Skip to content
Noroxi

Mattermost records

645 published records for vendor mattermost.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
4
With a fix record
56%
Median publish → KEV
No record has entered KEV

Records by year

  1. 20
  2. 21
  3. 22
  4. 23
  5. 24
  6. 25
  7. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

Bug bounty scope

The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.

All records

645 records
  • CVE-2019-20853
    40Plan

    An issue was discovered in Mattermost Packages before 5.16.3.

    CriticalCVSS 9.8No exploitEPSS 2%

    mattermost · mattermost packagesJun 19, 2020

  • CVE-2019-20856
    39Monitor

    An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS.

    CriticalCVSS 9.8No exploitEPSS 1%

    mattermost · mattermost desktopJun 19, 2020

  • CVE-2017-18912
    39Monitor

    An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.

    CriticalCVSS 9.8No exploitEPSS 1%

    mattermost · mattermost serverJun 19, 2020

  • CVE-2017-18900
    39Monitor

    An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3.

    CriticalCVSS 9.8No exploitEPSS 1%

    mattermost · mattermost serverJun 19, 2020

  • CVE-2016-11064
    39Monitor

    An issue was discovered in Mattermost Desktop App before 3.4.0.

    CriticalCVSS 9.8No exploitEPSS 1%

    mattermost · mattermost desktopJun 19, 2020

  • CVE-2017-18920
    39Monitor

    An issue was discovered in Mattermost Server before 3.6.2.

    CriticalCVSS 9.8No exploitEPSS 1%

    mattermost · mattermost serverJun 19, 2020

  • CVE-2018-21251
    39Monitor

    An issue was discovered in Mattermost Server before 5.2 and 5.1.1.

    CriticalCVSS 9.8No exploitEPSS 1%

    mattermost · mattermost serverJun 19, 2020

  • CVE-2016-11074
    39Monitor

    An issue was discovered in Mattermost Server before 3.0.0.

    CriticalCVSS 9.8No exploitEPSS 1%

    mattermost · mattermost serverJun 19, 2020

  • CVE-2017-18885
    39Monitor

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2.

    CriticalCVSS 9.8No exploitEPSS 1%

    mattermost · mattermost serverJun 19, 2020

  • CVE-2017-18908
    39Monitor

    An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2.

    CriticalCVSS 9.8No exploitEPSS 1%

    mattermost · mattermost serverJun 19, 2020

  • CVE-2017-18915
    39Monitor

    An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.

    CriticalCVSS 9.8No exploitEPSS 1%

    mattermost · mattermost serverJun 19, 2020

  • CVE-2017-18888
    39Monitor

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2.

    CriticalCVSS 9.8No exploitEPSS 1%

    mattermost · mattermost serverJun 19, 2020

  • CVE-2025-4981
    39Monitor

    Path Traversal Leading to RCE by Any Authenticated Mattermost User

    CriticalCVSS 9.9No exploitEPSS 0%

    mattermost · mattermost serverJun 20, 2025

  • CVE-2023-6458
    39Monitor

    Client side path traversal due to lack of route parameters validation

    CriticalCVSS 9.8No exploitEPSS 0%

    mattermost · mattermost serverDec 6, 2023

  • CVE-2026-4858
    39Monitor

    Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token.

    CriticalCVSS 9.9No exploitEPSS 0%

    mattermost · mattermost serverMay 21, 2026

  • CVE-2025-12421
    39Monitor

    Account Takeover via Code Exchange Endpoint

    CriticalCVSS 9.9No exploitEPSS 0%

    mattermost · mattermost serverNov 27, 2025

  • CVE-2025-12419
    39Monitor

    Account takeover on OAuth/OpenID-enabled servers

    CriticalCVSS 9.9No exploitEPSS 0%

    mattermost · mattermost serverNov 27, 2025

  • CVE-2024-39777
    38Monitor

    Malicious remote can invite itself to an arbitrary local channel

    CriticalCVSS 9.6No exploitEPSS 0%

    mattermost · mattermostAug 1, 2024

  • CVE-2025-25279
    37Monitor

    Arbitrary file read in Mattermost Boards via import & export board archive

    HighCVSS 7.5Proof of conceptEPSS 24%

    mattermost · mattermost serverFeb 24, 2025

  • CVE-2026-12985
    37Monitor

    Mattermost DCR redirect URI allowlist bypass via improper URL component validation

    CriticalCVSS 9.3No exploitEPSS 0%

    mattermost · mattermost serverSep 14, 2026

  • CVE-2019-20851
    36Monitor

    An issue was discovered in Mattermost Mobile Apps before 1.26.0.

    CriticalCVSS 9.1No exploitEPSS 1%

    mattermost · mattermostJun 19, 2020

  • CVE-2017-18883
    36Monitor

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider.

    CriticalCVSS 9.1No exploitEPSS 1%

    mattermost · mattermost serverJun 19, 2020

  • CVE-2017-18911
    36Monitor

    An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.

    CriticalCVSS 9.1No exploitEPSS 0%

    mattermost · mattermost serverJun 19, 2020

  • CVE-2023-2193
    36Monitor

    Oauth authorization codes do not expire when deauthorizing an oauth2 app

    CriticalCVSS 9.1No exploitEPSS 0%

    mattermost · mattermostApr 20, 2023

  • CVE-2019-20861
    35Monitor

    An issue was discovered in Mattermost Desktop App before 4.2.2.

    HighCVSS 8.8No exploitEPSS 1%

    mattermost · mattermost desktopJun 19, 2020