Login Request a demo
MA
Vendor
Matrix
17 products with CVEs on record
92
CVEs
0
On KEV
0
New 30D
Products
SY
Synapse
Matrix
9.8
40 CVEs0 on KEV0 new
JS
Javascript Sdk
Matrix
9.8
10 CVEs0 on KEV0 new
MI
Matrix Irc Bridge
Matrix
9.8
7 CVEs0 on KEV0 new
SY
Sydent
Matrix
7.5
7 CVEs0 on KEV0 new
OL
Olm
Matrix
9.8
5 CVEs0 on KEV0 new
SD
Software Development Kit
Matrix
7.5
4 CVEs0 on KEV0 new
TV
Tafnit v8
Matrix
9.8
4 CVEs0 on KEV0 new
DE
Dendrite
Matrix
8.8
2 CVEs0 on KEV0 new
EL
Element
Matrix
9.8
2 CVEs0 on KEV0 new
MA
Matrix-appservice-bridge
Matrix
6.5
2 CVEs0 on KEV0 new
MA
Matrix-rust-sdk
Matrix
7.5
2 CVEs0 on KEV0 new
MS
Matrix specification
Matrix
7.1
2 CVEs0 on KEV0 new
GO
Gomatrixserverlib
Matrix
8.8
1 CVEs0 on KEV0 new
HO
Hookshot
Matrix
9.0
1 CVEs0 on KEV0 new
MA
Matrix-android-sdk2
Matrix
5.9
1 CVEs0 on KEV0 new
MA
Matrix-react-sdk
Matrix
6.5
1 CVEs0 on KEV0 new
RS
React Sdk
Matrix
5.3
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2025-66622
MA
Matrix-rust-sdk
Matrix
7.5
0%
Dec 9matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event values
CVE-2025-54315
MS
Matrix specification
Matrix
7.1
0%
Oct 2The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create event uniqueness
CVE-2025-49090
MS
Matrix specification
Matrix
7.1
0%
Oct 2The Matrix specification before 1.16 (i.e., with a room version before 12 and State Resolution before 2.1) has deficient state resolution
CVE-2025-30355
SY
Synapse
Matrix
7.5
1%
Mar 27Synapse vulnerable to federation denial of service via malformed events
CVE-2025-27146
MI
Matrix Irc Bridge
Matrix
4.3
0%
Feb 25Matrix IRC Bridge allows IRC command injection to own puppeted user
CVE-2024-37303
SY
Synapse
Matrix
5.3
0%
Dec 3Synapse unauthenticated writes to the media repository allow planting of problematic content
CVE-2024-37302
SY
Synapse
Matrix
7.5
1%
Dec 3Synapse denial of service through media disk space consumption
CVE-2024-52805
SY
Synapse
Matrix
7.5
1%
Dec 3Synapse allows unsupported content types to lead to memory exhaustion
CVE-2024-52815
SY
Synapse
Matrix
5.3
1%
Dec 3Synapse allows a a malformed invite to break the invitee's `/sync`
CVE-2024-53863
SY
Synapse
Matrix
9.1
1%
Dec 3Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders
CVE-2024-45191
OL
Olm
Matrix
5.3
0%
Aug 22An issue was discovered in Matrix libolm through 3.2.16
CVE-2024-45193
OL
Olm
Matrix
4.3
0%
Aug 22An issue was discovered in Matrix libolm through 3.2.16
CVE-2024-45192
OL
Olm
Matrix
5.3
1%
Aug 22An issue was discovered in Matrix libolm through 3.2.16
CVE-2024-42369
JS
Javascript Sdk
Matrix
5.3
0%
Aug 20A room with itself as a its predecessor will freeze matrix-js-sdk
CVE-2024-42347
MA
Matrix-react-sdk
Matrix
6.5
0%
Aug 6URL preview setting for a room is controllable by the homeserver in matrix-react-sdk
CVE-2024-38432
TV
Tafnit v8
Matrix
9.8
0%
Jul 30Matrix – Tafnit v8 CWE-646: Reliance on File Name or Extension of Externally-Supplied File
CVE-2024-38431
TV
Tafnit v8
Matrix
7.5
0%
Jul 30Matrix Tafnit v8 - CWE-204: Observable Response Discrepancy
CVE-2024-38430
TV
Tafnit v8
Matrix
6.1
0%
Jul 30Matrix - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-38429
TV
Tafnit v8
Matrix
7.5
0%
Jul 30Matrix - CWE-552: Files or Directories Accessible to External Parties
CVE-2024-31208
SY
Synapse
Matrix
6.5
1%
Apr 23Synapse's V2 state resolution weakness allows DoS from remote room members
CVE-2023-43796
SY
Synapse
Matrix
5.3
1%
Oct 31Synapse vulnerable to leak of remote user device information
CVE-2023-45129
SY
Synapse
Matrix
4.9
1%
Oct 10matrix-synapse vulnerable to denial of service due to malicious server ACL events
CVE-2023-43656
HO
Hookshot
Matrix
9.0
0%
Sep 27Sandbox escape for instances that have enabled transformation functions in matrix-hookshot
CVE-2023-41335
SY
Synapse
Matrix
3.7
0%
Sep 26Temporary storage of plaintext passwords during password changes in matrix synapse
CVE-2023-42453
SY
Synapse
Matrix
4.3
1%
Sep 26Improper validation of receipts allows forged read receipts in matrix synapse
CVE-2023-38700
MI
Matrix Irc Bridge
Matrix
3.7
1%
Aug 4matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms
CVE-2023-38691
MA
Matrix-appservice-bridge
Matrix
6.5
0%
Aug 4matrix-appservice-bridge doesn't verify the sub parameter of an openId token exhange, allowing unauthorized access to provisioning APIs
CVE-2023-38690
MI
Matrix Irc Bridge
Matrix
9.8
1%
Aug 4matrix-appservice-irc IRC command injection via admin commands containing newlines
CVE-2023-38686
SY
Sydent
Matrix
5.3
0%
Aug 4Sydent does not verify email server certificates
CVE-2023-32683
SY
Synapse
Matrix
5.4
1%
Jun 6URL deny list bypass via oEmbed and image URLs when generating previews in Synapse
CVE-2023-32682
SY
Synapse
Matrix
5.4
1%
Jun 6Improper checks for deactivated users during login in synapse
CVE-2022-39374
SY
Synapse
Matrix
6.5
1%
May 26Synapse Denial of service due to incorrect application of event authorization rules during state resolution
CVE-2022-39335
SY
Synapse
Matrix
5.0
1%
May 26Synapse does not apply enough checks to servers requesting auth events of events in a room
CVE-2023-32323
SY
Synapse
Matrix
4.3
1%
May 26Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites
CVE-2023-29529
JS
Javascript Sdk
Matrix
5.3
1%
Apr 14matrix-js-sdk vulnerable to invisible eavesdropping in group calls
CVE-2022-36060
RS
React Sdk
Matrix
5.3
1%
Mar 28Prototype pollution in matrix-react-sdk
CVE-2023-28427
JS
Javascript Sdk
Matrix
8.2
1%
Mar 28Prototype pollution in matrix-js-sdk
CVE-2022-36059
JS
Javascript Sdk
Matrix
5.3
1%
Mar 28Prototype pollution in matrix-js-sdk
CVE-2022-41952
SY
Synapse
Matrix
5.3
1%
Nov 22Uncontrolled Resource Consumption in Matrix Synapse
CVE-2022-3971
MI
Matrix Irc Bridge
Matrix
5.6
1%
Nov 13matrix-appservice-irc PgDataStore.ts sql injection
CVE-2022-39252
MA
Matrix-rust-sdk
Matrix
7.5
1%
Sep 29When matrix-rust-sdk recieves forwarded room keys, the reciever doesn't check if it requested the key from the forwarder
CVE-2022-39250
JS
Javascript Sdk
Matrix
7.5
1%
Sep 29Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification
CVE-2022-39257
SD
Software Development Kit
Matrix
7.5
1%
Sep 28Matrix iOS SDK allows developers to build iOS apps compatible with Matrix
CVE-2022-39255
SD
Software Development Kit
Matrix
7.5
1%
Sep 28Matrix iOS SDK allows developers to build iOS apps compatible with Matrix
CVE-2022-39251
JS
Javascript Sdk
Matrix
7.5
1%
Sep 28Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript
CVE-2022-39249
JS
Javascript Sdk
Matrix
7.5
1%
Sep 28Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript
CVE-2022-39248
SD
Software Development Kit
Matrix
7.5
1%
Sep 28matrix-android-sdk2 is the Matrix SDK for Android
CVE-2022-39246
SD
Software Development Kit
Matrix
5.3
1%
Sep 28matrix-android-sdk2 is the Matrix SDK for Android
CVE-2022-39236
JS
Javascript Sdk
Matrix
5.3
1%
Sep 28Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript
CVE-2022-39203
MI
Matrix Irc Bridge
Matrix
8.8
1%
Sep 13matrix-appservice-irc is an open source Node.js IRC bridge for Matrix
CVE-2022-39202
MI
Matrix Irc Bridge
Matrix
6.3
1%
Sep 13matrix-appservice-irc is an open source Node.js IRC bridge for Matrix
CVE-2022-39200
DE
Dendrite
Matrix
5.3
0%
Sep 12Dendrite is a Matrix homeserver written in Go
CVE-2022-31152
SY
Synapse
Matrix
7.5
1%
Sep 2Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation
CVE-2022-36009
DE
Dendrite
Matrix
8.8
1%
Aug 19gomatrixserverlib is a Go library for matrix protocol federation
CVE-2022-31052
SY
Synapse
Matrix
6.5
2%
Jun 28Synapse is an open source home server implementation for the Matrix chat network
CVE-2022-29166
MI
Matrix Irc Bridge
Matrix
8.8
1%
May 5matrix-appservice-irc is a Node.js IRC bridge for Matrix
CVE-2021-44538
JS
Javascript Sdk
Matrix
9.8
2%
Dec 14The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow
CVE-2021-41281
SY
Synapse
Matrix
7.5
2%
Nov 23Synapse is a package for Matrix homeservers written in Python 3/Twisted
CVE-2021-40824
MA
Matrix-android-sdk2
Matrix
5.9
1%
Sep 13A logic error in the room key sharing functionality of Element Android before 1.2.2 and matrix-android-sdk2 (aka Matrix SDK for Android) before 1.2.2 allows a malicious Matrix…
CVE-2021-40823
JS
Javascript Sdk
Matrix
5.9
1%
Sep 13A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12.4.1 allows a malicious Matrix homeserver present in an encrypted room to…