Security Vulnerabilities
Mattermost versions 10.11.x <= 10.11.18, 11.6.x <= 11.6.3, 11.5.x <= 11.5.6 fail to properly apply markdown image rendering restrictions to AI bot tool result posts, which allows an authenticated attacker to exfiltrate data to an attacker-controlled server via injecting markdown image syntax into tool result content rendered by a victim's client.. Mattermost Advisory ID: MMSA-2026-00619
CVSS Score
3.5
EPSS Score
0.002
Published
2026-06-26
In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings
CVSS Score
5.3
EPSS Score
0.002
Published
2026-06-26
In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details
CVSS Score
4.3
EPSS Score
0.002
Published
2026-06-26
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags
CVSS Score
4.3
EPSS Score
0.002
Published
2026-06-26
In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack
CVSS Score
2.6
EPSS Score
0.002
Published
2026-06-26
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint
CVSS Score
4.3
EPSS Score
0.002
Published
2026-06-26
In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible
CVSS Score
3.1
EPSS Score
0.001
Published
2026-06-26
In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata
CVSS Score
6.7
EPSS Score
0.002
Published
2026-06-26
Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} endpoints.
CVSS Score
7.7
EPSS Score
0.002
Published
2026-06-26
A flaw was found in KubeVirt's migration proxy. When spec.configuration.migrations.disableTLS is set to true on the KubeVirt custom resource, the target virt-handler binds a plain TCP listener on all interfaces (0.0.0.0/::) on a random port with no authentication, peer allow-list, or handshake token. This listener proxies directly into the target virt-launcher's virtqemud control socket. An attacker with a running pod on the cluster network can connect to this listener and issue unfiltered libvirt RPC commands against another tenant's virtual machine, including reading VM memory and configuration, modifying VM state via QMP, or destroying the VM. The bind address is unconditionally 0.0.0.0 — configuring a dedicated migration network via migrations.network only changes the advertised migration IP, not the listener bind address, so the port remains reachable on the pod network even when a dedicated migration network is configured. The API documentation describes disableTLS as removing "the additional layer of live migration encryption" without disclosing that it also removes all mutual authentication.
CVSS Score
8.5
EPSS Score
0.002
Published
2026-06-26