CVE Tools
Track your stack

Mattermost

615 CVEs tracked since 2020. Since Jun 2020, none of them reached CISA KEV.

Mattermost CVEs per month

Jun 2020 to Sep 2026. Point at a month, or focus the strip and use the arrow keys.
Mattermost CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2020-061590
2020-07null or fewer
2020-08null or fewer
2020-09null or fewer
2020-10null or fewer
2020-11null or fewer
2020-12null or fewer
2021-01null or fewer
2021-02null or fewer
2021-03null or fewer
2021-04null or fewer
2021-05null or fewer
2021-06null or fewer
2021-07null or fewer
2021-08null or fewer
2021-09null or fewer
2021-10null or fewer
2021-11null or fewer
2021-1230
2022-0140
2022-02null or fewer
2022-0340
2022-0450
2022-05null or fewer
2022-06null or fewer
2022-0740
2022-08null or fewer
2022-09null or fewer
2022-10null or fewer
2022-1130
2022-12null or fewer
2023-01null or fewer
2023-0240
2023-03null or fewer
2023-04null or fewer
2023-0540
2023-06110
2023-07130
2023-0850
2023-0950
2023-1060
2023-11150
2023-12120
2024-01null or fewer
2024-02130
2024-0350
2024-04110
2024-0590
2024-06null or fewer
2024-0780
2024-08210
2024-0990
2024-1050
2024-11null or fewer
2024-1250
2025-01120
2025-0260
2025-0390
2025-04140
2025-0590
2025-0670
2025-07null or fewer
2025-08220
2025-0960
2025-1080
2025-11110
2025-12120
2026-01null or fewer
2026-02100
2026-03340
2026-0480
2026-05360
2026-06200
2026-07150
2026-08140
2026-09190

Products

The products that kept showing up in Mattermost's monthly top three, with their CVEs summed over those months.

  1. Mattermost43043 months
  2. Mattermost Server42636 months
  3. Mattermost Desktop2712 months
  4. Mattermost Mobile177 months
  5. Confluence131 month
  6. Mattermost Confluence Plugin131 month
  7. Focalboard21 month
  8. Mattermost App Framework21 month
  9. Mattermost Boards21 month
  10. Ms Teams22 months

Latest CVEs

The 15 most recently published vulnerabilities affecting Mattermost.

  1. CVE-2026-96260Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user6.5
  2. CVE-2026-96259Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator5.5
  3. CVE-2026-95666Unbounded post ID array in the bulk reactions endpoint allows denial of service4.3
  4. CVE-2026-12284Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler3.7
  5. CVE-2026-75588Mattermost Desktop App plugin popout scheme validation bypass2.6
  6. CVE-2026-75025Mattermost Desktop local network access from server-rendered content4.7
  7. CVE-2026-91181Data Retention Teams Endpoint Leaks Private Team Invite ID6.5
  8. CVE-2026-12985Mattermost DCR redirect URI allowlist bypass via improper URL component validation6.8
  9. CVE-2026-82920Mattermost ABAC parent policy bypass via policy update endpoint5.5
  10. CVE-2026-86348MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process4.3
  11. CVE-2026-86349Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting4.3
  12. CVE-2026-10556Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.5.3
  13. CVE-2026-13417Boards plugin denial of service via unvalidated block fields.properties4.3
  14. CVE-2026-9812Missing property field ownership validation in Playbooks run property update endpoint6.5
  15. CVE-2026-8821Playbooks run owner channel membership permission bypass7.1

The record

Peak rank
#1 in Jun 2020
Busiest month shown
Jun 2020, 159 CVEs
Months with a KEV entry
0 since Jun 2020
Monthly snapshots
44 since 2020
Mattermost's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store