CVE-2026-25783

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate User-Agent header tokens which allows an authenticated attacker to cause a request panic via a specially crafted User-Agent header. Mattermost Advisory ID: MMSA-2026-00586

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-1287

Affected software

No affected versions have been published.

Timeline

Published: Mar 16, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-257849.8Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows pr CVE-2026-257859.3Path traversal vulnerability exists in Lanscope Endpoint Manager (On-Premises) Sub-Manager Server Ver.9.4.7.3 and earlier, which may allow a CVE-2026-257869.1Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interface CVE-2026-257879.1Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the "Motion Control Diagnostics" page of the CVE-2026-257897.1Affected devices do not properly validate and sanitize filenames on the Firmware Update page. This could allow a remote attacker to social CVE-2026-25797.5The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the ‘search’ parameter CVE-2026-257907.2Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 3.9.0 and prior to version CVE-2026-257917.5Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.7.0, the DNS C2 listener accepts unauthenticated CVE-2026-257926.5Greenshot is an open source Windows screenshot utility. Versions 1.3.312 and below have untrusted executable search path / binary hijacking CVE-2026-257938.1Nebula is a scalable overlay networking tool. In versions from 1.7.0 to 1.10.2, when using P256 certificates (which is not the default confi CVE-2026-257948.2ImageMagick is free and open-source software used for editing and manipulating digital images. `WriteUHDRImage` in `coders/uhdr.c` uses `int CVE-2026-257957.5ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in