CVE-2026-9597 Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint

Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path, which allows a deactivated guest user to obtain a fully functional session via a magic-link token issued prior to deactivation...

CVE-2026-9597 Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint

Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path, which allows a deactivated guest user to obtain a fully functional session via a magic-link token issued prior to deactivation...

CVE-2026-15539

creationtimestamp| type| source ---|---|--- 2026-07-13 07:45:17+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj74rd7b32z...

CVE-2026-15537

creationtimestamp| type| source ---|---|--- 2026-07-13 07:44:03+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj72kteyz2x 2026-07-16 07:53:03+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqqxg2xzi2y...

CVE-2026-15535

creationtimestamp| type| source ---|---|--- 2026-07-13 06:43:52+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj3ox62ao2z 2026-07-13 20:58:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqklgkcool2y 2026-07-16 07:52:05+00:00| seen|...

Malicious Package

Overview testdonotredeemit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview sixseven9 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

CVE-2026-15517

creationtimestamp| type| source ---|---|--- 2026-07-13 04:18:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqitlob74327...

CVE-2026-15513

creationtimestamp| type| source ---|---|--- 2026-07-13 03:47:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqirtizk2z26...

PT-2026-60069

Name of the Vulnerable Software and Affected Versions Decidim versions prior to 0.30.9 Decidim versions 0.31.0 through 0.31.4 Decidim version 0.32.0.rc1 Description An issue exists in the download your data flow where the resulting Active Storage blob redirect URL can be replayed without...

The vulnerability of the /etc/boa/boa.conf file in the web interface of D-link DIR-823G router software allows a hacker to escalate their privileges.

The vulnerability of the /etc/boa/boa.conf file of the D-link DIR-823G router microprogramming software interface is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to elevate their privileges to the root level...

The vulnerability of the npm library extract-zip’s mechanism for processing symbolic links allows a hacker to execute arbitrary code.

The vulnerability of the npm library extract-zip’s mechanism for handling symbolic links is related to errors in link processing. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

The vulnerability of the nmk_pinctrl_dt_subnode_to_map() function in the drivers/pinctrl/nomadik/pinctrl-nomadik.c driver module, which is used by the PINCTRL output controller in the Linux operating system, allows a hacker to cause a service failure.

The vulnerability of the nmkpinctrldtsubnodetomap function in the drivers/pinctrl/nomadik/pinctrl-nomadik.c driver for Linux kernel-based GPIO controllers is related to errors during link counters updates. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-9597: Authentication Bypass by Primary Weakness

Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path, which allows a deactivated guest user to obtain a fully functional session via a magic-link token issued prior to deactivation...

PT-2026-60024

web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an Open Redirect vulnerability. If this vulnerability is exploited, the user may be redirected to an arbitrary website when accessing a specially crafted URL. As a result, the user may become a victim of a phishing atta...

PT-2026-57891

OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync feature that allows lower-trust callers to perform actions requiring stronger authorization. Attackers can exploit remote symlink parents to bypass policy checks and authorization boundaries when the...

PT-2026-59168

Summary The programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an attacker who can influence the scanned repository URL to trigger SSRF and...

PT-2026-57663

Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path, which allows a deactivated guest user to obtain a fully functional session via a magic-link token issued prior to deactivation...