Login Request a demo
MS
Product
Mattermost Server
by Mattermost · last CVE Oct 16, 2026
501
CVEs
0
On KEV
9.9
Max CVSS
15
New 30D
Vulnerabilities501In the news0Timeline
Severity mix
Critical 17High 86Medium 356Low 41
Severity
All severities500Critical17High86Medium356Low41
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Mattermost Server to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-47003
6.5
1%
Sep 26
DoS via non-string message using permalink embed
Affected: 9.5.0 before 9.5.9; 9.11.0; 9.11.0; 9.11.0; 9.11.0
CVE-2024-4183
6.5
1%
Apr 26
Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows an authenticated…
Affected: 8.1.0 before 8.1.12; 9.4.0 before 9.4.5; 9.5.0 before 9.5.3; 9.6.0 before 9.6.1
CVE-2024-22091
6.5
1%
Apr 26
Excessive resource consumption due to lack to request path size limits
Affected: 8.1.0 before 8.1.12; 9.5.0 before 9.5.3; 9.6.0 before 9.6.1
CVE-2024-2447
6.5
0%
Apr 5
Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of post actions, allowing…
Affected: 8.1.0 before 8.1.11; 9.3.0 before 9.3.3; 9.4.0 before 9.4.4; 9.5.0 before 9.5.2
CVE-2024-28949
6.5
1%
Apr 5
DoS via a large number of User Preferences
Affected: 8.1.0 before 8.1.11; 9.3.0 before 9.3.3; 9.4.0 before 9.4.4; 9.5.0 before 9.5.2
CVE-2024-28053
6.5
1%
Mar 15
Resource Exhaustion via the Invitation Feature
Affected: 8.1.0 before 8.1.10
CVE-2024-24988
6.5
1%
Feb 29
Excessive resource consumption when sending long emoji names in user custom status
Affected: before 8.1.8; 9.0.0 before 9.1.5; 9.2.0 before 9.2.4
CVE-2024-23493
6.5
0%
Feb 29
Team associated AD/LDAP Groups Leaked due to missing authorization
Affected: before 8.1.9; 9.0.0 before 9.2.5; 9.4.0 before 9.4.2; 9.3.0; 9.3.0; 9.3.0
CVE-2023-49809
6.5
1%
Dec 12
Todo plugin gets crashed and disabled by member
Affected: through 8.1.5; 9.0.0 through 9.1.0
CVE-2023-5333
6.5
1%
Oct 9
Denial of Service via multiple identical User IDs in /api/v4/users/ids
Affected: before 7.8.11; 8.0.0 before 8.0.3; 8.1.0 before 8.1.2
CVE-2023-3593
6.5
1%
Jul 17
Server crash via a specially crafted markdown input
Affected: 7.8.0 before 7.8.7; 7.9.0 before 7.9.5; 7.10.0 before 7.10.3
CVE-2023-1775
6.5
1%
Mar 31
Unsanitized events sent over Websocket to regular users in a High Availability environment
Affected: before 7.1.6; 7.7.1
CVE-2022-3257
6.5
1%
Sep 23
Server-side Denial of Service while processing a specifically crafted GIF file
Affected: before 7.2.0
CVE-2022-3147
6.5
1%
Sep 9
Server-side Denial of Service while processing a specifically crafted JPEG file
Affected: before 7.1.0
CVE-2022-2401
6.5
1%
Jul 14
Team members could access sensitive information of other users via an API call
Affected: before 6.3.9; 6.4.0 before 6.5.2; 6.6.0; 6.6.1; 6.7.0
CVE-2022-1982
6.5
1%
Jun 2
A crafted SVG attachment can crash a Mattermost server
Affected: 5.0.0 before 6.3.8; 6.4.0 before 6.4.3; 6.5.0; 6.6.0
CVE-2022-1337
6.5
1%
Apr 13
OOM DoS in Mattermost image proxy
Affected: 5.37.0 before 5.37.9; 6.2.0 before 6.2.5; 6.3.0 before 6.3.5; 6.4.0 before 6.4.2
CVE-2022-0904
6.5
1%
Mar 9
Stack overflow in document extractor in Mattermost
Affected: 5.0.0 before 5.37.8; 6.0.0 before 6.1.3; 6.2.0 before 6.2.3; 6.3.0 before 6.3.3
CVE-2016-11078
6.5
1%
Jun 19
An issue was discovered in Mattermost Server before 3.0.0
Affected: before 3.0.0
CVE-2016-11072
6.5
1%
Jun 19
An issue was discovered in Mattermost Server before 3.0.2
Affected: before 3.0.2
CVE-2017-18874
6.5
1%
Jun 19
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used
Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0
CVE-2018-21250
6.5
1%
Jun 19
An issue was discovered in Mattermost Server before 5.2.2, 5.1.2, and 4.10.4
Affected: before 4.10.4; 5.1.0 before 5.1.2; 5.2.0 before 5.2.2
CVE-2019-20873
6.5
1%
Jun 19
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8
Affected: before 4.10.8; 5.7.0 before 5.7.3; 5.8.0 before 5.8.1; 5.9.0; 5.9.0; 5.9.0; +1 more
CVE-2019-20844
6.5
0%
Jun 19
An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7
Affected: before 5.9.7; 5.15.0 before 5.15.4; 5.16.0 before 5.16.4; 5.17.0 before 5.17.2; 5.18.0; 5.18.0; +2 more
CVE-2020-14460
6.5
1%
Jun 19
An issue was discovered in Mattermost Server before 5.19.0, 5.18.1, 5.17.3, 5.16.5, and 5.9.8
Affected: before 5.9.8; 5.16.0 before 5.16.5; 5.17.0 before 5.17.3; 5.18.0 before 5.18.1; 5.19.0; 5.19.0; +1 more
CVE-2026-18795
6.4
0%
Oct 16
Missing server side validation allowed user to quarantine a DM and GM post
Affected: 11.7.0 before 11.7.10; 11.8.0 before 11.8.6; 11.9.0 before 11.9.2; 11.10.0
CVE-2026-6062
6.4
0%
Jun 22
IDOR in Jira plugin subscription edit endpoint
Affected: 10.11.0 before 10.11.18; 11.5.0 before 11.5.6; 11.6.0 before 11.6.3; 11.7.0 before 11.7.1
CVE-2026-6673
6.4
0%
Jun 22
Mattermost Jira plugin had unauthenticated {{/ac/installed}} lifecycle callback during pending Jira Cloud install
Affected: 10.11.0 before 10.11.18; 11.5.0 before 11.5.6; 11.6.0 before 11.6.3; 11.7.0 before 11.7.1
CVE-2026-10527
6.3
0%
Aug 17
Boards plugin retains Board Admin rights for users demoted to System Guest
Affected: 10.11.0 before 10.11.22; 11.7.0 before 11.7.7; 11.8.0 before 11.8.4
CVE-2026-16048
6.3
0%
Aug 17
Channel member roles accept out-of-scope roles
Affected: 10.11.0 before 10.11.22; 11.7.0 before 11.7.7; 11.8.0 before 11.8.3
CVE-2024-31859
6.3
0%
May 26
Member promoted to channel admin via playbooks run linking to channel
Affected: 8.1.0 before 8.1.13; 9.5.0 before 9.5.4; 9.6.0 before 9.6.2
CVE-2026-27656
6.1
0%
Mar 25
Account Takeover via Substring Matching in OpenID Connect Authentication
Affected: 10.11.0 before 10.11.12; 11.2.0 before 11.2.4; 11.3.0 before 11.3.2; 11.4.0 before 11.4.1
CVE-2025-62690
6.1
0%
Dec 17
Open redirect in error page when link opened in new tab
Affected: 10.11.0 before 10.11.5
CVE-2025-9084
6.1
0%
Sep 15
Open redirect in OAuth login
Affected: 10.5.0 before 10.5.10
CVE-2024-2445
6.1
0%
Mar 15
Reflected XSS in Mattermost Jira plugin
Affected: 8.1.0 before 8.1.10; 9.2.0 before 9.2.6; 9.3.0 before 9.3.2; 9.4.0 before 9.4.3
CVE-2023-7113
6.1
0%
Dec 29
Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client
Affected: before 8.1.7
CVE-2023-1421
6.1
0%
Mar 15
Reflected XSS in OAuth flow completion endpoints
Affected: 5.32.0 before 7.7.0
CVE-2016-11084
6.1
0%
Jun 19
An issue was discovered in Mattermost Server before 2.1.0
Affected: before 2.1.0
CVE-2016-11083
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 2.2.0
Affected: before 2.2.0
CVE-2016-11082
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 2.2.0
Affected: before 2.2.0
CVE-2016-11079
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 3.0.0
Affected: before 3.0.0
CVE-2016-11073
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 3.0.0
Affected: before 3.0.0
CVE-2016-11071
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 3.1.0
Affected: before 3.1.0
CVE-2016-11063
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 3.5.1
Affected: before 3.5.1
CVE-2017-18921
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2
Affected: before 3.5.2
CVE-2017-18907
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2
Affected: before 3.9.2; 3.10.0 before 3.10.2
CVE-2017-18913
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7
Affected: before 3.6.7; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2
CVE-2017-18904
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2
Affected: before 3.9.2; 3.10.0 before 3.10.2
CVE-2017-18880
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2
Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0
CVE-2017-18893
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5
Affected: before 4.0.5; 4.1.0 before 4.1.1; 4.2.0; 4.2.0; 4.2.0; 4.2.0
Page 4 of 10 · 500 total
1…345…10
The 500 most important CVEs for this product (exploited first, then by severity)