erroneo.us
Search all guides⌘K

Digest · Thursday

Security digest: November 27, 2025

2 critical advisories.

All digests · RSS · Markdown

Take stock

  • Go: 2 critical advisories (github.com/mattermost/mattermost/server/v8, github.com/mattermost/mattermost-server). Check with govulncheck ./....
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 2

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Go 2

Check: govulncheck ./...

  • Mattermost fails to to verify the token used during code exchange CVE-2025-12421 CVSS 9.9 Critical
    github.com/mattermost/mattermost/server/v8 < 8.0.0-20251022210333-acda1fb5dd46 → fixed in 8.0.0-20251022210333-acda1fb5dd46; github.com/mattermost/mattermost-server >= 11.0.0, < 11.0.3 → fixed in 11.0.3; github.com/mattermost/mattermost-server >= 10.12.0, < 10.12.2 → fixed in 10.12.2; +2 more packages
  • Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication CVE-2025-12419 CVSS 9.9 Critical
    github.com/mattermost/mattermost/server/v8 < 8.0.0-20251028000919-d3ed703dc833 → fixed in 8.0.0-20251028000919-d3ed703dc833; github.com/mattermost/mattermost-server >= 10.12.0, < 10.12.2 → fixed in 10.12.2; github.com/mattermost/mattermost-server >= 10.11.0, < 10.11.5 → fixed in 10.11.5; +2 more packages