3336 matches found
CVE-2026-0998
CVE-2026-0998 affects Mattermost releases 11.1.x up to 11.1.2, 10.11.x up to 10.11.9, 11.2.x up to 11.2.1 and Mattermost Plugin Zoom up to 1.11.0. The issue is in the {{/api/v1/askPMI}} endpoint where user identity and post ownership are not validated, allowing unauthorized users to start Zoom me...
CVE-2026-0998 Mattermost Zoom Plugin allows unauthorized meeting creation and post modification via insufficient API access controls
Mattermost versions 11.1.x = 11.1.2, 10.11.x = 10.11.9, 11.2.x = 11.2.1 and Mattermost Plugin Zoom versions =1.11.0 fail to validate user identity and post ownership in the /api/v1/askPMI endpoint which allows unauthorized users to start Zoom meetings as any user and overwrite arbitrary posts via...
Mattermost 安全漏洞
Mattermost is an open-source collaboration platform developed by the American company Mattermost. There are security vulnerabilities in Mattermost versions 11.1.2 and earlier 11.1.x series, 10.11.9 and earlier 10.11.x series, 11.2.1 and earlier 11.2.x series, as well as in Mattermost Plugin Zoom...
PT-2026-8328
Name of the Vulnerable Software and Affected Versions Mattermost versions 11.1.x through 11.1.2 Mattermost versions 10.11.x through 10.11.9 Mattermost versions 11.2.x through 11.2.1 Mattermost Plugin Zoom versions through 1.11.0 Description The Mattermost application and its Zoom plugin do not...
PT-2026-8329
Name of the Vulnerable Software and Affected Versions Mattermost versions 11.1.x through 11.1.2 Mattermost versions 10.11.x through 10.11.9 Mattermost versions 11.2.x through 11.2.1 Mattermost Plugin Zoom versions through 1.11.0 Description The software does not properly validate user identity an...
Mattermost 安全漏洞
Mattermost is an open-source collaboration platform developed by the American company Mattermost. There are security vulnerabilities in Mattermost versions 11.1.2 and earlier 11.1.x series, 10.11.9 and earlier 10.11.x series, 11.2.1 and earlier 11.2.x series, as well as in Mattermost Plugin Zoom...
North Korea-Linked UNC1069 Uses AI Lures to Attack Cryptocurrency Organizations
The North Korea-linked threat actor known as UNC1069 has been observed targeting the cryptocurrency sector to steal sensitive data from Windows and macOS systems with the ultimate goal of facilitating financial theft. "The intrusion relied on a social engineering scheme involving a compromised...
PT-2026-4358
This High severity XXE XML External Entity Injection vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. This XXE XML External Entity Injection vulnerability, with a CVSS Score of 7.9, allows an authenticated attacker to access local and remote content which has high...
Zoom and GitLab Release Security Updates Fixing RCE, DoS, and 2FA Bypass Flaws
Zoom and GitLab have released security updates to resolve a number of security vulnerabilities that could result in denial-of-service DoS and remote code execution. The most severe of the lot is a critical security flaw impacting Zoom Node Multimedia Routers MMRs that could permit a meeting...
CVE-2026-22844
A Command Injection vulnerability in Zoom Node Multimedia Routers MMRs before version 5.2.1716.0 may allow a meeting participant to conduct remote code execution of the MMR via network access...
CVE-2026-22844
A Command Injection vulnerability in Zoom Node Multimedia Routers MMRs before version 5.2.1716.0 may allow a meeting participant to conduct remote code execution of the MMR via network access...
CVE-2026-22844 Zoom Node Deployments - Command Injection
A Command Injection vulnerability in Zoom Node Multimedia Routers MMRs before version 5.2.1716.0 may allow a meeting participant to conduct remote code execution of the MMR via network access...
CVE-2026-22844
A Command Injection vulnerability in Zoom Node Multimedia Routers MMRs before version 5.2.1716.0 may allow a meeting participant to conduct remote code execution of the MMR via network access...
CVE-2026-22844 Zoom Node Deployments - Command Injection
A Command Injection vulnerability in Zoom Node Multimedia Routers MMRs before version 5.2.1716.0 may allow a meeting participant to conduct remote code execution of the MMR via network access...
PT-2026-3570
Name of the Vulnerable Software and Affected Versions Zoom Node Multimedia Routers MMRs versions prior to 5.2.1716.0 Description A critical command injection flaw exists in Zoom Node Multimedia Routers MMRs. This flaw allows a meeting participant to conduct remote code execution RCE on the MMR vi...
Zoom Node Meetings Hybrid and Zoom Node Meeting Connector security vulnerabilities
Zoom Node Meetings Hybrid and Zoom Node Meeting Connector are both products of the American company Zoom. Zoom Node Meetings Hybrid is a hybrid cloud deployment solution. Zoom Node Meeting Connector is a meeting service module. Both Zoom Node Meetings Hybrid and Zoom Node Meeting Connector have...
Firefox joins Chrome and Edge as sleeper extensions spy on users
A group of cybercriminals called DarkSpectre is believed to be behind three campaigns spread by malicious browser extensions: ShadyPanda, GhostPoster, and Zoom Stealer. We wrote about the ShadyPanda campaign in December 2025, warning users that extensions which had behaved normally for years...
CVE-2026-1048
A weakness has been identified in LigeroSmart up to 6.1.26. Impacted is an unknown function of the file /otrs/index.pl?Action=AgentTicketZoom. This manipulation of the argument TicketID causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made availabl...
CVE-2026-1048
A weakness has been identified in LigeroSmart up to 6.1.26. Impacted is an unknown function of the file /otrs/index.pl?Action=AgentTicketZoom. This manipulation of the argument TicketID causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made availabl...
CVE-2026-1048 LigeroSmart index.pl cross site scripting
A weakness has been identified in LigeroSmart up to 6.1.26. Impacted is an unknown function of the file /otrs/index.pl?Action=AgentTicketZoom. This manipulation of the argument TicketID causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made availabl...