https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-21T06:27:56.800997+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2024-30629 cnvd-2024-30629 2026-10-21T06:27:56.803487+00:00 cnvd-2024-30629 https://cve.radiocsirt.org/vuln/euvd-2026-5663 EUVD-2026-5663 2026-10-21T06:27:56.803524+00:00 EUVD-2026-5663 https://cve.radiocsirt.org/vuln/fkie_cve-2024-36257 fkie_cve-2024-36257 2026-10-21T06:27:56.803545+00:00

Mattermost versions 9.5.x <= 9.5.5 and 9.8.0, when using shared channels with multiple remote servers connected, fail to check that the remote server A requesting the server B to update the profile picture of a user is the remote that actually has the user as a local one . This allows a malicious remote A to change the profile images of users that belong to another remote server C that is connected to the server A.

 https://cve.radiocsirt.org/vuln/ghsa-5cg2-wmx6-ccqv GHSA-5cg2-wmx6-ccqv 2026-10-21T06:27:56.803590+00:00

Mattermost versions 9.5.x <= 9.5.5 and 9.8.0, when using shared channels with multiple remote servers connected, fail to check that the remote server A requesting the server B to update the profile picture of a user is the remote that actually has the user as a local one . This allows a malicious remote A to change the profile images of users that belong to another remote server C that is connected to the server A.