Slack's vulnerability footprint is narrowly scoped around its collaboration platform and related integrations such as Nebula and WordPress plugins, with observed weaknesses centered on information disclosure, path traversal, and cryptographic signature verification. Treat this as a compact vendor profile; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Slack over time
Signals from CVEs in this vendor scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-25793HIGH Nebula is a scalable overlay networking tool. In versions from 1.7.0 to 1.10.2, when using P256 certificates (which is not the default configuration), it is possible to evade a blo | Feb 6, 2026 | 8.1 | 27 | NO | NO |
CVE-2020-11498HIGH Slack Nebula through 1.1.0 contains a relative path vulnerability that allows a low-privileged attacker to execute code in the context of the root user via tun_darwin.go or tun_win | Apr 2, 2020 | 8.8 | 27 | NO | NO |
CVE-2019-14366HIGH WP SlackSync plugin through 1.8.5 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack (channels, members, | Nov 12, 2019 | 7.5 | 24 | NO | NO |
CVE-2025-62820MEDIUM Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network. | Oct 23, 2025 | 4.9 | 18 | NO | NO |
Signals from CVEs in this vendor scope (4 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Slack.
Media articles that mention a CVE ID that affects a product developed by Slack — matched by CVE ID, not by vendor name.