First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-14435

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Mattermost versions 10.11.x <= 10.11.8, 11.1.x <= 11.1.1, 11.0.x <= 11.0.6 fail to prevent infinite re-renders on API errors which allows authenticated users to cause application-level DoS via triggering unbounded component re-render loops.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Mattermost	Mattermost	>= 10.11.0, <= 10.11.8; >= 11.1.0, <= 11.1.1; >= 11.0.0, <= 11.0.6

References

https://mattermost.com/security-updatesVendor Advisory

Timeline

Published: Jan 16, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-144367.2The Brevo for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user_connection_id’ parameter in all ve CVE-2025-144377.5The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.18.CVE-2025-144386.4The Xagio SEO – AI Powered SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.1.0 CVE-2025-144409.8The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. This is due t CVE-2025-144414.3The Popupkit plugin for WordPress is vulnerable to arbitrary subscriber data deletion due to missing authorization on the DELETE `/subscribe CVE-2025-144425.3The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to sensitive information exposure due to storage o CVE-2025-144436.4A flaw was found in ose-openshift-apiserver. This vulnerability allows internal network enumeration, service discovery, limited information CVE-2025-144445.3The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to payment CVE-2025-144456.4The Image Hotspot by DevVN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hotspot_content' custom field meta in CVE-2025-144465.4The Popup Builder (Easy Notify Lite) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che CVE-2025-144474.3The AnnunciFunebri Impresa plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the CVE-2025-144485.4The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Multiple Checkbox and Multiple Se

CVE-2025-14435: Medium severity, CVSS 6.5 | Vulnix