Recent Advisories

Severity ID Title Vendor Product Date Type
CRITICAL 9.4 CVE-2026-7165

Multiple vulnerabilities in the Assassin game by Gaudire_CVE-2026-7165

The vulnerability is present in the ‘/addJugador’ endpoint: * The 'keyJugador' and 'keyJugadorObjectiu' parameters allow the modification of ot...

Gaudire Assassin game last version CVE
MEDIUM 6.4 CVE-2026-6673

Mattermost Jira plugin had unauthenticated {{/ac/installed}} lifecycle callback during pending Jira Cloud install_CVE-2026-6673

Mattermost versions 11.7.x

Mattermost Mattermost 11.7.0 CVE
HIGH 7 CVE-2026-6653

libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling_CVE-2026-6653

Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-servic...

GNOME libxml2 2.9.11 CVE
MEDIUM 6.4 CVE-2026-6062

IDOR in Jira plugin subscription edit endpoint_CVE-2026-6062

Mattermost versions 11.7.x

Mattermost Mattermost 11.7.0 CVE
MEDIUM 5.4 CVE-2026-5139

GitLab Plugin Allows Non-Admin Users to Modify Default Instance Configuration_CVE-2026-5139

Mattermost versions 11.7.x

Mattermost Mattermost 11.7.0 CVE
MEDIUM 5.1 CVE-2026-56450

AIL Framework – Missing Rate Limiting Enables Brute-Force Attacks Against Two-Factor Authentication Codes_CVE-2026-56450

AIL did not restrict repeated failed attempts to verify a two-factor authentication (OTP) code. An attacker who had reached the 2FA verification st...

ail project ail framework CVE
HIGH 8.3 CVE-2026-56448

Authenticated Path Traversal in AIL Framework Investigation Downloads Allows Arbitrary File Read_CVE-2026-56448

A path traversal vulnerability exists in AIL Framework before the release containing commit 0041456af25da0cdea1c1c4624e46baff2731d8f. An authentica...

ail project ail framework CVE
CRITICAL 9.3 CVE-2026-56447

MISP remote code execution via arbitrary rdkafka configuration path_CVE-2026-56447

MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config setting to an arbitrary filesystem path. MISP subsequently parsed ...

misp misp CVE
HIGH 8.7 CVE-2026-56446

Authenticated Remote Code Execution via Arbitrary NDJSON Error Log Path in MISP_CVE-2026-56446

MISP allowed a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool. Because log entries can i...

misp misp CVE
CRITICAL 9.3 CVE-2026-56425

MISP AAD authentication plugin – Improper OAuth State Handling, Missing Session Rotation, Insecure Redirect URI Validation, and Log Injection_CVE-2026-56425

The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its OAuth 2.0 authorization flow that could allow a...

misp misp CVE