MS
Product
Mattermost Server
501
CVEs
0
On KEV
9.9
Max CVSS
15
New 30D
Severity mix
Critical 17High 86Medium 356Low 41
Watch
Add Mattermost Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-20870 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.10.0 Affected: before 5.10.0 |
| CVE-2026-15754 | 4.2 | Aug 17 | Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal Affected: 11.7.0 before 11.7.7; 11.8.0 before 11.8.4 |
| CVE-2025-2571 | 4.2 | May 30 | Google OAuth Authentication Bypass for Converted Bot Accounts Affected: 9.11.0 before 9.11.13; 10.5.0 before 10.5.4; 10.6.0 before 10.6.3; 10.7.0 before 10.7.1 |
| CVE-2025-64641 | 4.1 | Dec 24 | Mattermost Jira plugin crafted action leaks Jira issue details Affected: 10.11.0 before 10.11.8; 10.12.0 before 10.12.4; 11.0.0 before 11.0.6; 11.1.0 before 11.1.1 |
| CVE-2025-4573 | 4.1 | Jun 11 | LDAP Injection in Mattermost Enterprise Edition When Using Active Directory Affected: 9.11.0 before 9.11.14; 10.5.0 before 10.5.5; 10.6.0 before 10.6.4; 10.7.0 before 10.7.2 |
| CVE-2024-24774 | 4.1 | Feb 9 | Missing authorization allows users to access arbitrary security levels on Jira through webhooks (Jira Plugin) Affected: through 8.1.7 |
The 500 most important CVEs for this product (exploited first, then by severity)