agentprime: mattermostEvery new CVE for mattermost.https://agentprime.io/CVE-2026-93851: Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted posthttps://agentprime.io/advisories/CVE-2026-93851/https://agentprime.io/advisories/CVE-2026-93851/CVSS 8.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 21:41:15 GMTCVECVE-2026-93846: Team admin can escalate a team member's permissions via the team member roles endpointhttps://agentprime.io/advisories/CVE-2026-93846/https://agentprime.io/advisories/CVE-2026-93846/CVSS 3.8 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 26 Oct 2026 15:58:14 GMTCVECVE-2026-93848: Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administratorhttps://agentprime.io/advisories/CVE-2026-93848/https://agentprime.io/advisories/CVE-2026-93848/CVSS 2.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 26 Oct 2026 14:28:23 GMTCVECVE-2026-93850: Unbounded memory consumption during PDF text extractionhttps://agentprime.io/advisories/CVE-2026-93850/https://agentprime.io/advisories/CVE-2026-93850/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 26 Oct 2026 14:26:56 GMTCVECVE-2026-93849: Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frameshttps://agentprime.io/advisories/CVE-2026-93849/https://agentprime.io/advisories/CVE-2026-93849/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 26 Oct 2026 14:25:26 GMTCVECVE-2026-93847: Improper post type validation on scheduled post endpointshttps://agentprime.io/advisories/CVE-2026-93847/https://agentprime.io/advisories/CVE-2026-93847/CVSS 3.5 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 26 Oct 2026 14:15:12 GMTCVECVE-2026-116516: Insufficient length validation when parsing Zoom chat transcriptionshttps://agentprime.io/advisories/CVE-2026-116516/https://agentprime.io/advisories/CVE-2026-116516/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 26 Oct 2026 13:56:57 GMTCVECVE-2026-13411: Null condition in Playbooks import crashes the pluginhttps://agentprime.io/advisories/CVE-2026-13411/https://agentprime.io/advisories/CVE-2026-13411/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 22 Oct 2026 10:46:05 GMTCVECVE-2026-18799: Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing usershttps://agentprime.io/advisories/CVE-2026-18799/https://agentprime.io/advisories/CVE-2026-18799/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 Oct 2026 07:16:19 GMTCVECVE-2026-16251: Mattermost local image proxy allows server memory exhaustion via unbounded image response bufferinghttps://agentprime.io/advisories/CVE-2026-16251/https://agentprime.io/advisories/CVE-2026-16251/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 Oct 2026 07:14:59 GMTCVECVE-2026-18256: Private team metadata disclosure via the team search APIhttps://agentprime.io/advisories/CVE-2026-18256/https://agentprime.io/advisories/CVE-2026-18256/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 Oct 2026 07:13:43 GMTCVECVE-2026-18223: Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel accesshttps://agentprime.io/advisories/CVE-2026-18223/https://agentprime.io/advisories/CVE-2026-18223/CVSS 5.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 Oct 2026 07:12:39 GMTCVECVE-2026-19076: Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer tokenhttps://agentprime.io/advisories/CVE-2026-19076/https://agentprime.io/advisories/CVE-2026-19076/CVSS 4.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 Oct 2026 07:11:29 GMTCVECVE-2026-18560: Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined statushttps://agentprime.io/advisories/CVE-2026-18560/https://agentprime.io/advisories/CVE-2026-18560/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 Oct 2026 07:10:12 GMTCVECVE-2026-16453: Mattermost SAML RelayState forgery allows unauthorized team membershiphttps://agentprime.io/advisories/CVE-2026-16453/https://agentprime.io/advisories/CVE-2026-16453/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 Oct 2026 07:08:48 GMTCVECVE-2026-19600: Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attemptshttps://agentprime.io/advisories/CVE-2026-19600/https://agentprime.io/advisories/CVE-2026-19600/CVSS 4.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 Oct 2026 07:07:17 GMTCVECVE-2026-19621: Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread readshttps://agentprime.io/advisories/CVE-2026-19621/https://agentprime.io/advisories/CVE-2026-19621/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 Oct 2026 07:06:00 GMTCVECVE-2026-19603: Private channel ID disclosure via user status endpointshttps://agentprime.io/advisories/CVE-2026-19603/https://agentprime.io/advisories/CVE-2026-19603/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 Oct 2026 07:02:38 GMTCVECVE-2026-18795: Missing server side validation allowed user to quarantine a DM and GM posthttps://agentprime.io/advisories/CVE-2026-18795/https://agentprime.io/advisories/CVE-2026-18795/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 Oct 2026 07:01:22 GMTCVECVE-2026-19867: Uncapped mention keys in user notification properties allow CPU exhaustion during post processinghttps://agentprime.io/advisories/CVE-2026-19867/https://agentprime.io/advisories/CVE-2026-19867/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 Oct 2026 07:00:12 GMTCVECVE-2026-19601: Disclosure of AD/LDAP bind password via Test Connectionhttps://agentprime.io/advisories/CVE-2026-19601/https://agentprime.io/advisories/CVE-2026-19601/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 Oct 2026 06:58:33 GMTCVECVE-2026-18551: Mattermost guest account privilege escalation via member roles APIhttps://agentprime.io/advisories/CVE-2026-18551/https://agentprime.io/advisories/CVE-2026-18551/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 Oct 2026 06:56:51 GMTCVECVE-2026-19541: Outgoing OAuth connection client secret exposure during connection validationhttps://agentprime.io/advisories/CVE-2026-19541/https://agentprime.io/advisories/CVE-2026-19541/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 Oct 2026 06:54:57 GMTCVECVE-2026-96260: Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated userhttps://agentprime.io/advisories/CVE-2026-96260/https://agentprime.io/advisories/CVE-2026-96260/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 22 Sep 2026 20:34:49 GMTCVECVE-2026-96259: Mattermost server-side request forgery via OAuth endpoints configurable by a System Administratorhttps://agentprime.io/advisories/CVE-2026-96259/https://agentprime.io/advisories/CVE-2026-96259/CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 22 Sep 2026 20:34:20 GMTCVECVE-2026-95666: Unbounded post ID array in the bulk reactions endpoint allows denial of servicehttps://agentprime.io/advisories/CVE-2026-95666/https://agentprime.io/advisories/CVE-2026-95666/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 22 Sep 2026 13:11:13 GMTCVECVE-2026-12284: Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handlerhttps://agentprime.io/advisories/CVE-2026-12284/https://agentprime.io/advisories/CVE-2026-12284/CVSS 3.8 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 17 Sep 2026 15:11:52 GMTCVECVE-2026-75588: Mattermost Desktop App plugin popout scheme validation bypasshttps://agentprime.io/advisories/CVE-2026-75588/https://agentprime.io/advisories/CVE-2026-75588/CVSS 2.6 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 17 Sep 2026 15:09:40 GMTCVECVE-2026-75025: Mattermost Desktop local network access from server-rendered contenthttps://agentprime.io/advisories/CVE-2026-75025/https://agentprime.io/advisories/CVE-2026-75025/CVSS 4.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 18:27:02 GMTCVECVE-2026-91181: Data Retention Teams Endpoint Leaks Private Team Invite IDhttps://agentprime.io/advisories/CVE-2026-91181/https://agentprime.io/advisories/CVE-2026-91181/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 21:21:47 GMTCVECVE-2026-12985: Mattermost DCR redirect URI allowlist bypass via improper URL component validationhttps://agentprime.io/advisories/CVE-2026-12985/https://agentprime.io/advisories/CVE-2026-12985/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 14:09:53 GMTCVECVE-2026-82920: Mattermost ABAC parent policy bypass via policy update endpointhttps://agentprime.io/advisories/CVE-2026-82920/https://agentprime.io/advisories/CVE-2026-82920/CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 13:59:01 GMTCVECVE-2026-86348: MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin processhttps://agentprime.io/advisories/CVE-2026-86348/https://agentprime.io/advisories/CVE-2026-86348/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 13:52:24 GMTCVECVE-2026-86349: Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nestinghttps://agentprime.io/advisories/CVE-2026-86349/https://agentprime.io/advisories/CVE-2026-86349/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 13:51:30 GMTCVECVE-2026-10556: Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.https://agentprime.io/advisories/CVE-2026-10556/https://agentprime.io/advisories/CVE-2026-10556/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 10:46:01 GMTCVECVE-2026-13417: Boards plugin denial of service via unvalidated block fields.propertieshttps://agentprime.io/advisories/CVE-2026-13417/https://agentprime.io/advisories/CVE-2026-13417/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 10:44:59 GMTCVECVE-2026-9812: Missing property field ownership validation in Playbooks run property update endpointhttps://agentprime.io/advisories/CVE-2026-9812/https://agentprime.io/advisories/CVE-2026-9812/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 10:43:45 GMTCVECVE-2026-8821: Playbooks run owner channel membership permission bypasshttps://agentprime.io/advisories/CVE-2026-8821/https://agentprime.io/advisories/CVE-2026-8821/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 10:42:42 GMTCVECVE-2026-5132: Unbounded zlib decompression in Calls SDP WebSocket messageshttps://agentprime.io/advisories/CVE-2026-5132/https://agentprime.io/advisories/CVE-2026-5132/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 10:41:42 GMTCVECVE-2026-15814: Uploading a crafted image causes excessive memory allocation in the Mattermost Serverhttps://agentprime.io/advisories/CVE-2026-15814/https://agentprime.io/advisories/CVE-2026-15814/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 10:39:45 GMTCVECVE-2026-10542: Playbooks channel action update validation issuehttps://agentprime.io/advisories/CVE-2026-10542/https://agentprime.io/advisories/CVE-2026-10542/CVSS 5.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 10:37:32 GMTCVECVE-2026-14344: Inconsistent authorization checks in Mattermost Boards endpointshttps://agentprime.io/advisories/CVE-2026-14344/https://agentprime.io/advisories/CVE-2026-14344/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 10:33:54 GMTCVECVE-2026-12882: Mattermost Markdown autolink parsing denial of servicehttps://agentprime.io/advisories/CVE-2026-12882/https://agentprime.io/advisories/CVE-2026-12882/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 10:30:39 GMTCVECVE-2026-11993: Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustionhttps://agentprime.io/advisories/CVE-2026-11993/https://agentprime.io/advisories/CVE-2026-11993/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 10:29:19 GMTCVECVE-2026-14259: Board archive import bypasses team board creation permissionshttps://agentprime.io/advisories/CVE-2026-14259/https://agentprime.io/advisories/CVE-2026-14259/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 10:26:41 GMTCVECVE-2026-75587: Plaintext pre-auth secret exposure via Desktop App diagnostics reporthttps://agentprime.io/advisories/CVE-2026-75587/https://agentprime.io/advisories/CVE-2026-75587/CVSS 3.6 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 17 Aug 2026 22:09:49 GMTCVECVE-2026-9693: Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invitehttps://agentprime.io/advisories/CVE-2026-9693/https://agentprime.io/advisories/CVE-2026-9693/CVSS 3.5 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 17 Aug 2026 22:07:12 GMTCVECVE-2026-9859: Mattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors to expose boards to arbitrary channelshttps://agentprime.io/advisories/CVE-2026-9859/https://agentprime.io/advisories/CVE-2026-9859/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 17 Aug 2026 22:06:26 GMTCVECVE-2026-9816: Insufficient server-side validation of board member role fields permits privilege escalationhttps://agentprime.io/advisories/CVE-2026-9816/https://agentprime.io/advisories/CVE-2026-9816/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 17 Aug 2026 22:05:24 GMTCVECVE-2026-10080: Boards plugin panics on WebSocket command with non-string field typeshttps://agentprime.io/advisories/CVE-2026-10080/https://agentprime.io/advisories/CVE-2026-10080/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 17 Aug 2026 22:04:30 GMTCVE