Mattermost Desktop
30 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Mattermost Desktop, a product in the communications space. Use it to gauge the current risk picture and drill into individual advisories.
Mattermost Desktop CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 1 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 2 |
| 2025-11 | 0 |
| 2025-12 | 2 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 1 |
| 2026-04 | 0 |
| 2026-05 | 2 |
| 2026-06 | 2 |
| 2026-07 | 2 |
| 2026-08 | 1 |
| 2026-09 | 0 |
Severity
How the 30 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical2
- High2
- Medium14
- Low12
Latest CVEs
The 15 most recently published vulnerabilities affecting Mattermost Desktop.
- CVE-2026-75587Plaintext pre-auth secret exposure via Desktop App diagnostics report3.6
- CVE-2026-8075Posting a malicious markdown image crashes the Mattermost Desktop App6.5
- CVE-2026-9602Mattermost Desktop App crashes when malformed arguments are provided to some exposed IPC methods6.5
- CVE-2026-8683Overly long URLs crash the Mattermost Desktop App6.5
- CVE-2026-6517Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed6.3
- CVE-2026-3471Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App6.5
- CVE-2026-4643Calling window.close() from server-side content causes crash in the Mattermost Desktop App3.5
- CVE-2026-1628Mattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites.4.6
- CVE-2025-13326Mattermost Desktop App fails to enable Hardened Runtime when packaged for Mac App Store3.9
- CVE-2025-13321Mattermost Desktop App logging sensitive information and fails to clear data on server deletion3.3
- CVE-2025-55035Mattermost Desktop DoS when user has basic authentication server configured6.1
- CVE-2025-58084Mattermost Desktop App crashes when clicking on malformed external URL3.5
- CVE-2025-1398macOS TCC Bypass via Code Injection3.3
- CVE-2024-45835Insufficient Electron Fuses Configuration2.5
- CVE-2024-39772Silent Desktop Screenshot Capture3.7
Product grouping is registry-driven, with AI assist and human review. How it works