Mattermost versions 11.7.0 through 11.7.10 contain an authorization flaw where the API does not properly restrict which built-in roles a team admin can assign to team members. This allows a team admin to grant permissions beyond the configured permission scheme via the update-team-member-roles REST API endpoint. The vulnerability has a low severity rating with limited impact on confidentiality and integrity.
A vulnerability in Brotli was discovered where it incorrectly handled certain compressed streams. This flaw could allow a remote attacker to cause a denial of service or execute arbitrary code by providing specially crafted input. The issue affects multiple Ubuntu package versions and has been addressed in updated releases. Users are advised to update to the fixed package versions to mitigate the risk.
A code injection vulnerability exists in AllenAI AllenNLP up to version 2.10.1 in the Registrable.resolve_class_name function. This flaw allows remote attackers to manipulate the Type argument, potentially leading to code execution. The vulnerability affects unsupported versions, and no vendor response or patch is available. Public exploit code exists, increasing the risk of exploitation.
Multiple vulnerabilities were discovered in nginx affecting various configurations and features, including alias directive with rewrite rules, map directives with regex matching, HTTP/3 request handling with proxy_request_buffering enabled, asynchronous file I/O with Server Side Includes, and SSL session ticket key handling with shared session cache. These issues could allow remote attackers to cause denial of service via crashes, execute arbitrary code, inject data into proxied requests, or forge client SSL sessions to bypass client certificate verification. The vulnerabilities affect specific Ubuntu package versions and have been addressed in updated package releases.
CVE-2026-99095 is a vulnerability in the Linux kernel's drm/vc4 driver where the hangcheck timer and job completion works are not properly drained during V3D unbind. This leads to timer callbacks accessing freed memory, causing potential use-after-free conditions. The issue was identified by static analysis and has been resolved by ensuring the timer and related work are properly shut down and flushed during unbind.
A malicious file identified by the SHA-256 hash 5bb52bd682510c1fdc91025512a92c0e2323c885664e65ad32f0fbb426940469 was observed by OffSeq Mirage honeypot sensors on 2026-10-26. The file was detected four times during attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The malicious activity was traced to attacker infrastructure located in PS. Organizations are advised to match this hash against their environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash a863e21577e54cd763729803a621804da4b5030afa35bcf879ea3b3413488a66 was observed by OffSeq Mirage honeypot sensors during attacker activity on 2026-10-26. This file is associated with CVE-2026-109618 and linked to the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The file likely represents a malicious payload such as a dropper, web shell, miner, or post-exploitation tool used during the attack. The activity was traced back to attacker infrastructure in PS. Organizations are advised to match this hash against files in their environments and threat intelligence feeds.
A NULL pointer dereference vulnerability was found in gssproxy. When a GSSX_INIT_SEC_CONTEXT request is received with the target_name field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy daemon via its Unix socket. The daemon does not automatically restart, resulting in a persistent denial of service that also affects dependent services such as Kerberized NFS and IdM.
Mattermost versions 11.7.x <= 11.7.10 fail to apply outbound internal-connection filtering to the OpenID discovery endpoint request which allows a System Administrator to determine whether internal addresses and ports are reachable from the server via an unauthenticated login request that triggers the discovery fetch.. Mattermost Advisory ID: MMSA-2026-00774
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to bind the volume of text extracted from an uploaded PDF which allows an authenticated user to exhaust server memory and cause a denial of service via a crafted PDF whose compressed content stream expands into a very large amount of text.. Mattermost Advisory ID: MMSA-2026-00769
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 Mattermost fail to apply allocation limits to the byte-string decode paths in its WebSocket msgpack decoder, which allows an authenticated remote attacker to cause excessive server memory allocation via a crafted binary WebSocket frame declaring a Bin32 payload length of up to 4,294,967,295 bytes.. Mattermost Advisory ID: MMSA-2026-00768
An Allocation of Resources Without Limits or Throttling vulnerability exists in the HTTP/2 request body reader of the bandit web server. An unauthenticated remote attacker can exploit this by sending WINDOW_UPDATE or empty SETTINGS frames repeatedly, causing the server to hold stream processes open indefinitely. This affects bandit versions from 1.4.0 before 1.14.0 and can lead to resource exhaustion. The vulnerability has a high severity with a CVSS score of 8.7.
A vulnerability in the HTTP/2 implementation of the bandit server allows unauthenticated remote attackers to exhaust server memory by sending a small HPACK-compressed HEADERS block that references a large cookie value many times. This causes excessive memory allocation before application code runs, potentially leading to denial of service. The issue affects bandit versions from 0.3.3 up to but not including 1.14.0.
An inefficient algorithmic complexity vulnerability exists in the HTTP/2 implementation of the bandit server, allowing unauthenticated remote attackers to exhaust server CPU resources. The issue arises from the handling of small SETTINGS or connection-level WINDOW_UPDATE frames, which cause the server to perform costly O(n²) operations when many streams are blocked. This vulnerability affects bandit versions from 0.3.4 before 1.14.0 and has a high severity rating with a CVSS score of 8.7.
A vulnerability in the HTTP/2 implementation of the bandit server allows unauthenticated remote attackers to exhaust server memory by sending DATA frames beyond the advertised receive window without proper flow control. This causes the server's stream process to block and queue frames until memory is depleted. The issue affects multiple specific versions of bandit prior to 1.14.0 and has a high severity rating.
CVE-2026-93847 is an authorization vulnerability in Mattermost versions 11.7.0 through 11.7.10. It occurs because these versions fail to properly validate reserved system post types during scheduled post creation and publication. This flaw allows an authenticated channel member to publish messages that appear as trusted system events via the scheduled post endpoint.
Mattermost versions <=11.9 11.1.9 11.5.8 11.10.7.0 fail to validate Zoom chat line length before slicing which allows an authenticated attacker to crash the Agents plugin via summarizing a Zoom chat transcription containing short continuation lines. Mattermost Advisory ID: MMSA-2026-00723