An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-11082.json"