element-hq

Records32All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high12CVSS 7.0–8.9

Exploited now

element-hq records in CISA KEV

No element-hq vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Element 4 records LOW Synapse 2 records LOW Desktop 1 record MEDIUM

Records

32 records

TI-2024-35327 CVE-2024-52815 · GHSA-f3r3-h2mq-hx2h

Synapse allows a a malformed invite to break the invitee's `/sync`

MEDIUM 44

Synapse is an open-source Matrix homeserver.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0057 Published 2024-12-03 Fixed in 1.120.1 CWE-20

TI-2024-36056 CVE-2024-53863 · GHSA-vp6v-whfm-rv3g

Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders

MEDIUM 43

Synapse is an open-source Matrix homeserver.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00606 Published 2024-12-03 Fixed in 1.120.1 CWE-434

TI-2024-35318 CVE-2024-52805 · GHSA-rfq8-j7rh-8hf2

Synapse allows unsupported content types to lead to memory exhaustion

MEDIUM 43

Synapse is an open-source Matrix homeserver.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00739 Published 2024-12-03 Fixed in 1.120.1 CWE-770

TI-2022-07650 CVE-2022-23597

Remote program execution with user interaction

MEDIUM 43

Element Desktop is a Matrix client for desktop platforms with Element Web at its core.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01509 Published 2022-02-01 No fix listed CWE-416

TI-2026-19372 CVE-2026-24044

ESS Community Helm Chart has a weak server key generation method

MEDIUM 42

Element Server Suite Community Edition (ESS Community) deploys a Matrix stack using the provided Helm charts and Kubernetes distribution.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00322 Published 2026-02-12 Fixed in 25.12.1, 0.5.7 CWE-336

TI-2024-24814 CVE-2024-37302 · GHSA-4mhg-xv73-xq2x

Synapse denial of service through media disk space consumption

MEDIUM 40

Synapse is an open-source Matrix homeserver.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00596 Published 2024-12-03 Fixed in 1.106 CWE-770

TI-2026-35452 CVE-2026-48007 · GHSA-6vhh-4xw6-h2h2

Element Call reports full URLs of visited pages to analytics server

LOW 39

Element Call is a native Matrix video conferencing application.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00254 Published 2026-08-07 Fixed in 0.19.4 CWE-200

TI-2024-17222 CVE-2024-26131

Element Android Intent Redirection

LOW 37

Element Android is an Android Matrix Client.

CVSS 3.1HIGH 8.4 Local No auth No interaction EPSS 0.00473 Published 2024-02-20 Fixed in 1.6.12 CWE-923

TI-2025-38692 CVE-2025-62425

Matrix Authentication Service account password can be changed using an authenticated…

LOW 36

MAS (Matrix Authentication Service) is a user management and authentication service for Matrix homeservers, written and maintained by Element.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00459 Published 2025-10-16 No fix listed CWE-620

TI-2025-21661 CVE-2025-30355 · GHSA-v56r-hwv5-mxg6

Synapse vulnerable to federation denial of service via malformed events

LOW 35

Synapse is an open source Matrix homeserver implementation.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01226 Published 2025-03-27 Fixed in 1.127.1 CWE-20

TI-2025-20409 CVE-2025-27599

Element X Android vulnerable to loading malicious web pages via received intent

LOW 35

Element X Android is a Matrix Android Client provided by element.io.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00367 Published 2025-04-18 Fixed in 25.04.2 CWE-20

TI-2026-83420 CVE-2026-62347

Element Call exposes shared passwords in logs

LOW 32

Element Call is a native Matrix video conferencing application.

CVSS 4.0MEDIUM 5.9 Network No auth User interaction EPSS 0.00304 Published 2026-10-30 Fixed in 0.20.3 CWE-532

TI-2024-32046 CVE-2024-47771

Element Desktop vulnerable to potential exposure of access token via authenticated media

LOW 32

Element Desktop is a Matrix client for desktop platforms.

CVSS 4.0HIGH 7.0 Network Low privileges User interaction EPSS 0.00591 Published 2024-10-15 Fixed in 1.11.81 CWE-200

TI-2024-20585 CVE-2024-31208 · GHSA-3h7q-rfh9-xm4v

Synapse's V2 state resolution weakness allows DoS from remote room members

LOW 32

Synapse is an open-source Matrix homeserver.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01463 Published 2024-04-23 Fixed in 1.105.1 CWE-770

TI-2024-32054 CVE-2024-47779

Element Web vulnerable to potential exposure of access token via authenticated media

LOW 31

Element is a Matrix web client built using the Matrix React SDK.

CVSS 4.0HIGH 7.0 Network Low privileges User interaction EPSS 0.00435 Published 2024-10-15 Fixed in 1.11.81 CWE-200

TI-2026-82990 CVE-2026-119407 · GHSA-fm3q-8qwm-p5xr

Forced logout in Element Web and Desktop via URL guest credentials

LOW 30

Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00142 Published 2026-10-30 Fixed in 1.12.32 CWE-352

TI-2024-24815 CVE-2024-37303 · GHSA-gjgr-7834-rhxr

Synapse unauthenticated writes to the media repository allow planting of problematic content

LOW 30

Synapse is an open-source Matrix homeserver.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0043 Published 2024-12-03 Fixed in 1.106 CWE-306

TI-2026-32926 CVE-2026-45078 · GHSA-8q93-326v-3m7g

Synapse CPU starvation (Denial of Service)

LOW 29

Synapse is an open source Matrix homeserver implementation.

CVSS 4.0MEDIUM 6.8 Local Low privileges No interaction EPSS 0.00128 Published 2026-05-28 Fixed in 1.152.1 CWE-770

TI-2025-22388 CVE-2025-31127

Element X Android allows the entity in control of the well-known file to break the confidentiality embedded Element Call

LOW 29

Element X Android is a Matrix Android Client provided by element.io.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00204 Published 2025-04-03 Fixed in 25.03.4 CWE-200

TI-2025-22387 CVE-2025-31126

Element X iOS allows the entity in control of the well-known file to break the confidentiality of embedded Element Call

LOW 29

Element X iOS is a Matrix iOS Client provided by Element.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00204 Published 2025-04-03 Fixed in 25.03.8 CWE-200

TI-2022-20245 CVE-2022-41904

Element iOS is vulnerable due to missing decoration for events decrypted with untrusted Megolm sessions

LOW 29

Element iOS is an iOS Matrix client provided by Element.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00465 Published 2022-11-11 Fixed in 1.9.7 CWE-357

TI-2026-40312 CVE-2026-55850

Element Web: A malicious homeserver can inject HTML in Element Web using its homepage

LOW 25

Element Web is a Matrix web client built using the Matrix React SDK.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00547 Published 2026-08-21 Fixed in 1.12.22 CWE-79

TI-2025-38104 CVE-2025-61672 · GHSA-fh66-fcv5-jjfr

Synapse: Invalid device keys degrade federation functionality

LOW 25

Synapse is an open source Matrix homeserver implementation.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00476 Published 2025-10-08 Fixed in 1.138.3, 1.139.1 CWE-1287

TI-2026-76542 CVE-2026-55644

Element X iOS deeplink grants mic and camera to attacker origin

LOW 23

Element X iOS is a Matrix iOS Client provided by Element.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.0038 Published 2026-10-19 Fixed in 26.05.0 CWE-20

TI-2026-32924 CVE-2026-45076 · GHSA-6qf2-7x63-mm6v

Synapse pagination denial of service

LOW 23

Synapse is an open source Matrix homeserver implementation.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00369 Published 2026-05-28 Fixed in 1.152.1 CWE-20

Open these records in search →