CVE-2026-57390

creationtimestamp| type| source ---|---|--- 2026-07-13 10:56:39+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjjswzowh2e...

CVE-2026-57378

creationtimestamp| type| source ---|---|--- 2026-07-13 10:50:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjjhx2lvr22 2026-07-13 18:56:31+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkemzm2be22 2026-07-16 07:55:34+00:00| seen|...

EUVD-2026-43315

Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path, which allows a deactivated guest user to obtain a fully functional session via a magic-link token issued prior to deactivation...

CERTFR-2026-CTI-004

creationtimestamp| type| source ---|---|--- 2026-07-13 09:25:58+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/116911948082559856...

CVE-2026-9597

Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path, which allows a deactivated guest user to obtain a fully functional session via a magic-link token issued prior to deactivation...

CVE-2026-15542

creationtimestamp| type| source ---|---|--- 2026-07-13 08:36:26+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjbyagvs42f 2026-07-13 10:22:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjhw3d2bu2l...

CVE-2026-15540

creationtimestamp| type| source ---|---|--- 2026-07-13 08:33:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjbt62nwu27 2026-07-13 10:08:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjh4ix3v227...

CVE-2026-9597 Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint

Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path, which allows a deactivated guest user to obtain a fully functional session via a magic-link token issued prior to deactivation...

CVE-2026-9597

Mattermost advisory MMSA-2026-00681 documents a vulnerability in Mattermost where versions 11.7.x <= 11.7.2 and 11.6.x

CVE-2026-9597 Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint

Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path, which allows a deactivated guest user to obtain a fully functional session via a magic-link token issued prior to deactivation...

CVE-2026-15539

creationtimestamp| type| source ---|---|--- 2026-07-13 07:45:17+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj74rd7b32z...

CVE-2026-15537

creationtimestamp| type| source ---|---|--- 2026-07-13 07:44:03+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj72kteyz2x 2026-07-16 07:53:03+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqqxg2xzi2y...

CVE-2026-15535

creationtimestamp| type| source ---|---|--- 2026-07-13 06:43:52+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj3ox62ao2z 2026-07-13 20:58:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqklgkcool2y 2026-07-16 07:52:05+00:00| seen|...

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

CVE-2026-15517

creationtimestamp| type| source ---|---|--- 2026-07-13 04:18:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqitlob74327...

CVE-2026-15513

creationtimestamp| type| source ---|---|--- 2026-07-13 03:47:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqirtizk2z26...

PT-2026-59013

A vulnerability was identified in modelscope agentscope up to 1.0.18. Affected by this issue is the function parse url/prepare image/openai audio to text of the file src/agentscope/tool/ multi modality/ openai tools.py of the component Cloud Metadata Endpoint. Such manipulation of the argument...

PT-2026-57920

Name of the Vulnerable Software and Affected Versions HedgeDoc versions prior to 1.11.0 Description The GitHub Gist export flow fails to properly validate the OAuth2 state value, checking only for its presence instead of verifying it against the user session. This allows an attacker to forge a...

PT-2026-60069

Name of the Vulnerable Software and Affected Versions Decidim versions prior to 0.30.9 Decidim versions 0.31.0 through 0.31.4 Decidim version 0.32.0.rc1 Description An issue exists in the download your data flow where the resulting Active Storage blob redirect URL can be replayed without...