CVE-2026-13426

The Mattermost Go module github.com/mattermost/mattermost/server/public versions

CVE-2026-13426 Client4 fails to validate path parameters

The Mattermost Go module github.com/mattermost/mattermost/server/public versions v0.1.22 fail to validate path parameters when constructing API route paths which allows an attacker to redirect API calls to unintended endpoints via crafted IDs containing path traversal components. Mattermost...

Unfixed XSS vulnerability at client4.addonchat.com

Security researcher Azat Harutyunyan, has submitted on 01/06/2010 a cross-site-scripting XSS vulnerability affecting client4.addonchat.com, which at the time of submission ranked 50545 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/07/2010...