Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

153 results · page 1 of 4

Feb 16, 2026Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on CVE-2026-1046 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comHigh 7.6
Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a user’s system via the user clicking on certain items in the Help menu Mattermost Advisory ID: MMSA-2026-00577
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com
Oct 13, 2025Mattermost Desktop App versions <= 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has conCVE-2025-58084 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.5
Mattermost Desktop App versions <= 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has configured to crash the user's application by sending the user a malformed URL.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com
Aug 21, 2025Mattermost Server versions 10.5.x <= 10.5.9 utilizing the Agents plugin fail to reject empty request bodies which allows users to trick users into clicking maliCVE-2025-47700 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.5
Mattermost Server versions 10.5.x <= 10.5.9 utilizing the Agents plugin fail to reject empty request bodies which allows users to trick users into clicking malicious links via post actions
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com
Apr 16, 2025Mattermost Plugin MSTeams versions <2.1.0 and Mattermost Server versions 10.5.x <=10.5.1 with the MS Teams plugin enabled fail to perform constant time comparisCVE-2025-27936 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 5.3
Mattermost Plugin MSTeams versions <2.1.0 and Mattermost Server versions 10.5.x <=10.5.1 with the MS Teams plugin enabled fail to perform constant time comparison on a MSTeams plugin webhook secret which allows an attacker to retrieve the webhook secret of the MSTeams plugin via a timing attack during webhook secret comparison.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com
Apr 5, 2024Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access contrCVE-2024-29221 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.7
Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the `/api/v4/users/me/teams` endpoint allowing a team admin to get the invite ID of their team, thus allowing them to invite users, even if the "Add Members" permission was explicitly removed from team admins.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Apr 5, 2024Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which alloCVE-2024-28949 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which allows an attacker to send a large number of user preferences potentially causing denial of service.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Apr 5, 2024Improper Access Control in Mattermost Server versions 8.1.x before 8.1.11 allows an attacker that is in a channel with an active call to keep participating in tCVE-2024-21848 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.1
Improper Access Control in Mattermost Server versions 8.1.x before 8.1.11 allows an attacker that is in a channel with an active call to keep participating in the call even if they are removed from the channel
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Mar 15, 2024Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker toCVE-2024-28053 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.1
Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker to send a very large email payload and crash the server.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
May 2, 2023Mattermost Desktop App fails to validate a mattermost server redirection and navigates to an arbitrary website CVE-2023-2000 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 5.4
Mattermost Desktop App fails to validate a mattermost server redirection and navigates to an arbitrary website
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Mar 10, 2022A stack overflow bug in the document extractor in Mattermost Server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting CVE-2022-0904 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
A stack overflow bug in the document extractor in Mattermost Server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting a maliciously crafted Apple Pages document.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Mar 10, 2022A call stack overflow bug in the SAML login feature in Mattermost server in versions up to and including 6.3.2 allows an attacker to crash the server via submitCVE-2022-0903 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 5.3
A call stack overflow bug in the SAML login feature in Mattermost server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting a maliciously crafted POST body.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2.CVE-2017-18921 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an error page.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.6.2.CVE-2017-18920 · Other software · Mattermost · reported by MITRECritical 9.8
An issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow the Same Origin Policy.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3.CVE-2017-18919 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3. Attackers can use the API for unauthenticated team creation.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5.CVE-2017-18918 · Other software · Mattermost · reported by MITREMedium 4.9
An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.CVE-2017-18917 · Other software · Mattermost · reported by MITREHigh 7.5
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.CVE-2017-18916 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.CVE-2017-18915 · Other software · Mattermost · reported by MITRECritical 9.8
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.CVE-2017-18914 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. An external link can occur on an error page even if it is not on an allowlist.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.CVE-2017-18913 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. XSS can occur via a link on an error page.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2.CVE-2017-18908 · Other software · Mattermost · reported by MITRECritical 9.8
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. A password-reset request was sometime sent to an attacker-provided e-mail address.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2.CVE-2017-18907 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used.CVE-2017-18906 · Other software · Mattermost · reported by MITREHigh 8.1
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled.CVE-2017-18905 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 2.1.0.CVE-2016-11084 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 2.2.0.CVE-2016-11083 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 2.2.0.CVE-2016-11082 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 2.2.0.CVE-2016-11081 · Other software · Mattermost · reported by MITREMedium 4.3
An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.0.0.CVE-2016-11080 · Other software · Mattermost · reported by MITREMedium 4.3
An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.0.0.CVE-2016-11079 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.0.0.CVE-2016-11078 · Other software · Mattermost · reported by MITREMedium 6.5
An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information (credential fields within config.json) via the System Console UI.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.0.0.CVE-2016-11077 · Other software · Mattermost · reported by MITRELow 2.7
An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.0.0.CVE-2016-11076 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.0.0.CVE-2016-11075 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.0.0.CVE-2016-11074 · Other software · Mattermost · reported by MITRECritical 9.8
An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.0.0.CVE-2016-11073 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.0.2.CVE-2016-11072 · Other software · Mattermost · reported by MITREMedium 6.5
An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.1.0.CVE-2016-11071 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.1.0.CVE-2016-11070 · Other software · Mattermost · reported by MITREMedium 5.4
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.2.0.CVE-2016-11069 · Other software · Mattermost · reported by MITREHigh 7.5
An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.2.0.CVE-2016-11068 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.2.0.CVE-2016-11067 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.2.0.CVE-2016-11066 · Other software · Mattermost · reported by MITREHigh 7.5
An issue was discovered in Mattermost Server before 3.2.0. The initial_load API disclosed unnecessary personal information.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.3.0.CVE-2016-11065 · Other software · Mattermost · reported by MITREMedium 4.3
An issue was discovered in Mattermost Server before 3.3.0. An attacker could use the WebSocket feature to send pop-up messages to users or change a post's appearance.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.5.1.CVE-2016-11063 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.5.1.CVE-2016-11062 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be bypassed.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 1.2.0.CVE-2015-9548 · Other software · Mattermost · reported by MITREHigh 7.5
An issue was discovered in Mattermost Server before 1.2.0. It allows attackers to cause a denial of service (memory consumption) via a small compressed file that has a large size when uncompressed.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.CVE-2017-18912 · Other software · Mattermost · reported by MITRECritical 9.8
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. It allows an attacker to specify a full pathname of a log file.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.CVE-2017-18911 · Other software · Mattermost · reported by MITRECritical 9.1
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The X.509 certificate validation can be skipped for a TLS-based e-mail server.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.CVE-2017-18910 · Other software · Mattermost · reported by MITREMedium 4.3
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. E-mail notifications can have spoofed links.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.