Security advisories

medium2026-05-18

CVE-2026-5163-Mattermost doesn't verify channel membership when processing AI-assisted message rewrites

mattermost/mattermost · GHSA-8r89-8w26-cq32

high2026-05-18

CVE-2026-6347-Mattermost doesn't sanitize sensitive configuration fields in the Mattermost Calls plugin

mattermost/mattermost · GHSA-82j6-4fq7-fx62

medium2026-05-18

CVE-2026-3637-Mattermost doesn't check the create_post channel permission during post edit operations

mattermost/mattermost · GHSA-v549-xx3c-6pc8

medium2026-05-18

CVE-2026-2325-Mattermost doesn't limit the size of the request body on the start meeting API endpoint

mattermost/mattermost · GHSA-m3p3-8frq-q7qh

low2026-05-18

CVE-2026-3495-Mattermost doesn't escape some variables that could contain malicious content during error page composition

mattermost/mattermost · GHSA-jx93-pf6x-874r

low2026-05-18

CVE-2026-6334-Mattermost doesn't enforce client identity binding during the OAuth authorization code redemption flow

mattermost/mattermost · GHSA-jp3f-x449-4q75

low2026-05-18

CVE-2026-4273-Mattermost doesn't validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation

mattermost/mattermost · GHSA-hqpj-f3jh-29vx

medium2026-05-18

CVE-2026-6340-Mattermost doesn't validate 7zip archive structure before processing

mattermost/mattermost · GHSA-cjm8-jxpw-g43m

medium2026-05-18

CVE-2026-28759-Mattermost does not verify remote cluster channel access when processing shared channel membership removals

mattermost/mattermost · GHSA-8h9w-w78c-vvr3

low2026-05-18

CVE-2026-8783-AMF Vulnerable to Improper Resource Shutdown or Release

omec-project/amf · GHSA-6v92-ph9p-hrpc

low2026-05-18

CVE-2026-8779-AMF Improperly Restricts Operations within the Bounds of a Memory Buffer

omec-project/amf · GHSA-fxvj-wqv2-xgcq

low2026-05-18

CVE-2026-8782-AMF Vulnerable to Improper Resource Shutdown or Release

omec-project/amf · GHSA-6h8r-h22r-jj64

low2026-05-18

CVE-2026-8781-AMF Vulnerable to Improper Resource Shutdown or Release

omec-project/amf · GHSA-4qf2-p32m-7hmf

low2026-05-18

CVE-2026-8780-AMF Improperly Restricts Operations within the Bounds of a Memory Buffer

omec-project/amf · GHSA-3x4g-259h-5p7c

medium2026-05-18

CVE-2026-8771-org.linlinjava:litemall-wx-api has an Injection issue

linlinjava/litemall · GHSA-cvwm-vwhp-22jx

low2026-05-18

CVE-2026-8769-@ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue

vercel/ai · GHSA-866g-f22w-33x8

low2026-05-18

CVE-2026-8766-@kilocode/cli Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

kilo-org/kilocode · GHSA-rpc6-9c4p-j5cg

low2026-05-17

CVE-2026-8754-AstrBot: File upload vulnerability in the function post_file of the file astrbot/dashboard/routes/chat.py

astrbotdevs/astrbot · GHSA-f63h-wc26-pmvc

high2026-05-16

CVE-2026-8657- jsondiffpatch patch APIs are vulnerable to prototype pollution

benjamine/jsondiffpatch · GHSA-j4fx-xxwh-2485

medium2026-05-15

CVE-2026-4054-Mattermost doesn't validate the response body of proxied images

mattermost/mattermost · GHSA-j76w-p754-g2w7