Most recent entries from all

cnvd-2025-01688

2026-10-02T14:05:29.746700+00:00

cnvd-2025-01688

EUVD-2026-188498

2026-10-02T14:05:29.746733+00:00

EUVD-2026-188498

fkie_cve-2024-47003

2026-10-02T14:05:29.746748+00:00

Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend.

GHSA-59hf-mpf8-pqjh — Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events

2026-10-02T14:05:29.746777+00:00

Affected: Go: github.com/mattermost/mattermost/server/v8

Mattermost does not strip `embeds` from `metadata` when broadcasting `posted` events.

This allows users to include arbitrary embeds in posts, which are then broadcasted via websockets. This can be exploited in many ways, for example to create permalinks with fully customizable content or to trigger a client Side Denial of Service (DoS) by sending a permalink with a non-string message.

The advisory metadata references the appropriate go pseudo version available from pkg.go.dev

openSUSE-SU-2024:0350-1 — Security update for govulncheck-vulndb

2026-10-02T14:05:29.746803+00:00

Security update for govulncheck-vulndb

SUSE-SU-2024:3911-1 — Security update for govulncheck-vulndb

2026-10-02T14:05:29.746834+00:00

Security update for govulncheck-vulndb

WID-SEC-W-2024-1957 — Mattermost Server: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

2026-10-02T14:05:29.746859+00:00

Ein Angreifer kann mehrere Schwachstellen im Mattermost Server ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.