CVE-2026-56323

Capgo CVE-2026-56323 affects Capgo before 12.128.2. The /functions/v1/channel_self endpoint allows unauthenticated information disclosure, enabling enumeration of non-public channel names, app existence, and subscription status. Remote attackers can issue GET requests with arbitrary app_id to rev...

CVE-2026-56323 Capgo - Unauthenticated Channel Enumeration and App Oracle via GET /channel_self

Capgo before 12.128.2 contains an information disclosure vulnerability in the /functions/v1/channelself endpoint that allows unauthenticated attackers to enumerate non-public channel names and determine app existence and subscription status. Remote attackers can send GET requests with arbitrary...

CVE-2026-56323 Capgo - Unauthenticated Channel Enumeration and App Oracle via GET /channel_self

Capgo before 12.128.2 contains an information disclosure vulnerability in the /functions/v1/channelself endpoint that allows unauthenticated attackers to enumerate non-public channel names and determine app existence and subscription status. Remote attackers can send GET requests with arbitrary...

Paymenter doesn't reset email verification status after email change

Summary The email update functionality fails to invalidate the existing verification state when a user changes their email address, allowing a verified account to retain its verified status after switching to an unverified or unowned email address. Technical Details When a user updated their emai...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication in the email update process. An attacker can retain a verified status on an account after changing the associated email address to one they do not control by updating the email without triggering a new verificati...

GHSA-RV89-WCH8-C574 Paymenter doesn't reset email verification status after email change

Summary The email update functionality fails to invalidate the existing verification state when a user changes their email address, allowing a verified account to retain its verified status after switching to an unverified or unowned email address. Technical Details When a user updated their emai...

PYSEC-2026-2112

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save and then restored later with CookieJar.load lose their host-only status. This vulnerability is fixed in 3.14.1...

MINI-VCQC-Q43R-9CX2

Bulletin has no description...

CVE-2026-6653

creationtimestamp| type| source ---|---|--- 2026-06-22 16:30:16+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3movco6cnwk26 2026-07-08 12:00:55+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mq533bbiim2i 2026-07-10 12:01:08+00:00| seen|...

Incorrect Authorization

Overview github.com/mattermost/mattermost/server/v8/channels/api4 is a platform for secure collaboration across the entire software development lifecycle Affected versions of this package are vulnerable to Incorrect Authorization through the demote-user API process. An attacker can degrade bot...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the demote-user API process. An attacker can degrade bot accounts to guest status without possessing bot-management permissions by targeting bot accounts as demotion targets. Remediation Upgrade...

CVE-2026-5139

creationtimestamp| type| source ---|---|--- 2026-06-22 15:54:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3movanaj4zd2t...

GHSA-G5VR-6PGG-74QV Mattermost doesn't enforce bot-specific permission checks on the user active status endpoint

Mattermost versions 11.7.x = 11.7.0, 10.11.x = 10.11.17 fail to enforce bot-specific permission checks on the user active status endpoint, which allows a User Manager with user management write access but no Integrations access to deactivate bot accounts via the PUT /api/v4/users/id/active API...

Mattermost doesn't enforce bot-specific permission checks on the user active status endpoint

Mattermost versions 11.7.x = 11.7.0, 10.11.x = 10.11.17 fail to enforce bot-specific permission checks on the user active status endpoint, which allows a User Manager with user management write access but no Integrations access to deactivate bot accounts via the PUT /api/v4/users/id/active API...

httpd: mod_md: unrestricted OCSP response leads to resource exhaustion

A flaw was found in the modmd module of httpd. When processing OCSP Online Certificate Status Protocol responses from a malicious or compromised OCSP responder, the module fails to enforce proper size limits on the incoming data. This issue leads to memory exhaustion and a denial of service...

httpd: mod_md: unrestricted OCSP response leads to resource exhaustion

A flaw was found in the modmd module of httpd. When processing OCSP Online Certificate Status Protocol responses from a malicious or compromised OCSP responder, the module fails to enforce proper size limits on the incoming data. This issue leads to memory exhaustion and a denial of service...

OPENSUSE-SU-2026:21020-1 Security update for postfix

This update for postfix fixes the following issue - CVE-2026-43964: buffer overread and process crash via an enhanced status code that lacks text after the third number bsc1264062...

SUSE-SU-2026:22335-1 Security update for postfix

This update for postfix fixes the following issue - CVE-2026-43964: buffer overread and process crash via an enhanced status code that lacks text after the third number bsc1264062...

MINI-WRJG-485M-87R3

Bulletin has no description...

CVE-2026-8074

Mattermost versions 11.7.x = 11.7.0, 10.11.x = 10.11.17 fail to enforce bot-specific permission checks on the user active status endpoint, which allows a User Manager with user management write access but no Integrations access to deactivate bot accounts via the PUT /api/v4/users/id/active API...