Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-19601 | medium | 4.9 | No | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind pas... | 2026-10-29 |
| CVE-2026-19541 | medium | 6.5 | No | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client... | 2026-10-29 |
| CVE-2026-18795 | medium | 6.4 | No | Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on server side whic... | 2026-10-29 |
| CVE-2026-16453 | high | 7.1 | No | Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayS... | 2026-10-29 |
| CVE-2026-18223 | medium | 5.0 | No | Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email... | 2026-10-29 |
| CVE-2026-18256 | medium | 4.3 | No | Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from pu... | 2026-10-29 |
| CVE-2026-18560 | medium | 4.3 | No | Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before othe... | 2026-10-29 |
| CVE-2026-18799 | medium | 4.3 | No | Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack import account binding t... | 2026-10-29 |
| CVE-2026-85321 | high | 7.5 | No | Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny... | 2026-10-29 |
| CVE-2026-83564 | high | 7.0 | No | Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | 2026-10-29 |
| CVE-2026-18551 | medium | 6.5 | No | Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and a... | 2026-10-29 |
| CVE-2026-85828 | high | 7.0 | No | Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally. | 2026-10-29 |
| CVE-2026-98059 | medium | 5.5 | No | In the Linux kernel, the following vulnerability has been resolved: bpf: Mark sched_process_wait argument as nullable do_wait() passes wo-... | 2026-10-29 |
| CVE-2026-83765 | medium | 5.5 | No | Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally. | 2026-10-29 |
| CVE-2026-83766 | medium | 4.2 | No | Incorrect authorization in Windows Hyper-V allows an authorized attacker to bypass a security feature over an adjacent network. | 2026-10-29 |
| CVE-2026-83767 | high | 7.8 | No | Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. | 2026-10-29 |
| CVE-2026-83769 | high | 7.8 | No | Use after free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally. | 2026-10-29 |
| CVE-2026-46300 | high | 7.8 | Listed | In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coa... | 2026-10-29 |
| CVE-2026-41709 | low | 2.7 | Listed | VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations... | 2026-10-29 |
| CVE-2026-84392 | low | 2.7 | No | A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0... | 2026-10-29 |