74667 matches found
Authentication Bypass by Primary Weakness
Overview Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness in the magic-link token authentication process. An attacker can gain unauthorized access to a deactivated guest account by using a previously issued magic-link token. Remediation Upgrade...
EUVD-2026-43315
Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path, which allows a deactivated guest user to obtain a fully functional session via a magic-link token issued prior to deactivation...
CERTFR-2026-CTI-004
creationtimestamp| type| source ---|---|--- 2026-07-13 09:25:58+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/116911948082559856...
CVE-2026-9597
Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path, which allows a deactivated guest user to obtain a fully functional session via a magic-link token issued prior to deactivation...
EUVD-2026-43330
The charging station does not require authentication for Bluetooth commands to perform actions. The functionality exposed includes sensitive information leakage, triggering reboots, or pushing a firmware update URL...
CVE-2026-15542
creationtimestamp| type| source ---|---|--- 2026-07-13 08:36:26+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjbyagvs42f 2026-07-13 10:22:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjhw3d2bu2l...
CVE-2026-15540
creationtimestamp| type| source ---|---|--- 2026-07-13 08:33:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjbt62nwu27 2026-07-13 10:08:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjh4ix3v227...
CVE-2026-9597 Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint
Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path, which allows a deactivated guest user to obtain a fully functional session via a magic-link token issued prior to deactivation...
CVE-2026-9597
Mattermost advisory MMSA-2026-00681 documents a vulnerability in Mattermost where versions 11.7.x <= 11.7.2 and 11.6.x
CVE-2026-9597 Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint
Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path, which allows a deactivated guest user to obtain a fully functional session via a magic-link token issued prior to deactivation...
CVE-2026-9597 Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint
Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path, which allows a deactivated guest user to obtain a fully functional session via a magic-link token issued prior to deactivation...
CVE-2026-15539
creationtimestamp| type| source ---|---|--- 2026-07-13 07:45:17+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj74rd7b32z...
CVE-2026-15537
creationtimestamp| type| source ---|---|--- 2026-07-13 07:44:03+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj72kteyz2x 2026-07-16 07:53:03+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqqxg2xzi2y...
CVE-2026-15535
creationtimestamp| type| source ---|---|--- 2026-07-13 06:43:52+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj3ox62ao2z 2026-07-13 20:58:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqklgkcool2y 2026-07-16 07:52:05+00:00| seen|...
Malicious Package
Overview testdonotredeemit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview sixseven9 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
golang: Go os.Root: Symlink following vulnerability allows directory traversal
A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...
golang: Go os.Root: Symlink following vulnerability allows directory traversal
A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...