Communication and Collaboration

In Mattermost versions 10.5.x ≤ 10.5.8 and 9.11.x ≤ 9.11.17 a low severity vulnerability CVE-2025-9081 was detected. This vulnerability allows any authenticated user to download sensitive files via the board file download endpoint using UUID enumeration due to improper access control validation. To fix this problem, users should upgrade to Mattermost version 10.5.9 or 9.11.18. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-9081.

In Mattermost versions 10.10.x prior to 10.10.2, 10.5.x prior to 10.5.10, and 10.9.x prior to 10.9.5 a medium severity vulnerability CVE-2025-9072 was detected. This vulnerability allows attackers to take over Mattermost accounts by crafting a malicious link that abuses the RelayState SAML parameter, enabling user cookies to be sent to an attacker-controlled URL after authentication. To address this issue, users should upgrade Mattermost to versions 10.10.2, 10.5.10, or 10.9.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-9072.

In Mattermost versions 10.8.x prior to 10.8.4, 10.5.x prior to 10.5.9, 9.11.x prior to 9.11.18, 10.10.x prior to 10.10.2, and 10.9.x prior to 10.9.4 a medium severity vulnerability CVE-2025-9078 was detected. This vulnerability allows authenticated users to access unauthorized posts and poison link previews by exploiting weak cache key validation through hash collision attacks on FNV-1 hashing. To address this issue, users should upgrade Mattermost to versions 10.8.4, 10.5.9, 9.11.18, 10.10.2, or 10.9.4. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-9078.

In Mattermost versions 10.5.x prior to 10.5.10 a medium severity vulnerability CVE-2025-9084 was detected. This vulnerability allows attackers to redirect users to malicious sites via crafted OAuth login URLs due to improper validation of redirect URLs. To address this issue, users should upgrade Mattermost to version 10.5.10 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-9084.

In Mattermost Server versions 10.10.x up to and including 10.10.1 a medium severity vulnerability CVE-2025-9076 was detected. This vulnerability allows malicious or compromised remote clusters to access sensitive user information via unsanitized user objects during shared channel membership synchronization. To address this issue, users should upgrade Mattermost Server to version 10.10.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-9076.

In pgAdmin 4 versions 9.7 and below a high severity vulnerability CVE-2025-9636 was detected. This vulnerability allows an attacker to manipulate the OAuth flow, which could lead to unauthorised account access, account takeover, data breaches, and privilege escalation. Currently, there is no fix versions for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-9636.

In Rocket.Chat version 7.3.1 a low severity vulnerability CVE-2025-7974 was detected. This vulnerability allows remote attackers to disclose sensitive information without authentication. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-7974.

In Discourse versions prior to 3.5.0.beta8 a low severity vulnerability CVE-2025-54411 was detected. This vulnerability allows an attacker to inject XSS into the welcome banner user name string for logged-in users. To address this issue, users should upgrade Discourse to version 3.5.0.beta8-dev or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-54411.

In Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 10.10.x <= 10.10.0, and 10.9.x <= 10.9.3 a medium severity vulnerability CVE-2025-6465 was detected. This vulnerability allows a user with file upload permission to overwrite file attachment thumbnails via path traversal in file streaming APIs. To address this issue, users should upgrade Mattermost to versions 10.8.4, 10.5.9, 10.9.4 or 10.10.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-6465.