Confluence
Mattermost · 14 CVEs
Cross-Site Scripting (XSS) via Unescaped Display Names in Mattermost Confluence Plugin OAuth2 Flow
Feb 6, 2026
Unauthorized Channel Subscription Creation in Mattermost Confluence Plugin
Aug 11, 2025
Unexpected input to Create Channel Subscription endpoint causes DoS in Mattermost Confluence Plugin
Aug 11, 2025
Unauthenticated Channel Subscription Edit in Mattermost Confluence Plugin
Aug 11, 2025
Unexpected Input to Cloud Webhook endpoint Causes DoS in Mattermost Confluence Plugin
Aug 11, 2025
Unauthorized Subscription Creation to Confluence Space in Mattermost Confluence Plugin
Aug 11, 2025
Unauthorized Channel Subscription Edit in Mattermost Confluence Plugin
Aug 11, 2025
Lack of Authorization on Get Channel Subscriptions for Autocomplete in Mattermost Confluence Plugin
Aug 11, 2025
Unexpected Input to Server Webhook endpoint Causes DoS in Mattermost Confluence Plugin
Aug 11, 2025
Unexpected input to Update Channel Subscription endpoint causes DoS in Mattermost Confluence Plugin
Aug 11, 2025
Unauthenticated Access to Channel Subscription in Mattermost Confluence Plugin
Aug 11, 2025
Unauthorized Subscription Edit to Confluence Space in Mattermost Confluence Plugin
Aug 11, 2025
Unauthenticated Channel Subscription Creation in Mattermost Confluence Plugin
Aug 11, 2025
Unauthorized Channel Subscription Read in Mattermost Confluence Plugin
Aug 11, 2025
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2025-13523 | Cross-Site Scripting (XSS) via Unescaped Display Names in Mattermost Confluence Plugin OAuth2 Flow | HIGH | 0.22% | Feb 6, 2026 |
| CVE-2025-8285 | Unauthorized Channel Subscription Creation in Mattermost Confluence Plugin | MEDIUM | 0.20% | Aug 11, 2025 |
| CVE-2025-54525 | Unexpected input to Create Channel Subscription endpoint causes DoS in Mattermost Confluence Plugin | HIGH | 0.34% | Aug 11, 2025 |
| CVE-2025-54478 | Unauthenticated Channel Subscription Edit in Mattermost Confluence Plugin | HIGH | 0.24% | Aug 11, 2025 |
| CVE-2025-54463 | Unexpected Input to Cloud Webhook endpoint Causes DoS in Mattermost Confluence Plugin | HIGH | 0.30% | Aug 11, 2025 |
| CVE-2025-54458 | Unauthorized Subscription Creation to Confluence Space in Mattermost Confluence Plugin | MEDIUM | 0.21% | Aug 11, 2025 |
| CVE-2025-53910 | Unauthorized Channel Subscription Edit in Mattermost Confluence Plugin | MEDIUM | 0.20% | Aug 11, 2025 |
| CVE-2025-53857 | Lack of Authorization on Get Channel Subscriptions for Autocomplete in Mattermost Confluence Plugin | LOW | 0.21% | Aug 11, 2025 |
| CVE-2025-53514 | Unexpected Input to Server Webhook endpoint Causes DoS in Mattermost Confluence Plugin | MEDIUM | 0.29% | Aug 11, 2025 |
| CVE-2025-52931 | Unexpected input to Update Channel Subscription endpoint causes DoS in Mattermost Confluence Plugin | HIGH | 0.34% | Aug 11, 2025 |
| CVE-2025-49221 | Unauthenticated Access to Channel Subscription in Mattermost Confluence Plugin | LOW | 0.25% | Aug 11, 2025 |
| CVE-2025-48731 | Unauthorized Subscription Edit to Confluence Space in Mattermost Confluence Plugin | MEDIUM | 0.18% | Aug 11, 2025 |
| CVE-2025-44004 | Unauthenticated Channel Subscription Creation in Mattermost Confluence Plugin | HIGH | 0.21% | Aug 11, 2025 |
| CVE-2025-44001 | Unauthorized Channel Subscription Read in Mattermost Confluence Plugin | MEDIUM | 0.21% | Aug 11, 2025 |
Showing 1 to 14 of 14 CVEs