github.com/mattermost/mattermost/server/v8 vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-3590Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost has session spoofing due to lack of single-use consumption of guest magic link tokens enforcementCVE-2026-28741Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't validate CSRF tokens on an authentication endpointCVE-2026-3112Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost allows system administrators to read arbitrary host files via malicious AdvancedLoggingJSON configurationCVE-2026-3114Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't validate decompressed archive entry sizes during file extractionCVE-2026-3108Highgithub.com/mattermost/mattermost/server/v8: Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequencesCVE-2026-3115Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost allows authenticated guest users to enumerate user IDs outside their allowed visibility scopeCVE-2026-4274Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost has an Incorrect Authorization issueCVE-2026-27656Mediumgithub.com/mattermost/mattermost-server: Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flawCVE-2026-27659Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't properly validate CSRF tokensCVE-2026-20719Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost: Authenticated DoS through failure to prevent rendering of external SVGs on link embeds CVE-2026-22545Lowgithub.com/mattermost/mattermost/server/v8: Mattermost fails to validate user's authentication method when processing account auth type switchCVE-2026-2455Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to canonicalize IPv4-mapped IPv6 addresses before reserved IP validationCVE-2026-24692Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to properly enforce read permissions in search API endpointsCVE-2026-4265Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to validate team-specific upload_file permissionsCVE-2026-21386Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to use consistent error responses when handling the /mute commandCVE-2026-2456Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to limit the size of responses from integration action endpointsCVE-2026-2458Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost allows a removed team member to enumerate all public channels within a private teamCVE-2026-2463Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to filter invite IDs based on user permissionsCVE-2026-2578Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to preserve the redacted state of burn-on-read posts during deletionCVE-2026-2457Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost allows attackers to spoof permalink embedsCVE-2026-26246Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to bound memory allocation when processing PSD image filesCVE-2026-25783Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to properly validate User-Agent header tokensCVE-2026-24458Highgithub.com/mattermost/mattermost/server/v8: Mattermost fails to properly handle very long passwordsCVE-2026-25780Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to bound memory allocation when processing DOC filesCVE-2025-14573Lowgithub.com/mattermost/mattermost/server/v8: Mattermost fails to enforce invite permissions when updating team settings

Stop the waste.
Protect your environment with Kodem.