Exposure of Mattermost

Message boards
47
exposure score
1
sites use
0
exploited
6
critical

CVEs

480 results
CVE-2025-12419CRITICALAccount takeover on OAuth/OpenID-enabled serversEPSS 0.4%CVE-2026-12882MEDIUMMattermost Markdown autolink parsing denial of serviceEPSS 0.4%CVE-2026-95666MEDIUMUnbounded post ID array in the bulk reactions endpoint allows denial of serviceEPSS 0.4%CVE-2026-86348MEDIUMMS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin processEPSS 0.4%CVE-2026-10600MEDIUMDenial of service via unbounded document content extraction in Mattermost ServerEPSS 0.4%CVE-2026-11993MEDIUMFix authenticated members disabling file content indexing server-wide via extraction pool exhaustionEPSS 0.4%CVE-2026-86349MEDIUMMattermost Server Algorithmic DoS via Unbounded Markdown Block NestingEPSS 0.4%CVE-2026-13417MEDIUMBoards plugin denial of service via unvalidated block fields.propertiesEPSS 0.4%CVE-2024-1952LOWMattermost version 8.1.x before 8.1.9 fails to sanitize data associated with permalinks when a plugin updates an ephemeral post, allowing anEPSS 0.4%CVE-2023-4106MEDIUMA guest user can perform various actions on public playbooksEPSS 0.4%CVE-2024-39777HIGHMalicious remote can invite itself to an arbitrary local channelEPSS 0.4%CVE-2023-2000MEDIUMUnrestricted navigation due to unvalidated mattermost server redirectionEPSS 0.4%CVE-2026-116516MEDIUMInsufficient length validation when parsing Zoom chat transcriptionsEPSS 0.4%CVE-2024-41144MEDIUMMalicious remote can create/update/delete arbitrary posts in arbitrary channelsEPSS 0.4%CVE-2026-9708MEDIUMIncoming webhook user attribution via unvalidated webhook ownerEPSS 0.4%CVE-2024-1942MEDIUMMattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under speEPSS 0.4%CVE-2023-47858MEDIUMDetails of archived public channels are leaked to members of another teamEPSS 0.4%CVE-2026-20719MEDIUMDoS via URL Previews Rendering Malicious SVGsEPSS 0.4%CVE-2026-3116MEDIUMImproper Input Validation in Zoom Plugin Webhook HandlerEPSS 0.4%CVE-2026-3114MEDIUMZip Bomb Denial of Service via Unrestricted Archive DecompressionEPSS 0.4%