PT-2026-78472

Name of the Vulnerable Software and Affected Versions Dell Command Update DCU versions prior to 5.7.1 Description Incorrect default permissions allow a low privileged attacker with local access to potentially gain filesystem access. Recommendations Update Dell Command Update DCU to version 5.7.1 ...

PT-2026-78471

Dell Command Update DCU, versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...

PT-2026-78445

Name of the Vulnerable Software and Affected Versions Dell Command Update DCU versions prior to 5.7.1 Description A Time-of-check Time-of-use TOCTOU Race Condition exists, which occurs when a program checks the state of a resource and then acts upon that resource, but the state changes between th...

CVE-2026-56796: Improper Link Resolution Before File Access

Dell Command Update DCU, versions prior to 5.7.1, contain an Improper Link Resolution Before File Access 'Link Following' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...

PT-2026-78440

Name of the Vulnerable Software and Affected Versions Dell Command Update DCU versions prior to 5.7.1 Description An issue exists involving the deserialization of untrusted data. A low privileged attacker with local access could exploit this to achieve elevation of privileges. Deserialization is...

CVE-2026-58562: Missing Authorization

Dell Command Update DCU, versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...

PT-2026-78479

Name of the Vulnerable Software and Affected Versions Dell Command Update DCU versions prior to 5.7.1 Description An Improper Restriction of XML External Entity Reference exists, which allows a low privileged attacker with local access to potentially achieve elevation of privileges and Server-sid...

PT-2026-78478

Dell Command Update DCU, versions prior to 5.7.1, contain an Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure...

PT-2026-78473

Name of the Vulnerable Software and Affected Versions Dell Command Update DCU versions prior to 5.7.1 Description Missing authorization allows a low privileged attacker with local access to achieve elevation of privileges. Recommendations Update Dell Command Update DCU to version 5.7.1 or later...

PT-2026-78441

Name of the Vulnerable Software and Affected Versions Dell Command Update versions prior to 5.7.1 Description An issue involving the deserialization of untrusted data allows a low privileged attacker with local access to escalate their privileges to SYSTEM level. Deserialization is the process of...

CVE-2026-67268: Improper Restriction of XML External Entity Reference

Dell Command Update DCU, versions prior to 5.7.1, contain an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges and Server-side request forgery...

PT-2026-78477

Name of the Vulnerable Software and Affected Versions Dell Command Update DCU versions prior to 5.7.1 Description An Incorrect Authorization issue exists where a low privileged attacker with local access could potentially exploit the flaw to achieve Elevation of privileges. Recommendations Update...

PT-2026-78469

Dell Command Update DCU, versions prior to 5.7.1, contain a Time-of-check Time-of-use TOCTOU Race Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the command update API. An attacker can impersonate existing system or custom commands by editing their own slash command trigger to match an already-registered trigger, potentially hijacking command...

Incorrect Authorization

Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Incorrect Authorization via the command update API. An attacker can impersonate existing system or custom commands by editing their own slash...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the command update API. An attacker can impersonate existing system or custom commands by editing their own slash command trigger to match an already-registered trigger, potentially hijacking command...

Mattermost doesn't enforce slash command trigger-word uniqueness during command updates

Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13, 11.4.x = 11.4.3 Fail to enforce slash command trigger-word uniqueness during command updates which allows an authenticated team member with Manage Own Slash Commands permission to hijack and impersonate existing system or custom slash...

CVE-2026-28732

Mattermost fixes are for versions 11.5.x (up to 11.5.1), 10.11.x (up to 10.11.13), and 11.4.x (up to 11.4.3). The issue is a failure to enforce slash command trigger-word uniqueness during command updates, allowing an authenticated team member with Manage Own Slash Commands permission to hijack o...

PT-2026-41649

Name of the Vulnerable Software and Affected Versions Mattermost versions prior to 11.5.2 Mattermost versions prior to 10.11.14 Mattermost versions prior to 11.4.4 Description An issue exists where the system fails to enforce trigger-word uniqueness during the update of slash commands. This allow...

CVE-2026-28732: Incorrect Authorization

Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13, 11.4.x = 11.4.3 Fail to enforce slash command trigger-word uniqueness during command updates which allows an authenticated team member with Manage Own Slash Commands permission to hijack and impersonate existing system or custom slash...