EUVD-2022-1604

Malicious code in bioql PyPI...

CVE-2025-27936

Mattermost Plugin MSTeams versions 2.1.0 and Mattermost Server versions 10.5.x =10.5.1 with the MS Teams plugin enabled fail to perform constant time comparison on a MSTeams plugin webhook secret which allows an attacker to retrieve the webhook secret of the MSTeams plugin via a timing attack...

CVE-2025-20033

Mattermost CVE-2025-20033 affects multiple releases (10.2.0; 9.11.x up to 9.11.5; 10.0.x up to 10.0.3; 10.1.x up to 10.1.3). The root cause is failure to properly validate post types, enabling a denial-of-service against users with the sysconsole_read_plugins permission by creating a post of type...

CVE-2022-1384 Authorized users are allowed to install old plugin versions from the Marketplace

Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated and an authorized user to install and exploit an old plugin version from the Marketplace which might have known vulnerabilities...