Security Vulnerabilities
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly handle very long passwords, which allows an attacker to overload the server CPU and memory via executing login attempts with multi-megabyte passwords. Mattermost Advisory ID: MMSA-2026-00587
CVSS Score
7.5
EPSS Score
0.001
Published
2026-03-16
Improper authentication in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to trigger a denial of service.
CVSS Score
6.5
EPSS Score
0.0
Published
2026-03-16
Path traversal in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to overwrite arbitrary files with Smart Switch privilege.
CVSS Score
6.5
EPSS Score
0.0
Published
2026-03-16
Improper authorization in Settings prior to SMR Mar-2026 Release 1 allows local attacker to disable configuring the background data usage of application.
CVSS Score
3.3
EPSS Score
0.0
Published
2026-03-16
Exposure of sensitive functionality to an unauthorized actor in Smart Switch prior to version 3.7.69.15 allows remote attackers to set a specific configuration.
CVSS Score
5.3
EPSS Score
0.001
Published
2026-03-16
Use of a broken or risky cryptographic algorithm in Smart Switch prior to version 3.7.69.15 allows remote attackers to configure a downgraded scheme for authentication.
CVSS Score
5.3
EPSS Score
0.0
Published
2026-03-16
Improper verification of cryptographic signature in Smart Switch prior to version 3.7.69.15 allows remote attackers to potentially bypass authentication.
CVSS Score
9.8
EPSS Score
0.001
Published
2026-03-16
Improper authentication in Smart Switch prior to version 3.7.69.15 allows remote attackers to bypass authentication.
CVSS Score
9.8
EPSS Score
0.002
Published
2026-03-16
Authentication bypass by replay in Smart Switch prior to version 3.7.69.15 allows remote attackers to trigger privileged functions.
CVSS Score
7.5
EPSS Score
0.001
Published
2026-03-16
Improper verification of intent by broadcast receiver in Settings prior to SMR Mar-2026 Release 1 allows local attacker to launch arbitrary activity with Settings privilege. User interaction is required for triggering this vulnerability.
CVSS Score
5.0
EPSS Score
0.0
Published
2026-03-16