M
Vendor security profile
mattermost
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs96
Critical1
CISA KEV0
Public exploit0
Patch rate%0
Avg. CVSS5.3
12-month vulnerability rate
0
8
0
0
0
3
31
3
15
14
22
0
CVE KEV
CVE severity distribution
96toplam CVE
Critical1 (1%)
High9 (9%)
Medium71 (74%)
Low15 (16%)
Patch and exploitation view
%0
Verified patch
%0
CISA KEV
%0
Public exploit
0Patch available
0Partial
0Workaround
0Vendor: no patch
96Unknown
Latest vulnerabilities
6.5
CVE-2026-96260
Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user
M
Patch status unknownEPSS %0
5.5
CVE-2026-96259
Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator
M
Patch status unknownEPSS %0
4.3
CVE-2026-95666
Unbounded post ID array in the bulk reactions endpoint allows denial of service
M
Patch status unknownEPSS %0
3.8
CVE-2026-12284
Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler
M
Patch status unknownEPSS %0
2.6
CVE-2026-75588
Mattermost Desktop App plugin popout scheme validation bypass
M
Patch status unknownEPSS %0
4.7
CVE-2026-75025
Mattermost Desktop local network access from server-rendered content
M
Patch status unknownEPSS %0
6.5
CVE-2026-91181
Data Retention Teams Endpoint Leaks Private Team Invite ID
M
Patch status unknownEPSS %0
6.8
CVE-2026-12985
Mattermost DCR redirect URI allowlist bypass via improper URL component validation
M
Patch status unknownEPSS %0
5.5
CVE-2026-82920
Mattermost ABAC parent policy bypass via policy update endpoint
M
Patch status unknownEPSS %0
4.3
CVE-2026-86348
MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process
M
Patch status unknownEPSS %0