CVE-2026-14934 Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab Enterprise

A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacker to escalate privileges and perform cross-tena...

CVE-2026-14934 Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab Enterprise

A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacker to escalate privileges and perform cross-tena...

CVE-2026-15546

creationtimestamp| type| source ---|---|--- 2026-07-13 09:45:55+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjfuhyoop2s 2026-07-13 10:17:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjhn4vufb26 2026-07-14 01:14:35+00:00| seen|...

CVE-2026-9708

creationtimestamp| type| source ---|---|--- 2026-07-13 09:41:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjflymjrr25 2026-07-13 09:51:01+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqjg5lvm5z2d 2026-07-13 09:51:01+00:00| seen|...

EUVD-2026-43315

Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path, which allows a deactivated guest user to obtain a fully functional session via a magic-link token issued prior to deactivation...

EUVD-2026-43288

The Tutor LMS WordPress plugin before 3.9.13 does not perform any authorization or post-target validation before creating a comment in one of its handlers, and stores the comment pre-approved, allowing authenticated users with subscriber-level access and above to post auto-approved comments...

CVE-2026-9597

Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path, which allows a deactivated guest user to obtain a fully functional session via a magic-link token issued prior to deactivation...

CVE-2026-14453

creationtimestamp| type| source ---|---|--- 2026-07-13 09:00:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/116911848014654725 2026-07-13 09:00:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mqjddarg6f2f 2026-07-13 09:08:06+00:00| seen|...

CVE-2026-57829

creationtimestamp| type| source ---|---|--- 2026-07-13 08:27:08+00:00| seen| https://bsky.app/profile/suriq.io/post/3mqjbhlhal325 2026-07-13 08:30:51+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjboanlg72i 2026-07-13 09:55:28+00:00| seen|...

CVE-2026-9597 Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint

Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path, which allows a deactivated guest user to obtain a fully functional session via a magic-link token issued prior to deactivation...

CVE-2026-9597

Mattermost advisory MMSA-2026-00681 documents a vulnerability in Mattermost where versions 11.7.x <= 11.7.2 and 11.6.x

CVE-2026-15539

creationtimestamp| type| source ---|---|--- 2026-07-13 07:45:17+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj74rd7b32z...

CVE-2026-12273

creationtimestamp| type| source ---|---|--- 2026-07-13 07:41:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj6vfbljy2y 2026-07-14 03:38:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqlbsllbjm2c...

CVE-2026-12081

creationtimestamp| type| source ---|---|--- 2026-07-13 07:38:43+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj6qz7b6s2f 2026-07-14 03:38:08+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqlbrqazvg26...

CVE-2026-4769

creationtimestamp| type| source ---|---|--- 2026-07-13 07:21:18+00:00| seen| https://infosec.exchange/users/certvde/statuses/116911458109125585 2026-07-13 07:54:49+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mqj7nsuneh2l 2026-07-13 08:30:05+00:00| seen|...

CVE-2026-12273

The Tutor LMS WordPress plugin, in versions prior to 3.9.13 , is vulnerable to an authorization and post-target validation flaw. A lack of proper checks in one of its handlers allows authenticated users with subscriber-level access and above to create comments across any content on the site. Beca...

CVE-2026-15516

creationtimestamp| type| source ---|---|--- 2026-07-13 01:31:58+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqikbabw3d23 2026-07-13 01:32:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqikbcff2j2i 2026-07-13 03:44:27+00:00| seen|...

CVE-2026-15551

creationtimestamp| type| source ---|---|--- 2026-07-13 01:30:39+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqik6uqc3l2e 2026-07-13 03:41:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqirjanmxp2z...

BIT-GITLAB-2025-12506 Use of Incorrectly-Resolved Name or Reference in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to create a repository where the content displayed in the web interface differed from t...

PT-2026-57870

Name of the Vulnerable Software and Affected Versions AnyDesk affected versions not specified Description A flaw in the handling of screen recording files allows a local attacker with low-privileged code execution capabilities to create a denial-of-service condition. The issue occurs when the...