| CVE ID | Title | Vendor | Product | Severity | CVSS Score | Published At | AI Analysis |
|---|---|---|---|---|---|---|---|
| CVE-2024-39353 | RemoteClusterFrame payloads are audit logged in full | Mattermost | Mattermost | Low | 2.7 | 2024-07-03 08:37:16 | Deep Dive |
| CVE-2024-39361 | Creating posts with user-defined IDs permitted in CreatePost API | Mattermost | Mattermost | Low | 3.1 | 2024-07-03 08:35:43 | Deep Dive |
| CVE-2024-39830 | Timing attack during remote cluster token comparison when shared channels are enabled | Mattermost | Mattermost | High | 8.1 | 2024-07-03 08:32:56 | Deep Dive |
| CVE-2024-39807 | Channel IDs of archived/restored channels leaked via webhook events | Mattermost | Mattermost | Low | 3.1 | 2024-07-03 08:31:58 | Deep Dive |
| CVE-2024-36257 | Lack of permission check when updating the profile picture of a remote user (shared channels enabled) | Mattermost | Mattermost | Low | 2.7 | 2024-07-03 08:29:10 | Deep Dive |
| CVE-2024-37182 | Lack of permissions prompting when opening external URLs | Mattermost | Mattermost | Medium | 4.7 | 2024-06-14 08:39:20 | Deep Dive |
| CVE-2024-36287 | Bypass of TCC restrictions on macOS | Mattermost | Mattermost | Low | 3.8 | 2024-06-14 08:39:08 | Deep Dive |
| CVE-2024-29215 | Slash commands run in channel without channel membership via playbook task commands | Mattermost | Mattermost | Medium | 4.3 | 2024-05-26 13:33:42 | Deep Dive |
| CVE-2024-36255 | Post actions can run playbook checklist task commands | Mattermost | Mattermost | Medium | 5.7 | 2024-05-26 13:32:56 | Deep Dive |
| CVE-2024-36241 | /playbook add slash command allows viewing arbitrary post contents | Mattermost | Mattermost | Low | 3.1 | 2024-05-26 13:32:19 | Deep Dive |
| CVE-2024-31859 | Member promoted to channel admin via playbooks run linking to channel | Mattermost | Mattermost | Medium | 4.3 | 2024-05-26 13:31:43 | Deep Dive |
| CVE-2024-5270 | SAML to email switch possible when email signin is disabled | Mattermost | Mattermost | Medium | 4.3 | 2024-05-26 13:30:53 | Deep Dive |
| CVE-2024-5272 | Run Details leak to guest via webhook event "custom_playbooks_playbook_run_updated" | Mattermost | Mattermost | Medium | 4.3 | 2024-05-26 13:29:58 | Deep Dive |
| CVE-2024-32045 | Playbook run link to private channel grants channel access | Mattermost | Mattermost | Medium | 5.9 | 2024-05-26 13:29:08 | Deep Dive |
| CVE-2024-34152 | Playbook Run Metadata leak to Guest | Mattermost | Mattermost | Medium | 4.3 | 2024-05-26 13:28:17 | Deep Dive |
| CVE-2024-34029 | AD/LDAP Group Members Leak | Mattermost | Mattermost | Medium | 4.3 | 2024-05-26 13:27:27 | Deep Dive |
| CVE-2024-4198 | Mattermost 安全漏洞 | Mattermost | Mattermost | Low | 2.7 | 2024-04-26 08:26:11 | Deep Dive |
| CVE-2024-4195 | Mattermost 安全漏洞 | Mattermost | Mattermost | Low | 2.7 | 2024-04-26 08:26:01 | Deep Dive |
| CVE-2024-4183 | Mattermost 安全漏洞 | Mattermost | Mattermost | Medium | 4.3 | 2024-04-26 08:25:47 | Deep Dive |
| CVE-2024-4182 | Mattermost 安全漏洞 | Mattermost | Mattermost | Medium | 4.3 | 2024-04-26 08:25:37 | Deep Dive |