Mattermost
Number 39 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Total vulnerabilities
512
Critical
6
High
42
Known Exploited
0
Exploit available
0
Network, no login needed
11.7%
Of 512 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 184 | 0 | 18 | 135 | 31 | 0 |
| 2025 | 119 | 6 | 10 | 66 | 37 | 0 |
| 2024 | 95 | 0 | 6 | 56 | 33 | 0 |
| 2023 | 84 | 0 | 7 | 56 | 21 | 0 |
| 2022 | 25 | 0 | 0 | 16 | 9 | 0 |
| 2021 | 5 | 0 | 1 | 1 | 3 | 0 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| Mattermost | 480 | 41 |
| Mattermost Confluence Plugin | 14 | 5 |
| Mattermost Desktop | 3 | 0 |
| Focalboard | 2 | 1 |
| Mattermost App Framework | 2 | 0 |
| Mattermost Boards | 2 | 0 |
| Mattermost Playbooks | 2 | 0 |
| Mattermost Github Plugin | 1 | 0 |
| Mattermost Google Drive Plugin | 1 | 0 |
| Mattermost Mobile | 1 | 0 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Incorrect Authorization | 91 | 2 |
| Missing Authorization | 50 | 5 |
| Information Disclosure | 48 | 4 |
| Improper Access Control | 47 | 3 |
| Denial of Service | 41 | 0 |
| Improper Check for Unusual or Exceptional Conditions | 23 | 2 |
| Improper Validation of Specified Type of Input | 19 | 1 |
| Allocation of Resources Without Limits or Throttling | 17 | 1 |
| Authentication Issues | 14 | 5 |
| Path Traversal | 14 | 7 |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-93851 | Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post | High | 0.3% | |
| CVE-2026-93850 | Unbounded memory consumption during PDF text extraction | Medium | 0.4% | |
| CVE-2026-93849 | Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames | Medium | 0.5% | |
| CVE-2026-93848 | Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator | Low | 0.3% | |
| CVE-2026-93847 | Improper post type validation on scheduled post endpoints | Low | 0.2% | |
| CVE-2026-93846 | Team admin can escalate a team member's permissions via the team member roles endpoint | Low | 0.2% | |
| CVE-2026-116516 | Insufficient length validation when parsing Zoom chat transcriptions | Medium | 0.4% | |
| CVE-2026-13411 | Null condition in Playbooks import crashes the plugin | Medium | 0.3% | |
| CVE-2026-19867 | Uncapped mention keys in user notification properties allow CPU exhaustion during post processing | Medium | 0.2% | |
| CVE-2026-19621 | Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads | Medium | 0.3% |