CVE-2026-10103 Authenticated remote cluster can modify or delete posts it does not own in Mattermost Connected Workspaces shared channels

Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4, 10.11.x = 10.11.19 fail to verify post ownership in the shared channel inbound sync handler, which allows an authenticated remote cluster to modify or delete posts authored by local users or other remotes via crafted sync messages referencing...

CVE-2026-15528

creationtimestamp| type| source ---|---|--- 2026-07-13 07:51:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqj7gytgpj2e 2026-07-13 08:15:11+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-15528 2026-07-13 21:23:04+00:00| seen|...

CVE-2026-12396

creationtimestamp| type| source ---|---|--- 2026-07-13 07:42:12+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj6xam3rs2d 2026-07-13 21:00:07+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqklk2ngxy26 2026-07-14 03:11:42+00:00| seen|...

CVE-2026-12273

creationtimestamp| type| source ---|---|--- 2026-07-13 07:41:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj6vfbljy2y 2026-07-14 03:38:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqlbsllbjm2c...

CVE-2026-12397

creationtimestamp| type| source ---|---|--- 2026-07-13 07:37:29+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj6ostdds2z...

CVE-2026-15529

creationtimestamp| type| source ---|---|--- 2026-07-13 07:30:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqj6d6kql72q 2026-07-13 08:15:09+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-15529...

CVE-2026-15527

creationtimestamp| type| source ---|---|--- 2026-07-13 07:17:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqj5ltowjg26 2026-07-13 08:15:14+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-15527...

CVE-2026-12274

The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-leve...

CVE-2026-15531

creationtimestamp| type| source ---|---|--- 2026-07-13 06:30:26+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj2wvxzcs2e 2026-07-13 21:25:03+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkmwms2f32w...

CVE-2026-12274 Tutor LMS < 3.9.13 - Instructor+ Arbitrary Post Overwrite via IDOR

The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-leve...

CVE-2026-12274

CVE-2026-12274 affects the Tutor LMS WordPress plugin prior to 3.9.13. The underlying issue is that content-builder save handlers do not verify that the requesting user is authorized to edit the target post, instead authenticating only against an unrelated identifier. This allows authenticated us...

CVE-2026-9492

creationtimestamp| type| source ---|---|--- 2026-07-13 04:30:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/116910786151566204 2026-07-13 04:30:27+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mqiuaepo5j2r 2026-07-13 05:00:25+00:00| seen|...

CVE-2026-15551

creationtimestamp| type| source ---|---|--- 2026-07-13 01:30:39+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqik6uqc3l2e 2026-07-13 03:41:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqirjanmxp2z...

PT-2026-57661

Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4, 10.11.x = 10.11.19 fail to validate the length and content of message attachment field values, which allows an authenticated attacker to cause a denial of service for all users in a channel via a post containing a specially crafted payload tha...

PT-2026-59686

A weakness has been identified in huggingface smolagents 1.24.0. Impacted is the function requests.get/requests.post of the component LocalPythonExecutor. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made...

PT-2026-60079

Summary Kimai 2.56.0 contains authenticated cross-site request forgery issues in its default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through GET routes and directly create or reuse a Team, add the current user as teamlead, and bind the target...

PT-2026-60087

Summary The Timesheet API PATCH /api/timesheets/id and POST /api/timesheets endpoints accept a user-supplied project ID and resolve it through a Symfony EntityType whose query builder allows the submitted ID to satisfy the access predicate via an unconditional OR branch. As a result, any...

PT-2026-59369

Summary A user can modify another user's model even if its visibility is set to Private. The finding resulted from a penetration test for a customer. It is suspected that the root cause of the issue lies within the core of Open WebUI, which is why it is being reported as a security issue here...

CVE-2026-15506

creationtimestamp| type| source ---|---|--- 2026-07-12 22:29:18+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqia2lm2hr26 2026-07-12 23:41:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqie4dn33n2w 2026-07-13 01:00:36+00:00| seen|...

CVE-2026-15505

creationtimestamp| type| source ---|---|--- 2026-07-12 20:28:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqhzcc6z252e 2026-07-12 23:56:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqiex6yemk2x 2026-07-13 00:15:03+00:00| seen|...