Rocket.chat vulnerabilities

Products

• Rocket.chat 81

Newest

• rocket.chat Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method CVE-2026-75575 6.9 MediumAugust 25, 2026
• rocket.chat Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10... CVE-2026-65645 4.3 MediumAugust 21, 2026
• rocket.chat Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10... CVE-2026-65644 7.5 HighAugust 21, 2026
• rocket.chat Rocket.Chat: Broken Access Control in channels.convertToTeam Allows Unauthorized Conversion of Public Channels into Teams CVE-2026-72919 4.3 MediumAugust 10, 2026
• rocket.chat Rocket.Chat: Insecure implementation of websocket notifications CVE-2026-72918 5.4 MediumAugust 10, 2026
• rocket.chat An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when... CVE-2026-56845 7.5 HighAugust 4, 2026
• rocket.chat Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8,... CVE-2026-58066 9.8 CriticalJuly 30, 2026
• rocket.chat Rocket.Chat: Any Authenticated User Can Permanently Deregister Workspace from Rocket.Chat Cloud via Unprotected `/api/v1/fingerprint` Endpoint CVE-2026-55762 8.1 HighJune 24, 2026
• rocket.chat Rocket.Chat: Apple Sign-In skips JWT claims validation, allowing expired and cross-audience token replay CVE-2026-55759 7.4 HighJune 24, 2026
• rocket.chat Rocket.Chat: Email Parameter Fallback Leads To Account Takeover Within Apple OAuth CVE-2026-55666 9.3 CriticalJune 24, 2026
• rocket.chat Rocket.Chat: Livechat Visitor Profile Disclosure Leaks Bearer Token and Enables Visitor Impersonation CVE-2026-49278 6.7 MediumJune 24, 2026
• rocket.chat Rocket.Chat: OAuth access and refresh tokens remain valid after account deactivation CVE-2026-49277 2.3 LowJune 24, 2026
• rocket.chat Rocket.Chat: users.deactivateIdle` deactivates accounts without revoking existing login tokens CVE-2026-45757 2.3 LowJune 24, 2026
• rocket.chat Rocket.Chat: SAML signature validation skipped when IdP certificate field is empty CVE-2026-46423 9.3 CriticalJune 24, 2026
• rocket.chat Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATO CVE-2026-45689 9.1 CriticalJune 24, 2026
• rocket.chat Rocket.Chat: Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAML User Session Hijack CVE-2026-45688 9.1 CriticalJune 24, 2026
• rocket.chat Rocket.Chat: Authenticated Arbitrary Data Export Theft via Mass Assignment in sendFileMessage CVE-2026-45687 8.5 HighJune 24, 2026
• rocket.chat Rocket.Chat: Lack of SAML Signature Check During Logout Could Lead To DoS CVE-2026-45677 8.7 HighJune 24, 2026
• rocket.chat Rocket.Chat: Missing URL protocol sanitization in ImageElement allows javascript: URLs in markdown images CVE-2026-47733 4.4 MediumJune 24, 2026
• rocket.chat Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is... CVE-2026-48929 7.5 HighJune 16, 2026
• rocket.chat Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access... CVE-2026-48616 9.3 CriticalJune 16, 2026
• rocket.chat The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8... CVE-2026-32995 7.5 HighMay 28, 2026
• rocket.chat The /api/v1/autotranslate.translateMessage endpoint in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, ... CVE-2026-32994 5.3 MediumMay 19, 2026
• rocket.chat In versions <8.4.0, <8.3.2, <8.2.2, <8.1.3, <8.0.4, <7.13.6, <7.12.7, <7.11.7, and <7.10.10, the... CVE-2026-29197 4.3 MediumApril 23, 2026
• rocket.chat In Rocket.Chat <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7.10.9, a NoSQL... CVE-2026-29198 Public exploit 9.8 CriticalApril 22, 2026
• rocket.chat An open redirect vulnerability in Rocket.Chat versions prior to 8.4.0 allows users to be... CVE-2026-22560 5.3 MediumApril 10, 2026
• rocket.chat Rocket.Chat: NoSQL injection in the EE ddp-streamer-service CVE-2026-30833 6.9 MediumMarch 6, 2026
• rocket.chat Rocket.Chat: 2FA bypass and login of deactivated users via EE ddp-streamer CVE-2026-30831 8.0 HighMarch 6, 2026
• rocket.chat Rocket.Chat: Users can login with any password via the EE ddp-streamer-service CVE-2026-28514 9.3 CriticalMarch 6, 2026
• rocket.chat Rocket.Chat Unauthorized Access to OAuth App Details CVE-2026-23477 7.7 HighJanuary 14, 2026
• rocket.chat rocket.chat Incorrect Authorization Information Disclosure Vulnerability CVE-2025-7974 3.7 LowSeptember 2, 2025
• rocket.chat desktop macOS Rocket.Chat: TCC Policy Bypass via Dylib Injection Due to Missing Code Signing Flags and Dangerous Entitlements CVE-2024-8270 5.5 MediumJune 10, 2025
• rocket.chat RocketChat parseMessage.js parseMessage redos CVE-2025-5892 5.3 MediumJune 9, 2025
• notfound mobile, rocketchat rocket.chat +1 more The E2EE password entropy generated by Rocket.Chat Mobile prior to version 4.5.1 is insufficient,... CVE-2024-42027 6.7 MediumOctober 7, 2024
• rocket.chat Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier allows stored XSS in the... CVE-2024-47048 5.4 MediumSeptember 24, 2024
• rocket.chat Denial of service in rocket chat message parser CVE-2024-46935 Fix available 7.5 HighSeptember 24, 2024
• rocket.chat Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to DOM-based... CVE-2024-46934 6.1 MediumSeptember 24, 2024
• rocket.chat The Electron desktop application of Rocket.Chat through 6.3.4 allows stored XSS via links in an... CVE-2024-45621 5.4 MediumSeptember 2, 2024
• rocket.chat Rocket.Chat Server-Side Request Forgery (SSRF) vulnerability CVE-2024-39713 Public exploitFix available 8.6 HighAugust 5, 2024
• rocket.chat Livechat messages can be leaked by combining two NoSQL injections affecting livechat:loginByToken... CVE-2024-37405 6.5 MediumJuly 12, 2024
• rocket.chat A NoSQL injection vulnerability has been identified in the listEmojiCustom method call within... CVE-2023-28359 5.3 MediumMay 11, 2023
• rocket.chat A vulnerability has been discovered in Rocket.Chat where a markdown parsing issue in the "Search... CVE-2023-28358 6.1 MediumMay 11, 2023
• rocket.chat A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command ... CVE-2023-28357 4.3 MediumMay 11, 2023
• rocket.chat A vulnerability has been identified where a maliciously crafted message containing a specific... CVE-2023-28356 7.5 HighMay 11, 2023
• rocket.chat An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to... CVE-2023-28325 6.5 MediumMay 11, 2023
• rocket.chat A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of... CVE-2023-28318 5.3 MediumMay 9, 2023
• rocket.chat A vulnerability has been discovered in Rocket.Chat, where editing messages can change the... CVE-2023-28317 5.3 MediumMay 9, 2023
• rocket.chat A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat... CVE-2023-28316 9.8 CriticalMay 9, 2023
• rocket.chat An improper access control vulnerability exists prior to v6 that could allow an attacker to break... CVE-2023-23911 7.5 HighMarch 10, 2023
• rocket.chat A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an... CVE-2023-23917 8.8 HighFebruary 23, 2023
• Show olderLoading…