CVE-2026-10106 Unauthorized users can trigger interactive post actions in private channels via action cookie channel mismatch in Mattermost

Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4, 10.11.x = 10.11.19 fail to verify that the channel referenced in an action cookie matches the channel of the target post, which allows an authenticated user without access to a private channel to trigger interactive post actions on posts in th...

CVE-2026-10103 Authenticated remote cluster can modify or delete posts it does not own in Mattermost Connected Workspaces shared channels

Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4, 10.11.x = 10.11.19 fail to verify post ownership in the shared channel inbound sync handler, which allows an authenticated remote cluster to modify or delete posts authored by local users or other remotes via crafted sync messages referencing...

CVE-2026-10103 Authenticated remote cluster can modify or delete posts it does not own in Mattermost Connected Workspaces shared channels

Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4, 10.11.x = 10.11.19 fail to verify post ownership in the shared channel inbound sync handler, which allows an authenticated remote cluster to modify or delete posts authored by local users or other remotes via crafted sync messages referencing...

CVE-2026-15528

creationtimestamp| type| source ---|---|--- 2026-07-13 07:51:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqj7gytgpj2e 2026-07-13 08:15:11+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-15528 2026-07-13 21:23:04+00:00| seen|...

CVE-2026-12396

creationtimestamp| type| source ---|---|--- 2026-07-13 07:42:12+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj6xam3rs2d 2026-07-13 21:00:07+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqklk2ngxy26 2026-07-14 03:11:42+00:00| seen|...

CVE-2026-12273

creationtimestamp| type| source ---|---|--- 2026-07-13 07:41:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj6vfbljy2y 2026-07-14 03:38:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqlbsllbjm2c...

CVE-2026-12397

creationtimestamp| type| source ---|---|--- 2026-07-13 07:37:29+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj6ostdds2z...

CVE-2026-15529

creationtimestamp| type| source ---|---|--- 2026-07-13 07:30:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqj6d6kql72q 2026-07-13 08:15:09+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-15529...

CVE-2026-15527

creationtimestamp| type| source ---|---|--- 2026-07-13 07:17:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqj5ltowjg26 2026-07-13 08:15:14+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-15527...

CVE-2026-12274

The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-leve...

CVE-2026-15531

creationtimestamp| type| source ---|---|--- 2026-07-13 06:30:26+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj2wvxzcs2e 2026-07-13 21:25:03+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkmwms2f32w...

CVE-2026-12274 Tutor LMS < 3.9.13 - Instructor+ Arbitrary Post Overwrite via IDOR

The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-leve...

CVE-2026-12274

CVE-2026-12274 affects the Tutor LMS WordPress plugin prior to 3.9.13. The underlying issue is that content-builder save handlers do not verify that the requesting user is authorized to edit the target post, instead authenticating only against an unrelated identifier. This allows authenticated us...

CVE-2026-9492

creationtimestamp| type| source ---|---|--- 2026-07-13 04:30:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/116910786151566204 2026-07-13 04:30:27+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mqiuaepo5j2r 2026-07-13 05:00:25+00:00| seen|...

CVE-2026-15551

creationtimestamp| type| source ---|---|--- 2026-07-13 01:30:39+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqik6uqc3l2e 2026-07-13 03:41:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqirjanmxp2z...

PT-2026-59686

A weakness has been identified in huggingface smolagents 1.24.0. Impacted is the function requests.get/requests.post of the component LocalPythonExecutor. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made...

PT-2026-57883

Name of the Vulnerable Software and Affected Versions MCP Appium versions prior to 1.85.10 Description The createLocatorGeneratorUI function fails to escape HTML or JavaScript context when interpolating element attributes—specifically text, content-desc, resource-id, and locator selector...

PT-2026-59369

Summary A user can modify another user's model even if its visibility is set to Private. The finding resulted from a penetration test for a customer. It is suspected that the root cause of the issue lies within the core of Open WebUI, which is why it is being reported as a security issue here...

CVE-2026-15506

creationtimestamp| type| source ---|---|--- 2026-07-12 22:29:18+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqia2lm2hr26 2026-07-12 23:41:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqie4dn33n2w 2026-07-13 01:00:36+00:00| seen|...

CVE-2026-15505

creationtimestamp| type| source ---|---|--- 2026-07-12 20:28:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqhzcc6z252e 2026-07-12 23:56:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqiex6yemk2x 2026-07-13 00:15:03+00:00| seen|...