CVE-2025-13523

Mattermost Confluence plugin version 1.7.0 fails to properly escape user-controlled display names in HTML template rendering which allows authenticated Confluence users with malicious display names to execute arbitrary JavaScript in victim browsers via sending a specially crafted OAuth2 connectio...

CVE-2025-13523

CVE-2025-13523 affects Mattermost Confluence plugin versions prior to 1.7.0. The root cause is improper escaping of user-controlled display names during HTML template rendering. This allows authenticated Confluence users with malicious display names to trigger arbitrary JavaScript execution in a ...

EUVD-2025-24174

Malicious code in bioql PyPI...

EUVD-2025-24173

Malicious code in bioql PyPI...

EUVD-2025-24177

Malicious code in bioql PyPI...

EUVD-2025-24172

Malicious code in bioql PyPI...

EUVD-2025-24180

Malicious code in bioql PyPI...

EUVD-2025-24179

Malicious code in bioql PyPI...

EUVD-2025-24175

Malicious code in bioql PyPI...

EUVD-2025-24169

Malicious code in bioql PyPI...

EUVD-2025-24176

Malicious code in bioql PyPI...

EUVD-2025-24178

Malicious code in bioql PyPI...

EUVD-2025-24171

Malicious code in bioql PyPI...

EUVD-2025-24181

Malicious code in bioql PyPI...

EUVD-2025-24170

Malicious code in bioql PyPI...

SUSE CVE-2025-44001

Mattermost Confluence Plugin version 1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details without proper access to the channel via API call to the Get Channel Subscriptions details endpoint...

SUSE CVE-2025-49221

Mattermost Confluence Plugin version 1.5.0 fails to enforce authentication of the user to the Mattermost instance which allows unauthenticated attackers to access subscription details without via API call to GET subscription endpoint...

SUSE CVE-2025-52931

Mattermost Confluence Plugin version 1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to update channel subscription endpoint with an invalid request body...

SUSE CVE-2025-53857

Mattermost Confluence Plugin version 1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details without proper access to the channel via API call to the GET autocomplete/GetChannelSubscriptions endpoint...

SUSE CVE-2025-54463

Mattermost Confluence Plugin version 1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to server webhook endpoint with an invalid request body...