Search vulnerabilities

Expected end of text, found ':' (at char 35), (line:1, col:36)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,865

CVE-2026-15754

Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal

Mattermost versions 11.7.x <= 11.7.6, 11.8.x <= 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin's team, which allows an authenticated team administrator to remove ABAC (attribute-based access control) policy assignments from channels outside their team via the policy unassign API after a channel has been moved to another team.. Mattermost Advisory ID: MMSA-2026-00718

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2026-10527

Boards plugin retains Board Admin rights for users demoted to System Guest

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI.. Mattermost Advisory ID: MMSA-2026-00691

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2026-75911

CodeWhale before 0.8.64 Remote Code Execution via allow_shell

CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the repository in CodeWhale, the AI model gains access to exec_shell and task_shell tools, enabling execution of arbitrary shell commands on the victim's machine without explicit user consent.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Hmbown
Products
Codewhale
CVE-2026-75897

Uncontrolled Resource Consumption in Capabilities Route in OpenSearch Dashboards

Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to cause a denial of service via a crafted HTTP request.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Aws Opensearch
Products
Amazon Opensearch Service Opensearch Dashboards
CVE-2026-74009

WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Razorpay Wordpress
Products
Razorpay For Woocommerce Wordpress
CVE-2026-73360

WordPress Chaty Pro plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Premio Wordpress
Products
Chaty Pro Wordpress
CVE-2026-73352

WordPress GiveWP plugin <= 4.16.5.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Nexcess Wordpress
Products
Givewp Wordpress
CVE-2026-73343

WordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Aresit Wordpress
Products
Wp Compress Wordpress
CVE-2026-67262

Missing Authorization Enables Unauthorized LUN Access in Dell PowerStore

Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped host could exploit this vulnerability to read from or write to LUNs that the host is not authorized to access, bypassing per-initiator LUN access controls and leading to protection mechanism bypass.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Powerstore 1000t Powerstore 1200t Powerstore 3000t and 9 more