76462 matches found
CVE-2026-9597 Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint
Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path, which allows a deactivated guest user to obtain a fully functional session via a magic-link token issued prior to deactivation...
CVE-2026-9597
Mattermost advisory MMSA-2026-00681 documents a vulnerability in Mattermost where versions 11.7.x <= 11.7.2 and 11.6.x
CVE-2026-9597
Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path, which allows a deactivated guest user to obtain a fully functional session via a magic-link token issued prior to deactivation...
CVE-2026-9597 Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint
Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path, which allows a deactivated guest user to obtain a fully functional session via a magic-link token issued prior to deactivation...
CVE-2026-9597 Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint
Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path, which allows a deactivated guest user to obtain a fully functional session via a magic-link token issued prior to deactivation...
CVE-2026-15539
creationtimestamp| type| source ---|---|--- 2026-07-13 07:45:17+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj74rd7b32z...
CVE-2026-15537
creationtimestamp| type| source ---|---|--- 2026-07-13 07:44:03+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj72kteyz2x 2026-07-16 07:53:03+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqqxg2xzi2y...
CVE-2026-15535
creationtimestamp| type| source ---|---|--- 2026-07-13 06:43:52+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj3ox62ao2z 2026-07-13 20:58:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqklgkcool2y 2026-07-16 07:52:05+00:00| seen|...
Malicious Package
Overview testdonotredeemit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview sixseven9 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
golang: Go os.Root: Symlink following vulnerability allows directory traversal
A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...
golang: Go os.Root: Symlink following vulnerability allows directory traversal
A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...
CVE-2026-15517
creationtimestamp| type| source ---|---|--- 2026-07-13 04:18:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqitlob74327...
CVE-2026-15513
creationtimestamp| type| source ---|---|--- 2026-07-13 03:47:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqirtizk2z26...
Windows Defender <= 1.1.26050.11 Elevation of Privilege (RoguePlanet) (CVE-2026-50656)
The Malware Protection Engine version of Microsoft Windows Defender installed on the remote Windows host is prior to or equal to 1.1.26050.11. It is, therefore, affected by an elevation of privilege vulnerability: - Improper link resolution before file access 'link following' in Microsoft Defende...
PT-2026-59602
Summary EntryPoint::FromStr in rattler conda types performs only .trim on the command field before the linker joins it onto the install prefix and writes an executable Python script. A malicious noarch:python package can ship an info/link.json with an entry-point name containing .., /, , or an...
PT-2026-59192
Impact Users of JupyterLab who click on a malicious link may get their Authorization and XSRFToken tokens exposed to a third party when running an older jupyter-server version. Patches JupyterLab 4.1.0b2, 4.0.11, and 3.6.7 were patched. Workarounds No workaround has been identified, however users...
PT-2026-58952
Description The normal download your data flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without authentication by anyone who obtains it. Technical description This private export flow turns an authenticated,...
PT-2026-57891
OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync feature that allows lower-trust callers to perform actions requiring stronger authorization. Attackers can exploit remote symlink parents to bypass policy checks and authorization boundaries when the...