CVE-2026-4286 Playbooks Plugin fails to validate team transfers, allowing unauthorized removal of member access via playbook update

Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13 fail to check if teamid was being changed when updating playbooks, allowing users with only Manage Playbook Configurations permission to change a playbook's team, bypassing manage members restriction via PUT api. Mattermost Advisory ID:...

EUVD-2010-5029

Malware in sbrugna...

Design/Logic Flaw

popup.php in Virtual War aka VWar 1.6.1 R2 allows remote attackers to bypass intended member restrictions and read news posts via a modified newsid parameter in a printnews action...

CVE-2010-5065

popup.php in Virtual War aka VWar 1.6.1 R2 allows remote attackers to bypass intended member restrictions and read news posts via a modified newsid parameter in a printnews action...

PT-2012-1318

Name of the Vulnerable Software and Affected Versions Virtual War aka VWar version 1.6.1 R2 Description The issue allows remote attackers to bypass intended member restrictions and read news posts. This is achieved by modifying the newsid parameter in a "printnews" action. Recommendations For...

CVE-2010-5065: Undefined Security Weakness

popup.php in Virtual War aka VWar 1.6.1 R2 allows remote attackers to bypass intended member restrictions and read news posts via a modified newsid parameter in a printnews action...