Login Request a demo
MS
Product
Mattermost Server
by Mattermost · last CVE Oct 16, 2026
489
CVEs
0
On KEV
9.9
Max CVSS
3
New 30D
Vulnerabilities489In the news0Timeline
Severity mix
Critical 17High 85Medium 345Low 42
Severity
All severities489Critical17High85Medium345Low42
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Mattermost Server to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-4858
9.9
0%
May 21
Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token.
Affected: 10.11.0 before 10.11.15; 11.4.0 before 11.4.5; 11.5.0 before 11.5.4; 11.6.0
CVE-2025-12421
9.9
0%
Nov 27
Account Takeover via Code Exchange Endpoint
Affected: 10.5.0 before 10.5.13; 10.11.0 before 10.11.5; 10.12.0 before 10.12.2; 11.0.0 before 11.0.3
CVE-2025-12419
9.9
0%
Nov 27
Account takeover on OAuth/OpenID-enabled servers
Affected: 10.5.0 before 10.5.13; 10.11.0 before 10.11.5; 10.12.0 before 10.12.2; 11.0.0 before 11.0.4
CVE-2025-4981
9.9
1%
Jun 20
Path Traversal Leading to RCE by Any Authenticated Mattermost User
Affected: 9.11.0 before 9.11.16; 10.5.0 before 10.5.6; 10.6.0 before 10.6.6; 10.7.0 before 10.7.3; 10.8.0; 10.8.0; +2 more
CVE-2023-6458
9.8
1%
Dec 6
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perform a client-side path traversal
Affected: before 7.8.14; 8.0.0 before 8.1.5; 9.0.0 before 9.0.3; 9.1.0 before 9.1.2
CVE-2017-18920
9.8
1%
Jun 19
An issue was discovered in Mattermost Server before 3.6.2
Affected: before 3.6.2
CVE-2017-18915
9.8
1%
Jun 19
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7
Affected: 3.6.0 before 3.6.7; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2
CVE-2017-18908
9.8
1%
Jun 19
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2
Affected: before 3.9.2; 3.10.0 before 3.10.2
CVE-2016-11074
9.8
1%
Jun 19
An issue was discovered in Mattermost Server before 3.0.0
Affected: before 3.0.0
CVE-2017-18912
9.8
1%
Jun 19
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7
Affected: before 3.6.7; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2
CVE-2017-18900
9.8
1%
Jun 19
An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3
Affected: before 3.10.3; 4.0.0 before 4.0.4
CVE-2017-18888
9.8
1%
Jun 19
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2
Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0
CVE-2017-18885
9.8
1%
Jun 19
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2
Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0
CVE-2018-21251
9.8
1%
Jun 19
An issue was discovered in Mattermost Server before 5.2 and 5.1.1
Affected: before 5.1.1; 5.2.0; 5.2.0; 5.2.0; 5.2.0; 5.2.0; +1 more
CVE-2026-12985
9.3
0%
Sep 14
Mattermost DCR redirect URI allowlist bypass via improper URL component validation
Affected: 11.7.0 before 11.7.8; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1
CVE-2017-18911
9.1
1%
Jun 19
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7
Affected: before 3.6.7; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2
CVE-2017-18883
9.1
1%
Jun 19
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider
Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0
Showing 17