Vulnerabilidades en Mattermost
512 resultadosCVE-2026-15814MEDIUMUploading a crafted image causes excessive memory allocation in the Mattermost ServerEPSS 0.4%CVE-2023-47865MEDIUMUsername and Icon override can be used by members when Hardened Mode is enabledEPSS 0.4%CVE-2023-1421LOWReflected XSS in OAuth flow completion endpointsEPSS 0.4%CVE-2023-6727LOWLeak Inaccessible Playbook Information via Channel Action IDOREPSS 0.4%CVE-2023-2808MEDIUMLack of URL normalization allows rendering previews for disallowed domainsEPSS 0.4%CVE-2025-8023MEDIUMPath Traversal in Template Upload Allows Uploading Files Outside Target DirectoryEPSS 0.4%CVE-2024-24975LOW Denial of Service for mobile app users due to automatic code highlightingEPSS 0.4%CVE-2025-35965MEDIUMDoS in Mattermost Playbooks via Excessive Task ActionsEPSS 0.4%CVE-2023-47168MEDIUMOpen redirect in /oauth/<service>/mobile_login?redirect_to=EPSS 0.4%CVE-2023-2791MEDIUMPlaybooks lets you edit arbitrary postsEPSS 0.4%CVE-2023-5194LOWA system/user manager can demote / deactivate another managerEPSS 0.4%CVE-2023-4105LOWAttachment of deleted message in a thread remains accessible and downloadable EPSS 0.4%CVE-2024-6428MEDIUMLimited DoS due to permitting creating users with user-defined IDsEPSS 0.4%CVE-2023-5875LOWLack of Hardening against media exploitation from a remote originEPSS 0.4%CVE-2026-93850MEDIUMUnbounded memory consumption during PDF text extractionEPSS 0.4%CVE-2024-40884LOWUnauthorized disabling of invite URLEPSS 0.4%CVE-2024-23493MEDIUM Team associated AD/LDAP Groups Leaked due to missing authorizationEPSS 0.4%CVE-2026-91181MEDIUMData Retention Teams Endpoint Leaks Private Team Invite IDEPSS 0.4%CVE-2026-3524HIGHAuthorization Bypass in Mattermost Legal Hold Plugin Due to Missing Return After Permission CheckEPSS 0.4%CVE-2025-1558MEDIUMDenial of Service Via Malicious GIFEPSS 0.4%