CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,475 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,475
Show in the list
Critical, last 7 days
358
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product mattermost:mattermost_desktop. Show all products

16 CVEs, showing 1 to 16
CVESeverityTitlePublished
CVE-2026-12284Low 3.8Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler
Assigned by Mattermost
Sep 17, 2026
CVE-2026-75588Low 2.6Mattermost Desktop App plugin popout scheme validation bypass
Assigned by Mattermost
Sep 17, 2026
CVE-2026-75025Medium 4.7Mattermost Desktop local network access from server-rendered content
Assigned by Mattermost
Sep 16, 2026
CVE-2026-75587Low 3.6Plaintext pre-auth secret exposure via Desktop App diagnostics report
Assigned by Mattermost
Aug 17, 2026
CVE-2026-9602Medium 6.5Mattermost Desktop App versions <=6.2 6.0.2 5.6.13.0 fail to validate payloads sent from the Mattermost Web App to the Desktop App which allows a malicious server owner to crash the Mattermost Deskto…Jul 17, 2026
CVE-2026-8075Medium 6.5Mattermost Desktop App versions <=6.2 5.5.13 6.0.2.0 fail to properly null check when checking for headers in the Mattermost Desktop App which allows any user to crash another channel members Desktop…Jul 17, 2026
CVE-2026-8683Medium 6.5Mattermost Desktop App versions <=6.1 5.5.13.0 fail to account for attempting to open extremely long URLs in the Mattermost Desktop App which allows a malicious server owner to crash the application…Jun 15, 2026
CVE-2026-6517High 7.7Mattermost Desktop App versions <=6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded to in the Mattermost Desktop App which allows any user on a server w…Jun 15, 2026
CVE-2026-4643Low 3.5Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent server-rendered content from closing an underlying application view in the Mattermost Desktop App which allows a malicious server…May 18, 2026
CVE-2026-3471Medium 6.5Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated cra…May 18, 2026
CVE-2026-1628Medium 4.6Mattermost Desktop App versions <=5.13.3 fail to attach listeners restricting navigation to external sites within the Mattermost app which allows a malicious server to expose preload script functiona…Mar 2, 2026
CVE-2026-1046Medium 6.5Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a user’s system via the user clicking o…Feb 16, 2026
CVE-2025-13326Low 3.9Mattermost Desktop App versions <6.0.0 fail to enable the Hardened Runtime on the Mattermost Desktop App when packaged for Mac App Store which allows an attacker to inherit TCC permissions via copyin…Dec 17, 2025
CVE-2025-13321Low 3.3Mattermost Desktop App versions <6.0.0 fail to sanitize sensitive information from Mattermost logs and clear data on server deletion which allows an attacker with access to the users system to gain a…Dec 17, 2025
CVE-2025-55035Medium 6.1Mattermost Desktop App versions <=5.13.0 fail to manage modals in the Mattermost Desktop App that stops a user with a server that uses basic authentication from accessing their server which allows an…Oct 16, 2025
CVE-2025-58084Medium 6.5Mattermost Desktop App versions <= 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has configured to crash the user's application…Oct 13, 2025

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.