Login Request a demo
MS
Product
Mattermost Server
by Mattermost · last CVE Oct 16, 2026
501
CVEs
0
On KEV
9.9
Max CVSS
15
New 30D
Vulnerabilities501In the news0Timeline
Severity mix
Critical 17High 86Medium 356Low 41
Severity
All severities500Critical17High86Medium356Low41
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Mattermost Server to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-4858
9.9
0%
May 21
Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token.
Affected: 10.11.0 before 10.11.15; 11.4.0 before 11.4.5; 11.5.0 before 11.5.4; 11.6.0
CVE-2025-12421
9.9
0%
Nov 27
Account Takeover via Code Exchange Endpoint
Affected: 10.5.0 before 10.5.13; 10.11.0 before 10.11.5; 10.12.0 before 10.12.2; 11.0.0 before 11.0.3
CVE-2025-12419
9.9
0%
Nov 27
Account takeover on OAuth/OpenID-enabled servers
Affected: 10.5.0 before 10.5.13; 10.11.0 before 10.11.5; 10.12.0 before 10.12.2; 11.0.0 before 11.0.4
CVE-2025-4981
9.9
1%
Jun 20
Path Traversal Leading to RCE by Any Authenticated Mattermost User
Affected: 9.11.0 before 9.11.16; 10.5.0 before 10.5.6; 10.6.0 before 10.6.6; 10.7.0 before 10.7.3; 10.8.0; 10.8.0; +2 more
CVE-2023-6458
9.8
1%
Dec 6
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perform a client-side path traversal
Affected: before 7.8.14; 8.0.0 before 8.1.5; 9.0.0 before 9.0.3; 9.1.0 before 9.1.2
CVE-2017-18920
9.8
1%
Jun 19
An issue was discovered in Mattermost Server before 3.6.2
Affected: before 3.6.2
CVE-2017-18915
9.8
1%
Jun 19
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7
Affected: 3.6.0 before 3.6.7; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2
CVE-2017-18908
9.8
1%
Jun 19
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2
Affected: before 3.9.2; 3.10.0 before 3.10.2
CVE-2016-11074
9.8
1%
Jun 19
An issue was discovered in Mattermost Server before 3.0.0
Affected: before 3.0.0
CVE-2017-18912
9.8
1%
Jun 19
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7
Affected: before 3.6.7; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2
CVE-2017-18900
9.8
1%
Jun 19
An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3
Affected: before 3.10.3; 4.0.0 before 4.0.4
CVE-2017-18888
9.8
1%
Jun 19
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2
Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0
CVE-2017-18885
9.8
1%
Jun 19
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2
Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0
CVE-2018-21251
9.8
1%
Jun 19
An issue was discovered in Mattermost Server before 5.2 and 5.1.1
Affected: before 5.1.1; 5.2.0; 5.2.0; 5.2.0; 5.2.0; 5.2.0; +1 more
CVE-2026-12985
9.3
0%
Sep 14
Mattermost DCR redirect URI allowlist bypass via improper URL component validation
Affected: 11.7.0 before 11.7.8; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1
CVE-2017-18911
9.1
1%
Jun 19
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7
Affected: before 3.6.7; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2
CVE-2017-18883
9.1
1%
Jun 19
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider
Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0
Showing 17
The 500 most important CVEs for this product (exploited first, then by severity)