Go Package Vulnerabilities

Packages

github.com/mattermost/mattermost/server/v8199 vulnerabilities
github.com/mattermost/mattermost-server178 vulnerabilities
code.gitea.io/gitea94 vulnerabilities
gogs.io/gogs76 vulnerabilities
github.com/usememos/memos74 vulnerabilities
github.com/grafana/grafana61 vulnerabilities
github.com/rancher/rancher61 vulnerabilities
github.com/siyuan-note/siyuan/kernel58 vulnerabilities
github.com/hashicorp/vault55 vulnerabilities
github.com/traefik/traefik/v253 vulnerabilities
github.com/traefik/traefik/v352 vulnerabilities
github.com/mattermost/mattermost-server/v647 vulnerabilities
github.com/filebrowser/filebrowser/v243 vulnerabilities
k8s.io/kubernetes43 vulnerabilities
github.com/zitadel/zitadel41 vulnerabilities
github.com/argoproj/argo-cd/v237 vulnerabilities
github.com/cilium/cilium37 vulnerabilities
github.com/docker/docker36 vulnerabilities
github.com/answerdev/answer34 vulnerabilities
github.com/argoproj/argo-cd34 vulnerabilities
github.com/hashicorp/nomad34 vulnerabilities
code.vikunja.io/api33 vulnerabilities
github.com/hashicorp/consul32 vulnerabilities
github.com/openbao/openbao29 vulnerabilities
github.com/traefik/traefik29 vulnerabilities

Go vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2026-4915MEDIUM	Server panic via outgoing webhook responses Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to filter nil elements from outgoing webhook attachment payloads before processing, which allows an authenticated user to cause a denial of service (server process termination) via a crafted webhook callback response containing a null attachment entry.. Mattermost Advisory ID: MMSA-2026-00641 CWE-754May 25, 2026	CVSS6.5v3.1	EPSS0.277%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-5740HIGH	Unauthenticated WebSocket binary frame causes denial of service in Mattermost Server Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to properly validate msgpack-encoded WebSocket frames before memory allocation which allows an unauthenticated remote attacker to crash the server process and cause a full service outage for all users via a crafted binary WebSocket message sent to the public WebSocket endpoint.. Mattermost Advisory ID: MMSA-2026-00647 CWE-789May 22, 2026	CVSS7.5v3.1	EPSS0.34%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-4055MEDIUM	Insufficient permission validation on cross-team playbook run creation Mattermost versions 11.5.x <= 11.5.1 fail to validate team-level run_create permission against the target team when creating a playbook run which allows an authenticated team member to create runs in teams where they lack permission via specifying a different team ID in the run creation API request. Mattermost Advisory ID: MMSA-2026-00629 CWE-863May 21, 2026	CVSS4.3v3.1	EPSS0.152%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-6333LOW	SSRF via Host Header Spoofing in Custom Slash Commands Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate the Host header when constructing response URLs for custom slash commands which allows an authenticated attacker to redirect slash command responses to an attacker-controlled server via a spoofed Host header.. Mattermost Advisory ID: MMSA-2026-00582 CWE-918May 18, 2026	CVSS3.5v3.1	EPSS0.137%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-6345MEDIUM	Prevent password disclosure and force reset during Slack import Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail prevent disclosure of created user password which allows a malicious attacker to impersonate a user via the use of some of those passwords.. Mattermost Advisory ID: MMSA-2026-00614 CWE-522May 18, 2026	CVSS6.5v3.1	EPSS0.231%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-6346HIGH	Sensitive credentials exposed in plaintext in Mattermost support packets Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields before including them in support packet generation, which allows a Mattermost System Admin or any party with access to a support packet to obtain sensitive credentials in plaintext via downloading a support packet from the System Console.. Mattermost Advisory ID: MMSA-2026-00607 CWE-200May 18, 2026	CVSS8.7v3.1	EPSS0.301%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-28732MEDIUM	Slash command trigger-word update allowed command hijacking Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 Fail to enforce slash command trigger-word uniqueness during command updates which allows an authenticated team member with Manage Own Slash Commands permission to hijack and impersonate existing system or custom slash commands via editing their own slash command trigger to an already-registered trigger through the command update API. Mattermost Advisory ID: MMSA-2026-00597 CWE-863May 18, 2026	CVSS4.3v3.1	EPSS0.152%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-6343MEDIUM	Mattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooks Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check public/private permissions which allows members without these permissions to access public playbooks via /get.. Mattermost Advisory ID: MMSA-2026-00591 CWE-863May 18, 2026	CVSS4.3v3.1	EPSS0.165%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-5163MEDIUM	Missing authorization check in AI message rewrite endpoint allows access to private thread content Mattermost versions 11.5.x <= 11.5.1 fail to verify channel membership when processing AI-assisted message rewrites which allows an authenticated attacker to read the content of threads in private channels and direct messages they do not have access to via a crafted request to the post rewrite endpoint.. Mattermost Advisory ID: MMSA-2026-00645 CWE-862May 18, 2026	CVSS6.5v3.1	EPSS0.205%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-4286LOW	Playbooks Plugin fails to validate team transfers, allowing unauthorized removal of member access via playbook update Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to check if {{team_id}} was being changed when updating playbooks, allowing users with only {{Manage Playbook Configurations}} permission to change a playbook's team, bypassing manage members restriction via PUT api. Mattermost Advisory ID: MMSA-2025-00552 CWE-863May 18, 2026	CVSS3.1v3.1	EPSS0.143%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-6339MEDIUM	Missing request origin validation on burn-on-read reveal endpoint Mattermost versions 11.5.x <= 11.5.1, 11.4.x <= 11.4.3 fail to validate the X-Requested-With header on the burn-on-read reveal endpoint which allows an authenticated channel member to force the reveal of a burn-on-read message without recipient consent via a crafted Markdown image tag.. Mattermost Advisory ID: MMSA-2026-00636 CWE-346May 18, 2026	CVSS4.3v3.1	EPSS0.113%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-6340MEDIUM	Memory Exhaustion via Malicious 7zip File Upload Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate 7zip archive structure before processing which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted 7zip file with excessive folder declarations.. Mattermost Advisory ID: MMSA-2026-00573 CWE-789May 18, 2026	CVSS4.3v3.1	EPSS0.24%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-3495LOW	Unescaped variables during error page composition Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to escape some variables that could contain malicious content during error page composition which allows an attacker with access to edit some site configuration to execute some malicious code via injecting some JS as part of those values.. Mattermost Advisory ID: MMSA-2026-00622 CWE-79May 18, 2026	CVSS3.8v3.1	EPSS0.143%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-4273LOW	Insufficient token rotation validation in remote cluster invite confirmation Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation which allows an authenticated attacker to bypass token rotation and reuse the original invite token via sending a crafted invite confirmation with a RefreshedToken matching the original token. Mattermost Advisory ID: MMSA-2026-00575 CWE-863May 18, 2026	CVSS3.7v3.1	EPSS0.142%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-3637MEDIUM	Mattermost fails to enforce create_post permission when editing posts Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check the create_post channel permission during post edit operations which allows an authenticated attacker with revoked posting privileges to modify their existing posts via direct API requests to the post update and patch endpoints.. Mattermost Advisory ID: MMSA-2026-00627 CWE-862May 18, 2026	CVSS4.3v3.1	EPSS0.152%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-28759MEDIUM	Insufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channels Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate that a remote cluster has access to a channel before processing membership removal requests during shared channel membership sync, which allows a malicious remote cluster to remove any user from any channel, including private channels, via crafted membership sync messages targeting channels the remote cluster is not authorized to access. Mattermost Advisory ID: MMSA-2026-00576 CWE-863May 18, 2026	CVSS4.3v3.1	EPSS0.152%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-6334LOW	OAuth authorization code client binding not enforced during token redemption in Mattermost Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce client identity binding during the OAuth authorization code redemption flow which allows an authenticated OAuth client to redeem authorization codes issued to a different client via a crafted token exchange request.. Mattermost Advisory ID: MMSA-2026-00570 CWE-305May 18, 2026	CVSS3.1v3.1	EPSS0.118%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-3590MEDIUM	Race Condition in Guest Magic Link Authentication Allows Token Reuse Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 11.4.x <= 11.4.2, 11.3.x <= 11.3.2 fail to enforce atomic single-use consumption of guest magic link tokens, which allows an attacker with access to a valid magic link to establish multiple independent authenticated sessions via concurrent requests.. Mattermost Advisory ID: MMSA-2026-00624 CWE-367Apr 15, 2026	CVSS6.5v3.1	EPSS0.145%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-28741MEDIUM	CSRF Protection Bypass Allows Updating a User's Authentication Method Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 11.4.x <= 11.4.2, 11.3.x <= 11.3.2 fail to validate CSRF tokens on an authentication endpoint which allows an attacker to update a user's authentication method via a CSRF attack by tricking a user into visiting a malicious page. Mattermost Advisory ID: MMSA-2026-00625 CWE-352Apr 15, 2026	CVSS6.8v3.1	EPSS0.129%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-3112MEDIUM	Arbitrary File Read via Advanced Logging Support Packet Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to validate Advanced Logging file target paths which allows system administrators to read arbitrary host files via malicious AdvancedLoggingJSON configuration in support packet generation. Mattermost Advisory ID: MMSA-2025-00562 CWE-22Mar 26, 2026	CVSS6.8v3.1	EPSS0.421%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-3115MEDIUM	Guest users can view group member IDs without respecting view restrictions Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to apply view restrictions when retrieving group member IDs, which allows authenticated guest users to enumerate user IDs outside their allowed visibility scope via the group retrieval endpoint.. Mattermost Advisory ID: MMSA-2026-00594 CWE-863Mar 26, 2026	CVSS4.3v3.1	EPSS0.231%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-3114MEDIUM	Zip Bomb Denial of Service via Unrestricted Archive Decompression Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to validate decompressed archive entry sizes during file extraction which allows authenticated users with file upload permissions to cause a denial of service via crafted zip archives containing highly compressed entries (zip bombs) that exhaust server memory.. Mattermost Advisory ID: MMSA-2026-00598 CWE-409Mar 26, 2026	CVSS6.5v3.1	EPSS0.343%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-3108HIGH	Terminal Escape Injection in mmctl Report Posts Command Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output which allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences that enable screen manipulation, fake prompts, and clipboard hijacking.. Mattermost Advisory ID: MMSA-2026-00599 CWE-150Mar 26, 2026	CVSS8.0v3.1	EPSS0.279%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-4274MEDIUM	Insufficient authorization in shared channel membership sync grants team-level access instead of channel-level access Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to restrict team-level access when processing membership sync from a remote cluster, which allows a malicious remote cluster to grant a user access to an entire private team instead of only the shared channel via sending crafted membership sync messages that trigger team membership assignment. Mattermost Advisory ID: MMSA-2026-00574 CWE-863Mar 26, 2026	CVSS5.4v3.1	EPSS0.141%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-27659MEDIUM	CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to properly validate CSRF tokens in the /api/v4/access_control_policies/{policy_id}/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a crafted request.. Mattermost Advisory ID: MMSA-2026-00578 CWE-352Mar 25, 2026	CVSS4.6v3.1	EPSS0.123%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX