Communication and Collaboration

In Discourse versions 3.5.0 and below a medium severity vulnerability CVE-2025-58055 was detected. The AI suggestion endpoints for topic “Title,” “Category,” and “Tags” allowed authenticated users to extract information about topics they weren’t authorized to access by modifying the topic_id parameter in API requests. To address this issue, users should upgrade Discourse to version 3.5.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-58055.

In Discourse versions 3.5.0 and below a medium severity vulnerability CVE-2025-58054 was detected. The platform is vulnerable to Cross-Site Scripting attacks through parsing and rendering of chat channel titles and chat thread titles via the quote message functionality when using the rich text editor. To address this issue, users should upgrade Discourse to version 3.5.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-58054.

In Mattermost versions 9.11.x ≤ 9.11.17, 10.5.x ≤ 10.5.8, 10.8.x ≤ 10.8.3, 10.9.x ≤ 10.9.3, and 10.10.x ≤ 10.10.1 a critical severity vulnerability CVE-2025-9079 was detected. This vulnerability allows admin users to execute arbitrary code by uploading a malicious plugin to the prepackaged plugins directory due to improper validation of the import directory path configuration. To fix this issue, users should upgrade Mattermost to version 9.11.18, 10.5.9, 10.8.4, 10.9.4, 10.10.2, or 10.11.0. For more information, visit https://nvd.nist.gov/vuln/detail/CVE-2025-9079.

In Mattermost versions 10.5.x ≤ 10.5.8 and 9.11.x ≤ 9.11.17 a low severity vulnerability CVE-2025-9081 was detected. This vulnerability allows any authenticated user to download sensitive files via the board file download endpoint using UUID enumeration due to improper access control validation. To fix this problem, users should upgrade to Mattermost version 10.5.9 or 9.11.18. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-9081.

In Mattermost versions 10.10.x prior to 10.10.2, 10.5.x prior to 10.5.10, and 10.9.x prior to 10.9.5 a medium severity vulnerability CVE-2025-9072 was detected. This vulnerability allows attackers to take over Mattermost accounts by crafting a malicious link that abuses the RelayState SAML parameter, enabling user cookies to be sent to an attacker-controlled URL after authentication. To address this issue, users should upgrade Mattermost to versions 10.10.2, 10.5.10, or 10.9.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-9072.

In Mattermost versions 10.8.x prior to 10.8.4, 10.5.x prior to 10.5.9, 9.11.x prior to 9.11.18, 10.10.x prior to 10.10.2, and 10.9.x prior to 10.9.4 a medium severity vulnerability CVE-2025-9078 was detected. This vulnerability allows authenticated users to access unauthorized posts and poison link previews by exploiting weak cache key validation through hash collision attacks on FNV-1 hashing. To address this issue, users should upgrade Mattermost to versions 10.8.4, 10.5.9, 9.11.18, 10.10.2, or 10.9.4. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-9078.

In Mattermost versions 10.5.x prior to 10.5.10 a medium severity vulnerability CVE-2025-9084 was detected. This vulnerability allows attackers to redirect users to malicious sites via crafted OAuth login URLs due to improper validation of redirect URLs. To address this issue, users should upgrade Mattermost to version 10.5.10 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-9084.

In Mattermost Server versions 10.10.x up to and including 10.10.1 a medium severity vulnerability CVE-2025-9076 was detected. This vulnerability allows malicious or compromised remote clusters to access sensitive user information via unsanitized user objects during shared channel membership synchronization. To address this issue, users should upgrade Mattermost Server to version 10.10.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-9076.

In pgAdmin 4 versions 9.7 and below a high severity vulnerability CVE-2025-9636 was detected. This vulnerability allows an attacker to manipulate the OAuth flow, which could lead to unauthorised account access, account takeover, data breaches, and privilege escalation. Currently, there is no fix versions for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-9636.