EUVD-2026-12411

Mattermost Plugins versions =11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which allows an authorised attacker with editor permission to modify comments created by other board members. Mattermost Advisory ID: MMSA-2025-00559...

GHSA-2V3W-6G35-5F9V Mattermost fails to properly validate User-Agent header tokens

Mattermost versions 11.3.x = 11.3.0, 11.2.x = 11.2.2, 10.11.x = 10.11.10 fail to properly validate User-Agent header tokens which allows an authenticated attacker to cause a request panic via a specially crafted User-Agent header. Mattermost Advisory ID: MMSA-2026-00586...

UBUNTU-CVE-2026-2923

GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary dependi...

CVE-2026-25783

Mattermost versions 11.3.x = 11.3.0, 11.2.x = 11.2.2, 10.11.x = 10.11.10 fail to properly validate User-Agent header tokens which allows an authenticated attacker to cause a request panic via a specially crafted User-Agent header. Mattermost Advisory ID: MMSA-2026-00586...

CVE-2025-52638

HCL AION is affected by a vulnerability where generated containers may execute binaries with root-level privileges. Running containers with root privileges may increase the potential security risk, as it grants elevated permissions within the container environment. Aligning container configuratio...

CVE-2026-4265 Guest user can upload files without permission across teams

Mattermost versions 11.3.x = 11.3.0, 11.2.x = 11.2.2, 10.11.x = 10.11.10 fail to validate team-specific uploadfile permissions which allows a guest user to post files in channels where they lack uploadfile permission via uploading files in a team where they have permission and reusing the file...

CVE-2026-2461 Missing authorization check allows unauthorized modification of other users' comments on a board

Mattermost Plugins versions =11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which allows an authorised attacker with editor permission to modify comments created by other board members. Mattermost Advisory ID: MMSA-2025-00559...

CVE-2026-2476

Mattermost Plugins versions =2.0.3.0 fail to properly mask sensitive configuration values which allows an attacker with access to support packets to obtain original plugin settings via exported configuration data. Mattermost Advisory ID: MMSA-2026-00606...

CVE-2026-2476 MS Teams plugin sensitive config values not properly masked in support packets

Mattermost Plugins versions =2.0.3.0 fail to properly mask sensitive configuration values which allows an attacker with access to support packets to obtain original plugin settings via exported configuration data. Mattermost Advisory ID: MMSA-2026-00606...

CVE-2025-15553

Non-working logout functionality in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disclosure of local admin password...

PT-2026-25680

Name of the Vulnerable Software and Affected Versions Mattermost Plugins versions through 2.0.3.0 Description The Mattermost plugins do not properly mask sensitive configuration values. This allows an attacker with access to support packets to obtain original plugin settings through exported...

PT-2026-25676

Non-working logout functionality in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disclosure of local admin password...

Adobe Experience Manager cross-site scripting vulnerability (CNVD-2026-13947)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

EulerOS Virtualization 2.12.0 : edk2 (EulerOS-SA-2026-1528)

According to the versions of the edk2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful...

The vulnerabilities of the functions arch_dup_task_struct() and copy_thread() in the arch/s390/kernel/process.c module of the S390 platform support module of the Linux operating system allow a hacker to cause a service failure.

The vulnerability of the functions archduptaskstruct and copythread in the arch/s390/kernel/process.c module, which is part of the S390 platform support for the Linux operating system, relates to the re-release of previously released memory. Exploiting this vulnerability could allow an attacker t...

The vulnerability of the CUPS Filters printing package lies in the possibility of a write-off operation going beyond the buffer boundaries in memory, allowing an attacker to cause a service failure.

The vulnerability of the CUPS Filters printing package relates to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the dm_dmub_outbox1_low_irq() function in the drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c driver module of the Direct Rendering Infrastructure (DRI) support driver for AMD graphics cards in Linux operating systems allows a attacker to cause a service failure.

The vulnerability of the dmdmuboutbox1lowirq function in the drivers/gpu/drm/amd/display/amdgpudm/amdgpudm.c driver for AMD graphics cards’ kernel-based Linux operating system is related to a single-shift error. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the snd_pcm_lib_free_pages() function in the sound/core/pcm_memory.c module allows a hacker to cause a service failure in Linux-based systems.

The vulnerability of the sndpcmlibfreepages function in the sound/core/pcmmemory.c module, which is part of Linux’s kernel-based audio card support, relates to the assignment of pointers. Exploiting this vulnerability could allow an attacker to cause a service failure...

EulerOS Virtualization 2.12.0 : libssh (EulerOS-SA-2026-1496)

According to the versions of the libssh package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in libssh's handling of key exchange KEX processes when a client repeatedly sends incorrect KEX guesses. The librar...

The vulnerability of the `security_read_state_kernel()` function in the `security/selinux/ss/services.c` module of the Linux kernel’s security subsystem allows a attacker to trigger a service failure.

The vulnerability of the securityreadstatekernel function in the security/selinux/ss/services.c module of the Linux kernel’s security subsystem is related to improper memory release memory leak. Exploiting this vulnerability could allow an attacker to cause a service failure...