Exposição de Mattermost

Message boards
47
score de exposição
1
sites usam
0
em exploração
6
críticos

CVEs

480 resultados
CVE-2026-3109LOWMissing timestamp validation in Zoom webhook handlerEPSS 0.3%CVE-2026-6346HIGHSensitive credentials exposed in plaintext in Mattermost support packetsEPSS 0.3%CVE-2025-49222MEDIUMMattermost Shared Channel Upload Type Validation BypassEPSS 0.3%CVE-2025-11794MEDIUMPassword hash and MFA secret returned in user email verification endpointEPSS 0.3%CVE-2025-24866LOWUnauthorized Access to User Activity Logs API by delegated granular administration rolesEPSS 0.3%CVE-2024-37182MEDIUMLack of permissions prompting when opening external URLsEPSS 0.3%CVE-2026-10106MEDIUMUnauthorized users can trigger interactive post actions in private channels via action cookie channel mismatch in MattermostEPSS 0.3%CVE-2026-6673MEDIUMMattermost Jira plugin had unauthenticated {{/ac/installed}} lifecycle callback during pending Jira Cloud installEPSS 0.3%CVE-2024-39613MEDIUMRCE in desktop app in Windows by local attackerEPSS 0.3%CVE-2026-6957HIGHPath traversal in Mattermost Legal Hold plugin via unsanitized file name from federated peer allows arbitrary file write.EPSS 0.3%CVE-2024-36492HIGHExisting local user overwritten by malicious remoteEPSS 0.3%CVE-2024-52032MEDIUMPrivate channel names leaking when Elasticsearch is enabledEPSS 0.3%CVE-2024-34029MEDIUMAD/LDAP Group Members LeakEPSS 0.3%CVE-2023-7113LOWMattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web cEPSS 0.3%CVE-2024-10241MEDIUMPrivate channel names leaked with Ctrl+K when ElasticSearch is enabledEPSS 0.3%CVE-2025-3228MEDIUMUnauthorized Guest user access to PlaybookEPSS 0.3%CVE-2025-24526MEDIUMChannel export permitted on archived channel when viewing archived channels is disabledEPSS 0.3%CVE-2026-16049LOW_GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints_EPSS 0.3%CVE-2026-2454MEDIUMDoS in Calls plugin via malformed msgpack in websocket request.EPSS 0.3%CVE-2024-42411MEDIUMUser creation date manipulation in POST /api/v4/usersEPSS 0.3%