https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-19T07:39:27.413558+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-319476 EUVD-2026-319476 2026-10-19T07:39:27.415679+00:00 EUVD-2026-319476 https://cve.radiocsirt.org/vuln/fkie_cve-2026-6333 fkie_cve-2026-6333 2026-10-19T07:39:27.415710+00:00

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate the Host header when constructing response URLs for custom slash commands which allows an authenticated attacker to redirect slash command responses to an attacker-controlled server via a spoofed Host header.. Mattermost Advisory ID: MMSA-2026-00582

 https://cve.radiocsirt.org/vuln/ghsa-vqp5-2mrp-qqxg GHSA-vqp5-2mrp-qqxg — Mattermost doesn't validate the Host header when constructing response URLs for custom slash command 2026-10-19T07:39:27.415740+00:00

Affected: Go: github.com/mattermost/mattermost/server/v8, Go: github.com/mattermost/mattermost-server

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate the Host header when constructing response URLs for custom slash commands which allows an authenticated attacker to redirect slash command responses to an attacker-controlled server via a spoofed Host header.. Mattermost Advisory ID: MMSA-2026-00582