Login Request a demo
MA
Vendor
Mattermost
17 products with CVEs on record
821
CVEs
0
On KEV
25
New 30D
Products
MA
Mattermost
Mattermost
9.9
245 CVEs0 on KEV22 new
MS
Mattermost Server
Mattermost
9.9
489 CVEs0 on KEV3 new
MD
Mattermost Desktop
Mattermost
9.8
34 CVEs0 on KEV0 new
MM
Mattermost Mobile
Mattermost
7.5
21 CVEs0 on KEV0 new
CO
Confluence
Mattermost
7.5
14 CVEs0 on KEV0 new
FO
Focalboard
Mattermost
6.5
2 CVEs0 on KEV0 new
LH
Legal Hold
Mattermost
8.8
2 CVEs0 on KEV0 new
MB
Mattermost Boards
Mattermost
7.5
2 CVEs0 on KEV0 new
MT
MS Teams
Mattermost
5.9
2 CVEs0 on KEV0 new
PL
Playbooks
Mattermost
8.8
2 CVEs0 on KEV0 new
ZO
Zoom
Mattermost
4.3
2 CVEs0 on KEV0 new
CE
Channel Export
Mattermost
4.3
1 CVEs0 on KEV0 new
GI
github.com/mattermost/mattermost/server/public
Mattermost
5.4
1 CVEs0 on KEV0 new
GD
Google Drive
Mattermost
4.3
1 CVEs0 on KEV0 new
MG
Mattermost Google Drive Plugin
Mattermost
4.3
1 CVEs0 on KEV0 new
MP
Mattermost Packages
Mattermost
9.8
1 CVEs0 on KEV0 new
MP
Mattermost Plugins
Mattermost
7.5
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-93846
New
MA
Mattermost
Mattermost
3.8
0%
Oct 26Team admin can escalate a team member's permissions via the team member roles endpoint
CVE-2026-93848
New
MA
Mattermost
Mattermost
2.7
0%
Oct 26Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator
CVE-2026-93850
New
MA
Mattermost
Mattermost
6.5
0%
Oct 26Unbounded memory consumption during PDF text extraction
CVE-2026-93849
New
MA
Mattermost
Mattermost
6.5
0%
Oct 26Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames
CVE-2026-93847
New
MA
Mattermost
Mattermost
3.5
0%
Oct 26Improper post type validation on scheduled post endpoints
CVE-2026-116516
New
MA
Mattermost
Mattermost
6.5
0%
Oct 26Insufficient length validation when parsing Zoom chat transcriptions
CVE-2026-13411
New
MA
Mattermost
Mattermost
4.3
0%
Oct 22Null condition in Playbooks import crashes the plugin
CVE-2026-18799
MA
Mattermost
Mattermost
4.3
0%
Oct 16Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users
CVE-2026-16251
MA
Mattermost
Mattermost
6.5
0%
Oct 16Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering
CVE-2026-18256
MA
Mattermost
Mattermost
4.3
0%
Oct 16Private team metadata disclosure via the team search API
CVE-2026-18223
MA
Mattermost
Mattermost
5.0
0%
Oct 16Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access
CVE-2026-19076
MA
Mattermost
Mattermost
4.9
0%
Oct 16Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token
CVE-2026-18560
MA
Mattermost
Mattermost
4.3
0%
Oct 16Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status
CVE-2026-16453
MA
Mattermost
Mattermost
7.1
0%
Oct 16Mattermost SAML RelayState forgery allows unauthorized team membership
CVE-2026-19600
MA
Mattermost
Mattermost
4.9
0%
Oct 16Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts
CVE-2026-19621
MA
Mattermost
Mattermost
6.5
0%
Oct 16Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads
CVE-2026-19603
MA
Mattermost
Mattermost
4.3
0%
Oct 16Private channel ID disclosure via user status endpoints
CVE-2026-18795
MA
Mattermost
Mattermost
6.4
0%
Oct 16Missing server side validation allowed user to quarantine a DM and GM post
CVE-2026-19867
MA
Mattermost
Mattermost
4.3
0%
Oct 16Uncapped mention keys in user notification properties allow CPU exhaustion during post processing
CVE-2026-19601
MA
Mattermost
Mattermost
4.9
0%
Oct 16Disclosure of AD/LDAP bind password via Test Connection
CVE-2026-18551
MA
Mattermost
Mattermost
6.5
0%
Oct 16Mattermost guest account privilege escalation via member roles API
CVE-2026-19541
MA
Mattermost
Mattermost
6.5
0%
Oct 16Outgoing OAuth connection client secret exposure during connection validation
CVE-2026-96260
MA
Mattermost
Mattermost
6.5
0%
Sep 22Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user
CVE-2026-96259
MA
Mattermost
Mattermost
5.5
0%
Sep 22Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator
CVE-2026-95666
MA
Mattermost
Mattermost
4.3
0%
Sep 22Unbounded post ID array in the bulk reactions endpoint allows denial of service
CVE-2026-12284
MA
Mattermost
Mattermost
3.7
0%
Sep 17Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler
CVE-2026-75588
MA
Mattermost
Mattermost
2.6
0%
Sep 17Mattermost Desktop App plugin popout scheme validation bypass
CVE-2026-75025
MA
Mattermost
Mattermost
4.7
0%
Sep 16Mattermost Desktop local network access from server-rendered content
CVE-2026-91181
MA
Mattermost
Mattermost
6.5
0%
Sep 14Data Retention Teams Endpoint Leaks Private Team Invite ID
CVE-2026-12985
MA
Mattermost
Mattermost
9.3
0%
Sep 14Mattermost DCR redirect URI allowlist bypass via improper URL component validation
CVE-2026-82920
MA
Mattermost
Mattermost
5.5
0%
Sep 14Mattermost ABAC parent policy bypass via policy update endpoint
CVE-2026-86348
MA
Mattermost
Mattermost
4.3
0%
Sep 14MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process
CVE-2026-86349
MA
Mattermost
Mattermost
4.3
0%
Sep 14Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting
CVE-2026-10556
MA
Mattermost
Mattermost
5.3
0%
Sep 14Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.
CVE-2026-13417
MA
Mattermost
Mattermost
4.3
0%
Sep 14Boards plugin denial of service via unvalidated block fields.properties
CVE-2026-9812
MA
Mattermost
Mattermost
6.5
0%
Sep 14Missing property field ownership validation in Playbooks run property update endpoint
CVE-2026-8821
MA
Mattermost
Mattermost
7.1
0%
Sep 14Playbooks run owner channel membership permission bypass
CVE-2026-5132
MA
Mattermost
Mattermost
6.5
0%
Sep 14Unbounded zlib decompression in Calls SDP WebSocket messages
CVE-2026-15814
MA
Mattermost
Mattermost
6.5
0%
Sep 14Uploading a crafted image causes excessive memory allocation in the Mattermost Server
CVE-2026-10542
MA
Mattermost
Mattermost
4.3
0%
Sep 14Playbooks channel action update validation issue
CVE-2026-14344
MA
Mattermost
Mattermost
4.3
0%
Sep 14Inconsistent authorization checks in Mattermost Boards endpoints
CVE-2026-12882
MA
Mattermost
Mattermost
4.3
0%
Sep 14Mattermost Markdown autolink parsing denial of service
CVE-2026-11993
MA
Mattermost
Mattermost
4.3
0%
Sep 14Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustion
CVE-2026-14259
MA
Mattermost
Mattermost
4.3
0%
Sep 14Board archive import bypasses team board creation permissions
CVE-2026-75587
MA
Mattermost
Mattermost
3.3
0%
Aug 17Plaintext pre-auth secret exposure via Desktop App diagnostics report
CVE-2026-9693
MA
Mattermost
Mattermost
3.5
0%
Aug 17Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite
CVE-2026-9859
MA
Mattermost
Mattermost
6.5
0%
Aug 17Mattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors to expose boards to arbitrary channels
CVE-2026-9816
MA
Mattermost
Mattermost
8.3
0%
Aug 17Insufficient server-side validation of board member role fields permits privilege escalation
CVE-2026-10080
MA
Mattermost
Mattermost
6.5
0%
Aug 17Boards plugin panics on WebSocket command with non-string field types
CVE-2026-10527
MA
Mattermost
Mattermost
6.3
0%
Aug 17Boards plugin retains Board Admin rights for users demoted to System Guest
CVE-2026-15754
MA
Mattermost
Mattermost
4.2
0%
Aug 17Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal
CVE-2026-16044
MA
Mattermost
Mattermost
5.4
0%
Aug 17Insufficient validation of guest board admin privileges on archive import
CVE-2026-16045
MA
Mattermost
Mattermost
4.3
0%
Aug 17Delegated OAuth tokens could revoke unrelated OAuth application authorizations
CVE-2026-16049
MA
Mattermost
Mattermost
4.3
0%
Aug 17_GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints_
CVE-2026-16047
MA
Mattermost
Mattermost
4.3
0%
Aug 17Board channel linking without read channel permission validation
CVE-2026-16046
MA
Mattermost
Mattermost
4.3
0%
Aug 17Missing run-state validation on finished playbook runs
CVE-2026-16048
MA
Mattermost
Mattermost
6.3
0%
Aug 17Channel member roles accept out-of-scope roles
CVE-2026-14298
MA
Mattermost
Mattermost
6.5
0%
Aug 13Boards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in Mattermost
CVE-2026-7521
MA
Mattermost
Mattermost
5.5
0%
Jul 28SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory
CVE-2026-10819
MA
Mattermost
Mattermost
6.5
0%
Jul 27Mattermost Server Denial of Service via Animated GIF Emoji Upload