EUVD-2026-43307

Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4, 10.11.x = 10.11.19 fail to verify post ownership in the shared channel inbound sync handler, which allows an authenticated remote cluster to modify or delete posts authored by local users or other remotes via crafted sync messages referencing...

EUVD-2026-43289

The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-leve...

CVE-2026-10103

Mattermost versions affected: 11.7.x (up to 11.7.2), 11.6.x (up to 11.6.4), and 10.11.x (up to 10.11.19) have a flaw in the shared channel inbound sync handler that fails to verify post ownership. This allows an authenticated remote cluster to modify or delete posts authored by local users or oth...

CVE-2026-12274 Tutor LMS < 3.9.13 - Instructor+ Arbitrary Post Overwrite via IDOR

The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-leve...

CVE-2026-12274

The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-leve...

CVE-2026-7162

creationtimestamp| type| source ---|---|--- 2026-07-13 05:00:18+00:00| seen| https://bsky.app/profile/potato.software/post/3mqivvr66wf2l 2026-07-13 05:00:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqivvqbkwr2w 2026-07-13 07:21:40+00:00| seen|...

CVE-2026-15522

creationtimestamp| type| source ---|---|--- 2026-07-13 03:28:55+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqiqseevj52c 2026-07-13 03:32:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqiqz75lmn2x 2026-07-13 21:03:37+00:00| seen|...

CVE-2026-15523

creationtimestamp| type| source ---|---|--- 2026-07-13 03:27:57+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqiqqmy34f2d 2026-07-13 04:03:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqisqsy3vf26...

CVE-2026-15515

creationtimestamp| type| source ---|---|--- 2026-07-13 01:29:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqik4jlf3e2x 2026-07-13 01:30:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/116910078363580201 2026-07-13 01:30:27+00:00| seen|...

CVE-2026-10103: Authorization Bypass Through User-Controlled Key

Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4, 10.11.x = 10.11.19 fail to verify post ownership in the shared channel inbound sync handler, which allows an authenticated remote cluster to modify or delete posts authored by local users or other remotes via crafted sync messages referencing...

PT-2026-57636

The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-leve...

PT-2026-57857

The Smart Slider 3 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.1.37 via the 'keyword' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract titles and full content...

CVE-2026-15510

creationtimestamp| type| source ---|---|--- 2026-07-12 23:35:19+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqidqncgq226 2026-07-12 23:46:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqiefc2vp526 2026-07-13 03:15:05+00:00| seen|...

CVE-2026-15508

creationtimestamp| type| source ---|---|--- 2026-07-12 23:29:34+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqidge2kbd2x 2026-07-12 23:37:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqiduo2m3q2t 2026-07-13 03:15:03+00:00| seen|...

CVE-2026-58596

creationtimestamp| type| source ---|---|--- 2026-07-12 16:26:11+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqhlrbrzxl2s 2026-07-12 16:37:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqhmf2ynph2t 2026-07-12 17:00:14+00:00| seen|...

CVE-2026-56259

creationtimestamp| type| source ---|---|--- 2026-07-12 12:37:06+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqh6xnohbv2i 2026-07-12 12:58:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqha5ebg6o2e 2026-07-12 13:00:42+00:00| seen|...

CVE-2026-59260

creationtimestamp| type| source ---|---|--- 2026-07-12 12:33:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqh6rywql22e 2026-07-12 13:22:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqhbituyrk2t 2026-07-12 14:00:37+00:00| seen|...

CVE-2026-56271

creationtimestamp| type| source ---|---|--- 2026-07-12 12:33:19+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqh6qvmwwo2y 2026-07-12 12:46:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqh7hpkdws2f 2026-07-12 12:54:26+00:00| seen|...

CVE-2026-56260

creationtimestamp| type| source ---|---|--- 2026-07-12 12:32:38+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqh6poejfa2a 2026-07-12 12:51:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqh7qnobqh2k 2026-07-12 13:00:54+00:00| seen|...

CVE-2026-61875

creationtimestamp| type| source ---|---|--- 2026-07-12 12:31:28+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqh6nlrwqv2w 2026-07-12 13:00:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqhabhbgbv2r 2026-07-12 13:17:30+00:00| seen|...