daw10

Cross-Site Scripting (XSS) via Unescaped Display Names in Mattermost Confluence Plugin OAuth2 Flow

Application-Level DoS via infinite re-render loop in user profile handling

Lack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation

Slack import bypasses email verification for team access controls

IDOR in board file download allows any user to download any file by UUID

Mattermost Server exposes sensitive user credentials during shared channel membership synchronization

Weak cache keys lead to post IDOR and link preview poisoning

Path traversal in image upload with preview overwrite

Nil pointer dereference in bulk import crashes server

Mattermost Shared Channel Upload Type Validation Bypass