CVE-2025-12559

Mattermost versions 11.0.x = 11.0.2, 10.12.x = 10.12.1, 10.11.x = 10.11.4, 10.5.x = 10.5.12 fail to sanitize team email addresses to be visible only to Team Admins, which allows any authenticated user to view team email addresses via the GET /api/v4/channels/channelid/commonteams endpoint...

cc.ddrpa.dorian.polystash:polystash-spring-boot-starter (>=1.0.0, <=1.0.1), com.alibaba.fastjson2:fastjson2-extension (>=2.0.27, <=2.0.66) +46 more potentially affected by CVE-2025-12183 via org.lz4:lz4-pure-java (1.8.0)

org.lz4:lz4-pure-java MAVEN version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.lz4:lz4-pure-java and may be impacted: - cc.ddrpa.dorian.polystash:polystash-spring-boot-starter =1.0.0, =2.0.27, =0.3.1, =0.40.8-public, =0.40.8-public,...

How CVSS v4.0 works: characterizing and scoring vulnerabilities

The Common Vulnerability Scoring System CVSS provides software developers, testers, and security and IT professionals with a standardized way to assess vulnerabilities. You can use CVSS to assess the threat level of each vulnerability and then prioritize mitigation accordingly. This article...

PT-2025-54658

Уязвимость функции change memory common модуля arch/arm64/mm/pageattr.c ядра операционной системы Linux связана с отсутствием проверки возвращаемого значения. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, оказать воздействие на конфиденциальность, целостность и...

GHSA-4G87-9X45-CX2H Mattermost fails to sanitize team email addresses

Mattermost versions 11.0.x = 11.0.2, 10.12.x = 10.12.1, 10.11.x = 10.11.4, 10.5.x = 10.5.12 fail to sanitize team email addresses to be visible only to Team Admins, which allows any authenticated user to view team email addresses via the GET /api/v4/channels/channelid/commonteams endpoint...

EUVD-2025-199831

Mattermost versions 11.0.x = 11.0.2, 10.12.x = 10.12.1, 10.11.x = 10.11.4, 10.5.x = 10.5.12 fail to sanitize team email addresses to be visible only to Team Admins, which allows any authenticated user to view team email addresses via the GET /api/v4/channels/channelid/commonteams endpoint...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the GET /api/v4/channels/channelid/commonteams endpoint. An attacker can access team email addresses intended to be visible only to Team Admins by making authenticated requests to this endpoint. Remediation...

CVE-2025-12559

Mattermost versions 11.0.x = 11.0.2, 10.12.x = 10.12.1, 10.11.x = 10.11.4, 10.5.x = 10.5.12 fail to sanitize team email addresses to be visible only to Team Admins, which allows any authenticated user to view team email addresses via the GET /api/v4/channels/channelid/commonteams endpoint...

CVE-2025-12559 Information Disclosure in Common Teams API

Mattermost versions 11.0.x = 11.0.2, 10.12.x = 10.12.1, 10.11.x = 10.11.4, 10.5.x = 10.5.12 fail to sanitize team email addresses to be visible only to Team Admins, which allows any authenticated user to view team email addresses via the GET /api/v4/channels/channelid/commonteams endpoint...

CVE-2025-12559 Information Disclosure in Common Teams API

Mattermost versions 11.0.x = 11.0.2, 10.12.x = 10.12.1, 10.11.x = 10.11.4, 10.5.x = 10.5.12 fail to sanitize team email addresses to be visible only to Team Admins, which allows any authenticated user to view team email addresses via the GET /api/v4/channels/channelid/commonteams endpoint...

CVE-2025-12559

Mattermost suffers an information-disclosure vulnerability CVE-2025-12559 where certain versions are not sanitizing team email addresses. Affected: Mattermost Server 11.0.x &lt;= 11.0.2; 10.12.x &lt;= 10.12.1; 10.11.x &lt;= 10.11.4; 10.5.x

CVE-2025-12559 Information Disclosure in Common Teams API

Mattermost versions 11.0.x = 11.0.2, 10.12.x = 10.12.1, 10.11.x = 10.11.4, 10.5.x = 10.5.12 fail to sanitize team email addresses to be visible only to Team Admins, which allows any authenticated user to view team email addresses via the GET /api/v4/channels/channelid/commonteams endpoint...

CVE-2025-8890

creationtimestamp| type| source ---|---|--- 2025-11-27 15:28:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m6moorbxdg2s 2025-11-28 01:04:23+00:00| seen| https://infosec.exchange/users/offseq/statuses/115624631470875781 2025-11-28 01:04:26+00:00| seen|...

@eui/deps-base (>=21.0.0-alpha.10, <=21.0.0-next.28), @eui/deps-base-light (>=21.0.0-alpha.10, <=21.0.0-next.28) potentially affected by CVE-2025-66035 via @angular/common (>=21.0.0-next.1, <=21.0.0)

@angular/common NPM version =21.0.0-next.1, =21.0.0-alpha.10, =21.0.0-alpha.10, =21.0.0-next.28 Source cves: CVE-2025-66035 Source advisory: OSV:GHSA-58C5-G7WP-6W37...

@ammar_sk/shared-lib (0.0.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.0.147-alpha) +23 more potentially affected by CVE-2025-66035 via @angular/common (>=20.0.0-rc.0, <=20.3.12)

@angular/common NPM version =20.0.0-rc.0, =5.1.121, =5.1.121, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =8.9.1, =8.9.1, =0.0.57, =0.7.2, =0.10.1, =0.8.0, =0.63.3, =0.107.0 and more Source cves: CVE-2025-66035 Source advisory: OSV:GHSA-58C5-G7WP-6W37...

4byte-peru-components (1.0.0), @aipeel/mat-currency-field (>=3.19.0, <=3.19.1) +34 more potentially affected by CVE-2025-66035 via @angular/common (>=19.0.0-next.9, <=19.2.15)

@angular/common NPM version =19.0.0-next.9, =3.19.0, =19.0.0, =3.0.0, =5.0.559-alpha, =5.0.559-alpha, =2.2.2-beta-1, =1.28.26-alpha.1, =19.0.0-next.1, =19.0.0-next.1, =0.346.0, =0.0.1-canary.0.0, =0.30.0, =0.30.1 and more Source cves: CVE-2025-66035 Source advisory: GHSA-58C5-G7WP-6W37...

4byte-peru-components (1.0.0), @aipeel/mat-currency-field (>=3.19.0, <=3.19.1) +34 more potentially affected by CVE-2025-66035 via @angular/common (>=19.0.0-next.9, <=19.2.15)

@angular/common NPM version =19.0.0-next.9, =3.19.0, =19.0.0, =3.0.0, =5.0.559-alpha, =5.0.559-alpha, =2.2.2-beta-1, =1.28.26-alpha.1, =19.0.0-next.1, =19.0.0-next.1, =0.346.0, =0.0.1-canary.0.0, =0.30.0, =0.30.1 and more Source cves: CVE-2025-66035 Source advisory: OSV:GHSA-58C5-G7WP-6W37...

@eui/deps-base (>=21.0.0-alpha.10, <=21.0.0-next.28), @eui/deps-base-light (>=21.0.0-alpha.10, <=21.0.0-next.28) potentially affected by CVE-2025-66035 via @angular/common (>=21.0.0-next.1, <=21.0.0)

@angular/common NPM version =21.0.0-next.1, =21.0.0-alpha.10, =21.0.0-alpha.10, =21.0.0-next.28 Source cves: CVE-2025-66035 Source advisory: GHSA-58C5-G7WP-6W37...

@ammar_sk/shared-lib (0.0.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.0.147-alpha) +23 more potentially affected by CVE-2025-66035 via @angular/common (>=20.0.0-rc.0, <=20.3.12)

@angular/common NPM version =20.0.0-rc.0, =5.1.121, =5.1.121, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =8.9.1, =8.9.1, =0.0.57, =0.7.2, =0.10.1, =0.8.0, =0.63.3, =0.107.0 and more Source cves: CVE-2025-66035 Source advisory: GHSA-58C5-G7WP-6W37...

@eui/deps-base (>=21.0.0-alpha.10, <=21.0.0-next.28), @eui/deps-base-light (>=21.0.0-alpha.10, <=21.0.0-next.28) potentially affected by CVE-2025-66035 via @angular/common (>=21.0.0-next.1, <=21.0.0)

@angular/common NPM version =21.0.0-next.1, =21.0.0-alpha.10, =21.0.0-alpha.10, =21.0.0-next.28 Source cves: CVE-2025-66035 Source advisory: SNYK:JS-ANGULARCOMMON-14135651...