Security advisories

high2026-03-16

CVE-2026-29112-Uncontrolled memory allocation via crafted SVG dimensions in @dicebear/converter

dicebear/dicebear · GHSA-v3r3-4qgc-vw66

high2026-03-16

CVE-2026-28498-Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding

authlib/authlib · GHSA-m344-f55w-2m6j

low2026-03-16

CVE-2026-22545-Mattermost fails to validate user's authentication method when processing account auth type switch

mattermost/mattermost · GHSA-rv67-7w2g-7976

medium2026-03-16

CVE-2026-2455-Mattermost fails to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation

mattermost/mattermost · GHSA-gqv7-j2j8-qmwq

medium2026-03-16

CVE-2026-24692-Mattermost fails to properly enforce read permissions in search API endpoints

mattermost/mattermost · GHSA-cwfj-642j-gfh4

medium2026-03-16

CVE-2026-4265-Mattermost fails to validate team-specific upload_file permissions

mattermost/mattermost · GHSA-xpvf-6qcc-9jqc

medium2026-03-16

CVE-2026-4229-Vanna has a SQL injection in the remove_training_data function

vanna-ai/vanna · GHSA-6mj8-jmp2-g8q7

medium2026-03-16

CVE-2026-21386-Mattermost fails to use consistent error responses when handling the /mute command

mattermost/mattermost · GHSA-5mr9-crcg-8wh2

medium2026-03-16

CVE-2026-4175-Aureus ERP vulnerable to cross-site scripting in the Chatter Message Handler

aureuserp/aureuserp · GHSA-76c2-3q6g-xvpm

medium2026-03-16

CVE-2026-32774-Vulnogram contains a stored cross-site scripting vulnerability in comment hypertext handling

vulnogram/vulnogram · GHSA-vggc-6pg2-xvp9

medium2026-03-16

CVE-2026-2461-Mattermost Boards Plugin fails to implement authorisation checks on comment block modifications

mattermost/mattermost-plugin-boards · GHSA-hf8w-x9h5-5gf9

medium2026-03-16

CVE-2026-2463-Mattermost fails to filter invite IDs based on user permissions

mattermost/mattermost · GHSA-fx49-m253-27jj

medium2026-03-16

CVE-2026-2458-Mattermost allows a removed team member to enumerate all public channels within a private team

mattermost/mattermost · GHSA-679f-wmrg-qf57

high2026-03-16

CVE-2026-2476-Mattermost Microsoft Teams Plugin fails to properly mask sensitive configuration values

mattermost/mattermost-plugin-msteams · GHSA-4ppj-6chv-5pgc

medium2026-03-16

CVE-2026-2578-Mattermost fails to preserve the redacted state of burn-on-read posts during deletion

mattermost/mattermost · GHSA-3rhr-jr63-hwq5

medium2026-03-16

CVE-2026-2456-Mattermost fails to limit the size of responses from integration action endpoints

mattermost/mattermost · GHSA-34g8-9fpp-46ch

medium2026-03-16

CVE-2026-25780-Mattermost fails to bound memory allocation when processing DOC files

mattermost/mattermost · GHSA-xv2p-wchj-qjhp

medium2026-03-16

CVE-2026-2457-Mattermost allows attackers to spoof permalink embeds

mattermost/mattermost · GHSA-ph22-fw5m-w2q9

high2026-03-16

CVE-2026-24458-Mattermost fails to properly handle very long passwords

mattermost/mattermost · GHSA-m5rv-56xx-hfc6

medium2026-03-16

CVE-2026-26246-Mattermost fails to bound memory allocation when processing PSD image files

mattermost/mattermost · GHSA-44mv-jq72-gj49