CVE-2026-48007 | | | 2026-08-07 | Element Call is a native Matrix video conferencing application. Versions 0.5.17 through 0.19.3 report analytics data to a PostHog server, when configured to by… |
CVE-2026-45078 | Medium | 5.5 | 2026-05-28 | Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, local authenticated users can cause Synapse to starve other requests of CPU and l… |
CVE-2026-45076 | Low | 2.7 | 2026-05-28 | Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way tha… |
CVE-2026-24044 | | | 2026-02-12 | Element Server Suite Community Edition (ESS Community) deploys a Matrix stack using the provided Helm charts and Kubernetes distribution. The ESS Community Hel… |
CVE-2025-62425 | High | 8.3 | 2025-10-16 | MAS (Matrix Authentication Service) is a user management and authentication service for Matrix homeservers, written and maintained by Element. A logic flaw in… |
CVE-2025-61672 | | | 2025-10-08 | Synapse is an open source Matrix homeserver implementation. Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attack… |
CVE-2025-59161 | | | 2025-09-16 | Element Web is a Matrix web client built using the Matrix React SDK. Element Web and Element Desktop before version 1.11.112 have insufficient validation of ro… |
CVE-2025-27599 | Medium | 6.5 | 2025-04-18 | Element X Android is a Matrix Android Client provided by element.io. Prior to version 25.04.2, a crafted hyperlink on a webpage, or a locally installed malicio… |
CVE-2025-32026 | Low | 3.8 | 2025-04-08 | Element Web is a Matrix web client built using the Matrix React SDK. Element Web, starting from version 1.11.16 up to version 1.11.96, can be configured to loa… |
CVE-2025-31127 | Medium | 5.3 | 2025-04-03 | Element X Android is a Matrix Android Client provided by element.io. In Element X Android versions between 0.4.16 and 25.03.3, the entity in control of the ele… |
CVE-2025-31126 | Medium | 5.3 | 2025-04-03 | Element X iOS is a Matrix iOS Client provided by Element. In Element X iOS version between 1.6.13 and 25.03.7, the entity in control of the element.json well-k… |
CVE-2025-30355 | High | 7.1 | 2025-03-27 | Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 fro… |
CVE-2025-27606 | Medium | 5.1 | 2025-03-14 | Element Android is an Android Matrix Client provided by Element. Element Android up to version 1.6.32 can, under certain circumstances, fail to logout the user… |
CVE-2024-53867 | Medium | 4.3 | 2024-12-03 | Synapse is an open-source Matrix homeserver. The Sliding Sync feature on Synapse versions between 1.113.0rc1 and 1.120.0 can leak partial room state changes to… |
CVE-2024-53863 | Critical | 9.1 | 2024-12-03 | Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the dynamic_thumbnails option or processing a specially crafted reque… |
CVE-2024-52815 | Medium | 5.3 | 2024-12-03 | Synapse is an open-source Matrix homeserver. Synapse versions before 1.120.1 fail to properly validate invites received over federation. This vulnerability all… |
CVE-2024-52805 | High | 7.5 | 2024-12-03 | Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory… |
CVE-2024-37303 | Medium | 5.3 | 2024-12-03 | Synapse is an open-source Matrix homeserver. Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and cach… |
CVE-2024-37302 | High | 7.5 | 2024-12-03 | Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce… |
CVE-2024-51750 | Medium | 5.0 | 2024-11-12 | Element is a Matrix web client built using the Matrix React SDK. A malicious homeserver can send invalid messages over federation which can prevent Element Web… |
CVE-2024-51749 | Low | 3.5 | 2024-11-12 | Element is a Matrix web client built using the Matrix React SDK. Versions of Element Web and Desktop earlier than 1.11.85 do not check if thumbnails for attach… |
CVE-2024-47779 | | | 2024-10-15 | Element is a Matrix web client built using the Matrix React SDK. Element Web versions 1.11.70 through 1.11.80 contain a vulnerability which can, under speciall… |
CVE-2024-47771 | | | 2024-10-15 | Element Desktop is a Matrix client for desktop platforms. Element Desktop versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially c… |
CVE-2024-31208 | Medium | 6.5 | 2024-04-23 | Synapse is an open-source Matrix homeserver. A remote Matrix user with malicious intent, sharing a room with Synapse instances before 1.105.1, can dispatch spe… |
CVE-2024-26132 | Medium | 4.0 | 2024-02-29 | Element Android is an Android Matrix Client. A third-party malicious application installed on the same phone can force Element Android, version 0.91.0 through… |
CVE-2024-26131 | High | 8.4 | 2024-02-29 | Element Android is an Android Matrix Client. Element Android version 1.4.3 through 1.6.10 is vulnerable to intent redirection, allowing a third-party malicious… |