Skip to contentMatrix vulnerabilities
Newest
- matrix-org matrix-js-sdk, matrix javascript sdk +1 morePrototype pollution in matrix-js-sdkCVE-2022-36059Fix available8.2 High
- element-hq synapseSynapse vulnerable to denial of service (DoS) due to incorrect application of event authorization rulesCVE-2022-31152Fix available6.4 Medium
- matrix dendrite, gomatrixserverlib +1 moreIncorrect parsing of access level in gomatrixserverlib and dendriteCVE-2022-36009Fix available5.0 Medium
- element-hq synapse, fedoraproject fedora +1 moreURL previews can crash Synapse media repositories or Synapse monolithsCVE-2022-31052Fix available6.5 Medium
- matrix irc bridge, matrix-org matrix-appservice-irc +1 moreImproper handling of multiline messages in matrix-appservice-ircCVE-2022-29166Fix available8.0 High
- element-hq synapseUncontrolled Resource Consumption in Matrix SynapseCVE-2022-41952Fix available6.5 Medium
- matrix element, olm, schildi schildichat +3 more +5 moreThe olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer...CVE-2021-44538Fix available9.8 Critical
- element-hq synapse, fedoraproject fedora +1 morePath traversal in Matrix SynapseCVE-2021-41281Fix available7.5 High
- matrix element, matrix-android-sdk2 +1 moreLogic error in Matrix SDK for AndroidCVE-2021-40824Fix available5.9 Medium
- matrix javascript sdkmatrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserverCVE-2021-40823Fix available5.9 Medium
- element-hq synapse, fedoraproject fedora +1 moreImproper authorisation of /members discloses room membership to non-membersCVE-2021-39164Fix available3.1 Low
- element-hq synapse, fedoraproject fedora +1 moreAdding a private/unlisted room to a community exposes room metadata in an unauthorised manner.CVE-2021-39163Fix available3.1 Low
- matrix matrix-appservice-bridgeAutomatic room upgrade handling can be used maliciously to bridge a room non-consentuallyCVE-2021-32659Fix available6.5 Medium
- matrix olmMatrix libolm before 3.2.3 allows a malicious Matrix homeserver to crash a client (while it is...CVE-2021-34813Fix available9.8 Critical
- element-hq synapse, fedoraproject fedora +1 moreDenial of service in Matrix SynapseCVE-2021-29471Fix available3.7 Low
- matrix sydentSSRF in Sydent due to missing validation of hostnamesCVE-2021-29431Fix available7.7 High
- matrix sydentMalicious users could control the content of invitation emailsCVE-2021-29432Fix available5.3 Medium
- matrix sydentDenial of service attack via memory exhaustionCVE-2021-29430Fix available7.5 High
- matrix sydentDenial of service (via resource exhaustion) due to improper input validationCVE-2021-29433Fix available4.3 Medium
- element-hq synapse, fedoraproject fedora +1 moreOpen redirect via transitional IPv6 addresses on dual-stack networksCVE-2021-21392Fix available6.3 Medium
- element-hq synapse, fedoraproject fedora +1 moreDenial of service (via resource exhaustion) due to improper input validation on groups/communities endpointsCVE-2021-21393Fix available5.3 Medium
- element-hq synapse, fedoraproject fedora +1 moreDenial of service (via resource exhaustion) due to improper input validation on third-party identifier endpointsCVE-2021-21394Fix available5.3 Medium
- element-hq synapse, fedoraproject fedora +1 moreHTML injection in email and account expiry notificationsCVE-2021-21333Fix available6.1 Medium
- element-hq synapse, fedoraproject fedora +1 moreCross-site scripting (XSS) vulnerability in the password reset endpointCVE-2021-21332Fix available6.9 Medium
- element-hq synapse, fedoraproject fedora +1 moreOpen redirects on some federation and push requestsCVE-2021-21273Fix available3.1 Low
- element-hq synapse, fedoraproject fedora +1 moreDenial of service attack via .well-known lookupsCVE-2021-21274Fix available4.3 Medium
- element-hq synapse, fedoraproject fedora +1 moreDenial of service attack via incorrect parameters to federation APIsCVE-2020-26257Fix available6.5 Medium
- matrix synapse, fedoraproject fedora +1 moreDenial of service attack due to invalid JSONCVE-2020-26890Fix available7.5 High
- matrix synapseCross-site scripting (XSS) vulnerability in the fallback authentication endpointCVE-2020-26891Fix available6.1 Medium
- matrix synapseImproper Verification of Cryptographic Signature in matrix-synapseCVE-2019-18835Fix available9.8 Critical
- matrix sydent, synapse +1 morematrix-sydent and matrix-synapse Use Cryptographically Weak PRNGCVE-2019-11842Fix available7.5 High
- matrix sydentMatrix Sydent mishandles emailsCVE-2019-11340Fix available5.9 Medium
- matrix synapse, fedoraproject fedora +1 moreMatrix Synapse Predictable Secret KeyCVE-2019-5885Fix available7.5 High
- matrix synapse, debian linux +1 moreMatrix Synapse Improper Signature ValidationCVE-2018-16515Fix available8.8 High
- matrix synapseMatrix Synapse Authorization ErrorCVE-2018-12423Fix available7.5 High
- matrix synapseMatrix Synapse Security Filtering FlawCVE-2018-12291Fix available7.5 High
- matrix synapseMatrix Synapse DoSCVE-2018-10657Fix available7.5 High