Go github.com/mattermost/mattermost-server
productUSpkg:golang/github.com/mattermost/mattermost-server
A product tracked in the threat graph; the vulnerabilities below are known to affect it.
by severity
11critical33high144medium18low
updated 2026-10-28
| ID | severity CVSS base severity and score (0–10). | EPSS FIRST.org probability this is exploited in the next 30 days, with its percentile rank among all CVEs. | exploitable On CISA's Known Exploited Vulnerabilities list, or a public exploit is on file. | patched Whether a fixed version is on file for an affecting range. | published | affected |
|---|
| CVE-2025-25279US | high7.5 | 24.2% (98th) | Exploit | ✓10.4.2+incompatible | 2025-02-24 | 4 versions |
| CVE-2023-5968US | medium4.9 | 0.51% (43rd) | Exploit | ✓5.3.2-0.20230825233148-f787fd63368a | 2023-11-06 | < 5.3.2-0.20230825233148-f787fd63368a |
| CVE-2017-18912US | critical9.8 | 1.39% (72nd) | — | ✓3.7.4-0.20170404171331-0b5c0794fdcb | 2020-06-19 | 2 versions |
| CVE-2017-18900US | critical9.8 | 1.30% (70th) | — | ✓3.10.3 | 2020-06-19 | 4 versions |
| CVE-2017-18874US | medium6.5 | 1.24% (69th) | — | ✓4.3.0+incompatible | 2020-06-19 | 5 versions |
| CVE-2017-18915US | critical9.8OT elevated | 1.18% (68th) | — | ✓3.8.2+incompatible | 2020-06-19 | 5 versions |
| CVE-2017-18908US | critical9.8 | 1.18% (68th) | — | ✓3.10.1 | 2020-06-19 | 4 versions |
| CVE-2016-11074US | critical9.8 | 1.18% (68th) | — | ✓3.0.0+incompatible | 2020-06-19 | 2 versions |
| CVE-2017-18885US | critical9.8 | 1.18% (68th) | — | ✓4.3.0+incompatible | 2020-06-19 | 6 versions |
| CVE-2018-21258US | high7.5 | 1.17% (67th) | — | ✓5.1.0 | 2020-06-19 | 2 versions |
| CVE-2016-11066US | high7.5 | 1.15% (67th) | — | ✓3.1.1 | 2020-06-19 | 2 versions |
| CVE-2017-18883US | critical9.1 | 1.13% (66th) | — | ✓4.2.1+incompatible | 2020-06-19 | 6 versions |
| CVE-2017-18871US | high7.5 | 1.12% (66th) | — | ✓4.3.4+incompatible | 2020-06-19 | 8 versions |
| CVE-2022-4044US | medium6.5 | 1.12% (66th) | — | ✓7.1.4 | 2022-11-23 | 3 versions |
| CVE-2017-18888US | critical9.8 | 1.11% (66th) | — | ✓4.3.0+incompatible | 2020-06-19 | 6 versions |
| CVE-2016-11067US | medium5.3 | 1.11% (66th) | — | ✓3.2.0 | 2020-06-19 | 2 versions |
| CVE-2017-18898US | medium5.3 | 1.11% (66th) | — | ✓4.0.5+incompatible | 2020-06-19 | 6 versions |
| CVE-2017-18873US | medium5.3 | 1.11% (66th) | — | ✓4.2.1-0.20171013140502-b3e4b0ac9168 | 2020-06-19 | 6 versions |
| CVE-2025-4981US | — | 1.02% (63rd) | — | ✓10.6.6+incompatible | 2025-06-20 | 6 versions |
| CVE-2017-18886US | high8.8 | 0.95% (61st) | — | ✓4.3.0+incompatible | 2020-06-19 | 6 versions |
| CVE-2022-1982US | medium6.5 | 0.94% (61st) | — | ✓6.4.3 | 2022-06-02 | 4 versions |
| CVE-2016-11078US | medium6.5 | 0.94% (61st) | — | ✓3.0.0+incompatible | 2020-06-19 | 2 versions |
| CVE-2016-11075US | medium5.3 | 0.93% (60th) | — | ✓2.0.1-0.20160310160916-26ad6d2c7696 | 2020-06-19 | 2 versions |
| CVE-2016-11068US | medium5.3 | 0.93% (60th) | — | ✓3.2.0+incompatible | 2020-06-19 | 2 versions |
| CVE-2017-18902US | medium5.3 | 0.93% (60th) | — | ✓4.0.4 | 2020-06-19 | 6 versions |
| CVE-2017-18901US | medium5.3 | 0.93% (60th) | — | ✓3.10.3 | 2020-06-19 | 3 versions |
| CVE-2017-18895US | medium5.3 | 0.93% (60th) | — | ✓4.1.1+incompatible | 2020-06-19 | 6 versions |
| CVE-2017-18887US | medium5.3 | 0.93% (60th) | — | ✓4.3.0 | 2020-06-19 | 6 versions |
| CVE-2020-14457US | medium5.3OT elevated | 0.92% (60th) | — | ✗no fix | 2020-06-19 | — |
| CVE-2022-1337US | medium6.5 | 0.92% (60th) | — | ✗no fix | 2022-04-13 | — |
| CVE-2016-11069US | high7.5 | 0.90% (59th) | — | ✓3.2.0+incompatible | 2020-06-19 | 2 versions |
| CVE-2016-11076US | medium5.3 | 0.88% (59th) | — | ✓3.0.0 | 2020-06-19 | 2 versions |
| CVE-2017-18876US | medium4.9 | 0.87% (59th) | — | ✓4.3.0+incompatible | 2020-06-19 | 4 versions |
| CVE-2022-1385US | medium4.6 | 0.84% (58th) | — | ✗no fix | 2022-04-19 | — |
| CVE-2017-18894US | high8.1 | 0.83% (57th) | — | ✓4.2.0+incompatible | 2020-06-19 | 6 versions |
| CVE-2022-2401US | medium6.5 | 0.83% (57th) | — | ✗no fix | 2022-07-14 | — |
| CVE-2017-18884US | high8.1OT elevated | 0.81% (57th) | — | ✓4.3.0+incompatible | 2020-06-19 | 6 versions |
| CVE-2017-18906US | high8.1 | 0.79% (56th) | — | ✓3.9.2-0.20170714134023-b17fca0d5ee7 | 2020-06-19 | 3 versions |
| CVE-2017-18878US | medium4.3 | 0.78% (56th) | — | ✓4.3.0+incompatible | 2020-06-19 | 4 versions |
| CVE-2017-18890US | medium4.3 | 0.78% (56th) | — | ✓4.3.0 | 2020-06-19 | 6 versions |
| CVE-2017-18916US | medium5.3 | 0.78% (56th) | — | ✓3.8.2+incompatible | 2020-06-19 | 5 versions |
| CVE-2017-18905US | medium5.3 | 0.78% (56th) | — | ✓3.10.2+incompatible | 2020-06-19 | 4 versions |
| CVE-2017-18896US | medium5.3 | 0.78% (56th) | — | ✓4.1.1+incompatible | 2020-06-19 | 6 versions |
| CVE-2025-6465US | — | 0.77% (55th) | — | ✓10.9.4 | 2025-08-21 | 8 versions |
| CVE-2016-11081US | medium4.3 | 0.75% (55th) | — | ✓2.2.0 | 2020-06-19 | 2 versions |
| CVE-2017-18875US | medium4.9 | 0.73% (54th) | — | ✓4.2.1-0.20171004194140-6d3cb2ce07fc | 2020-06-19 | 4 versions |
| CVE-2016-11072US | medium6.5 | 0.73% (54th) | — | ✓3.0.2 | 2020-06-19 | 2 versions |
| CVE-2017-18917US | high7.5 | 0.72% (54th) | — | ✓3.8.2+incompatible | 2020-06-19 | 3 versions |
| CVE-2017-18897US | medium6.1 | 0.69% (53rd) | — | ✓4.1.1 | 2020-06-19 | 6 versions |
| CVE-2017-18891US | medium6.1 | 0.69% (53rd) | — | ✓4.2.0 | 2020-06-19 | 6 versions |
showing 50 of 296