CVE Tools
Track your stack

Mattermost

641 CVEs tracked since 2020. Since Jun 2020, none of them reached CISA KEV.

Mattermost CVEs per month

Jun 2020 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Mattermost CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2020-061590
2020-07no snapshot
2020-082 or fewer
2020-091 or fewer
2020-101 or fewer
2020-111 or fewer
2020-122 or fewer
2021-012 or fewer
2021-022 or fewer
2021-03no snapshot
2021-042 or fewer
2021-052 or fewer
2021-062 or fewer
2021-072 or fewer
2021-083 or fewer
2021-092 or fewer
2021-102 or fewer
2021-112 or fewer
2021-1230
2022-0140
2022-022 or fewer
2022-0340
2022-0450
2022-053 or fewer
2022-063 or fewer
2022-0740
2022-083 or fewer
2022-093 or fewer
2022-102 or fewer
2022-1130
2022-123 or fewer
2023-013 or fewer
2023-0240
2023-03no snapshot
2023-043 or fewer
2023-0540
2023-06110
2023-07130
2023-0850
2023-0950
2023-1060
2023-11150
2023-12120
2024-014 or fewer
2024-02130
2024-0350
2024-04110
2024-0590
2024-064 or fewer
2024-0780
2024-08210
2024-0990
2024-1050
2024-114 or fewer
2024-1250
2025-01120
2025-0260
2025-0390
2025-04140
2025-0590
2025-0670
2025-075 or fewer
2025-08220
2025-0960
2025-1080
2025-11110
2025-12120
2026-015 or fewer
2026-02100
2026-03340
2026-0480
2026-05360
2026-06200
2026-07150
2026-08140
2026-09220
2026-10230
2026-110

Products

The products that kept showing up in Mattermost's monthly top three, with their CVEs summed over those months.

  1. Mattermost45644 months
  2. Mattermost Server44137 months
  3. Mattermost Desktop2712 months
  4. Mattermost Mobile177 months
  5. Confluence131 month
  6. Mattermost Confluence Plugin131 month
  7. Focalboard21 month
  8. Mattermost App Framework21 month
  9. Mattermost Boards21 month
  10. Ms Teams22 months

Latest CVEs

The 15 most recently published vulnerabilities affecting Mattermost.

  1. CVE-2026-93851Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post8.0
  2. CVE-2026-93846Team admin can escalate a team member's permissions via the team member roles endpoint3.8
  3. CVE-2026-93848Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator2.7
  4. CVE-2026-93850Unbounded memory consumption during PDF text extraction6.5
  5. CVE-2026-93849Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames6.5
  6. CVE-2026-93847Improper post type validation on scheduled post endpoints3.5
  7. CVE-2026-116516Insufficient length validation when parsing Zoom chat transcriptions6.5
  8. CVE-2026-13411Null condition in Playbooks import crashes the plugin4.3
  9. CVE-2026-18799Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users4.3
  10. CVE-2026-16251Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering6.5
  11. CVE-2026-18256Private team metadata disclosure via the team search API4.3
  12. CVE-2026-18223Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access5.0
  13. CVE-2026-19076Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token4.4
  14. CVE-2026-18560Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status4.3
  15. CVE-2026-16453Mattermost SAML RelayState forgery allows unauthorized team membership7.1

The record

Peak rank
#1 in Jun 2020
Busiest month shown
Jun 2020, 159 CVEs
Months with a KEV entry
0 since Jun 2020
Monthly snapshots
45 since 2020
Mattermost's full record, month by month