https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T17:08:14.906872+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-16347 bdu:2025-16347 2026-10-08T17:08:14.909654+00:00 bdu:2025-16347 https://cve.radiocsirt.org/vuln/euvd-2026-263859 EUVD-2026-263859 2026-10-08T17:08:14.909684+00:00 EUVD-2026-263859 https://cve.radiocsirt.org/vuln/fkie_cve-2025-13352 fkie_cve-2025-13352 2026-10-08T17:08:14.909698+00:00

Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding which allows attackers to hijack the GitHub reaction feature to make users add reactions to arbitrary GitHub objects via crafted notification posts.

 https://cve.radiocsirt.org/vuln/ghsa-jf5h-xfw4-p8gp GHSA-jf5h-xfw4-p8gp — Mattermost GitHub Plugin Bot Identity Validation Bypass Allows Arbitrary GitHub Reaction Injection 2026-10-08T17:08:14.909729+00:00

Affected: Go: github.com/mattermost/mattermost/server/v8, Go: github.com/mattermost/mattermost, Go: github.com/mattermost/mattermost-plugin-github

Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding which allows attackers to hijack the GitHub reaction feature to make users add reactions to arbitrary GitHub objects via crafted notification posts.