Astra Linux – Vulnerability in rabbitMQ-server

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI through the rabbitmqfederationmanagement plugin, its consumer tag was rendered without proper tag sanitization. This potentially allows for...

WordPress PublishPress Authors plugin <= 4.15.0 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin PublishPress Authors versions = 4.15.0...

Astra Linux – Vulnerability in twitter-bootstrap3

A security vulnerability has been discovered in Bootstrap that could enable Cross-Site Scripting XSS attacks. The vulnerability is related to the “data-loading-text” attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into this attribute,...

Astra Linux – Vulnerability in LibreOffice

There is a vulnerability in input validation in the GStreamer integration of The Document Foundation LibreOffice, which allows an attacker to execute arbitrary GStreamer plugins. In affected versions, the filename of the embedded video is not properly escaped when passed to GStreamer, enabling an...

Astra Linux – Vulnerability in docker.io-app

Moby is an open-source container framework. Prior to version 29.3.1, a security vulnerability was detected that allowed attackers to bypass authorization plugins AuthZ. This issue has been fixed in version 29.3.1...

CVE-2026-9812

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate that a property field belongs to the specified run before updating its value which allows an authenticated user with run property-management access to crash the Playbooks plugin via a REST...

CVE-2026-78375

Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder Free and Pro 5.2.1 - 6.9.0 - plgContentSppagebuilder::onContentAfterSave read jformattribssppagebuilderarticleid from the request and concatenated it directly into the WHERE viewid ...

CVE-2026-13417

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate the type of fields.properties on block creation which allows an authenticated user with editor access to a board to crash the Boards plugin worker and trigger a denial of service via a child...

CVE-2026-10556

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service t...

CVE-2026-78375 Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.0

Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder Free and Pro 5.2.1 - 6.9.0 - plgContentSppagebuilder::onContentAfterSave read jformattribssppagebuilderarticleid from the request and concatenated it directly into the WHERE viewid ...

CVE-2026-78375 Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.0

Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder Free and Pro 5.2.1 - 6.9.0 - plgContentSppagebuilder::onContentAfterSave read jformattribssppagebuilderarticleid from the request and concatenated it directly into the WHERE viewid ...

CVE-2026-78375

SP Page Builder (Free and Pro) by joomshaper.com, a Joomla extension, is affected by an authenticated privileged SQL injection in versions 5.2.1 through 6.9.0 . The vulnerable function plgContentSppagebuilder::onContentAfterSave() reads jform[attribs][sppagebuilder_article_id] from the request an...

CVE-2026-10556 Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service t...

CVE-2026-10556

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service t...

EUVD-2026-77379

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service t...

CVE-2026-13417 Boards plugin denial of service via unvalidated block fields.properties

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate the type of fields.properties on block creation which allows an authenticated user with editor access to a board to crash the Boards plugin worker and trigger a denial of service via a child...

CVE-2026-13417

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate the type of "fields.properties" on block creation which allows an authenticated user with editor access to a board to crash the Boards plugin worker and trigger a denial of service via a chi...

CVE-2026-13417 Boards plugin denial of service via unvalidated block fields.properties

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate the type of fields.properties on block creation which allows an authenticated user with editor access to a board to crash the Boards plugin worker and trigger a denial of service via a child...

CVE-2026-9812 Missing property field ownership validation in Playbooks run property update endpoint

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate that a property field belongs to the specified run before updating its value which allows an authenticated user with run property-management access to crash the Playbooks plugin via a REST...

CVE-2026-9812 Missing property field ownership validation in Playbooks run property update endpoint

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate that a property field belongs to the specified run before updating its value which allows an authenticated user with run property-management access to crash the Playbooks plugin via a REST...