vulnbox-easy-CVE-2025-29927

Man-in-the-middle This application is named Man-in-the middle because it contains a vulnerability in Next.JS middleware and the flag is in the API call. 🚀 Production Setup 1. .env.production DATABASEURL=postgresql://postgres:password@db:5432/nextauth JWTSECRET=your-production-secret 2. Build and...

CVE-2026-122312

A flaw was found in Kyverno. An authenticated user with permissions to create namespaced policies can bypass namespace isolation restrictions by supplying a specially crafted API call URL path containing query strings. Because the path validation mechanism improperly handles query characters,...

IBM Aspera Faspex <=4.4.2 PL1 - Remote Code Execution

IBM Aspera Faspex through 4.4.2 Patch Level 1 is susceptible to remote code execution via a YAML deserialization flaw. This can allow an attacker to send a specially crafted obsolete API call and thereby execute arbitrary code, obtain sensitive data, and/or execute other unauthorized operations...

CVE-2026-18560

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to validate user’s permissions before other validations which allows non-content reviewers to infer a post’s flagged status via direct API call.. Mattermost Advisory ID: MMSA-2026-00754...

CVE-2026-18795

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID: MMSA-2026-00756...

CVE-2026-18560

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to validate user’s permissions before other validations which allows non-content reviewers to infer a post’s flagged status via direct API call.. Mattermost Advisory ID: MMSA-2026-00754...

EUVD-2026-102746

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to validate user’s permissions before other validations which allows non-content reviewers to infer a post’s flagged status via direct API call.. Mattermost Advisory ID: MMSA-2026-00754...

EUVD-2026-102813

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID: MMSA-2026-00756...

CVE-2026-18795 Missing server side validation allowed user to quarantine a DM and GM post

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID: MMSA-2026-00756...

CVE-2026-18795

Mattermost versions 11.10.x &lt;= 11.10.0, 11.7.x &lt;= 11.7.9, 11.9.x &lt;= 11.9.1, and 11.8.x

CVE-2026-18795 Missing server side validation allowed user to quarantine a DM and GM post

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID: MMSA-2026-00756...

CVE-2026-18795 Missing server side validation allowed user to quarantine a DM and GM post

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID: MMSA-2026-00756...

CVE-2026-18795

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID: MMSA-2026-00756...

PT-2026-115511

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID: MMSA-2026-00756...

PT-2026-115510

Name of the Vulnerable Software and Affected Versions Mattermost version 11.10.0 Mattermost versions 11.7.x through 11.7.9 Mattermost versions 11.9.x through 11.9.1 Mattermost versions 11.8.x through 11.8.5 Description An improper order of authorizations in the 'GetFile' API endpoint allows an...

CVE-2026-18560: Observable Discrepancy

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to validate user’s permissions before other validations which allows non-content reviewers to infer a post’s flagged status via direct API call.. Mattermost Advisory ID: MMSA-2026-00754...

CVE-2026-18795: Missing Authorization

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID: MMSA-2026-00756...

Rocky Linux 10.1 [CIQ] Security Update: systemd / systemd-boot-unsigned / systemd-container / etc (crlsa-2026_13651)

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202613651 advisory. systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data CVE-2026-29111 Tenable has extracted the preceding description...

Rocky Linux 9 [CIQ] Security Update: rhel-net-naming-sysattrs / systemd / systemd-boot-unsigned / etc (crlsa-2026_13677)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202613677 advisory. systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data CVE-2026-29111 Tenable has extracted the preceding description block...

Rocky Linux 10.2 [CIQ] Security Update: systemd / systemd-boot-unsigned / systemd-container / etc (crlsa-2026_19068)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202619068 advisory. systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data CVE-2026-29111 Tenable has extracted the preceding description...