漏洞公告

Mattermost doesn't validate the Host header when constructing response URLs for custom slash command

Mattermost doesn't check public/private permissions

Mattermost doesn't check if {{team_id}} was being changed when updating playbooks

Mattermost doesn't sanitize sensitive configuration fields before including them in support packet generation

Mattermost doesn't verify channel membership when processing AI-assisted message rewrites

Mattermost doesn't sanitize sensitive configuration fields in the Mattermost Calls plugin

Mattermost doesn't check the create_post channel permission during post edit operations

Mattermost doesn't limit the size of the request body on the start meeting API endpoint

Mattermost doesn't escape some variables that could contain malicious content during error page composition

Mattermost doesn't enforce client identity binding during the OAuth authorization code redemption flow

Mattermost doesn't validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation

Mattermost doesn't validate 7zip archive structure before processing

Mattermost does not verify remote cluster channel access when processing shared channel membership removals

AMF Vulnerable to Improper Resource Shutdown or Release

AMF Improperly Restricts Operations within the Bounds of a Memory Buffer

AMF Vulnerable to Improper Resource Shutdown or Release

AMF Vulnerable to Improper Resource Shutdown or Release

AMF Improperly Restricts Operations within the Bounds of a Memory Buffer

org.linlinjava:litemall-wx-api has an Injection issue

@ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue

@kilocode/cli Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Beetl's SpELFunction extension function has an expression injection risk

AstrBot: File upload vulnerability in the function post_file of the file astrbot/dashboard/routes/chat.py