Login Request a demo
MA
Vendor
matrix-org
15 products with CVEs on record
52
CVEs
0
On KEV
0
New 30D
Products
SY
synapse
matrix-org
6.5
10 CVEs0 on KEV0 new
MA
matrix-js-sdk
matrix-org
8.7
8 CVEs0 on KEV0 new
MA
matrix-rust-sdk
matrix-org
7.5
8 CVEs0 on KEV0 new
MA
matrix-appservice-irc
matrix-org
9.8
6 CVEs0 on KEV0 new
MA
matrix-react-sdk
matrix-org
8.7
6 CVEs0 on KEV0 new
DE
dendrite
matrix-org
6.5
3 CVEs0 on KEV0 new
MA
matrix-hookshot
matrix-org
9.0
2 CVEs0 on KEV0 new
VO
vodozemac
matrix-org
2.9
2 CVEs0 on KEV0 new
GO
gomatrixserverlib
matrix-org
4.3
1 CVEs0 on KEV0 new
MA
matrix-appservice-bridge
matrix-org
6.5
1 CVEs0 on KEV0 new
MA
matrix-sdk-crypto
matrix-org
5.5
1 CVEs0 on KEV0 new
MA
matrix-sdk-ui
matrix-org
4.9
1 CVEs0 on KEV0 new
MJ
mjolnir
matrix-org
9.1
1 CVEs0 on KEV0 new
PI
pinecone
matrix-org
6.1
1 CVEs0 on KEV0 new
SY
sydent
matrix-org
5.3
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-45056
MA
matrix-rust-sdk
matrix-org
6.9
0%
Sep 11Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution
CVE-2026-45057
MA
matrix-sdk-ui
matrix-org
4.9
0%
Sep 11matrix-sdk-ui: Incomplete edit validation
CVE-2026-63097
DE
dendrite
matrix-org
4.3
0%
Jul 17Dendrite 0.13.8 syncapi /context Endpoint Post-Leave State Exposure
CVE-2026-63096
DE
dendrite
matrix-org
5.8
0%
Jul 17Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint
CVE-2026-63095
DE
dendrite
matrix-org
6.5
0%
Jul 17Dendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint
CVE-2025-66622
MA
matrix-rust-sdk
matrix-org
7.5
0%
Dec 9matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event values
CVE-2025-59160
MA
matrix-js-sdk
matrix-org
2.7
0%
Sep 16matrix-js-sdk has insufficient validation when considering a room to be upgraded by another
CVE-2025-59047
MA
matrix-rust-sdk
matrix-org
2.7
0%
Sep 11matrix-sdk-base has panic in the `RoomMember::normalized_power_level()` method
CVE-2025-53549
MA
matrix-rust-sdk
matrix-org
5.2
0%
Jul 10Matrix Rust SDK allows SQL injection in the EventCache implementation
CVE-2025-48937
MA
matrix-rust-sdk
matrix-org
4.9
0%
Jun 10matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator
CVE-2025-27155
PI
pinecone
matrix-org
6.1
0%
Mar 4In-memory stored Cross-site scripting (XSS) vulnerability in pineconesim
CVE-2025-27146
MA
matrix-appservice-irc
matrix-org
4.3
0%
Feb 25Matrix IRC Bridge allows IRC command injection to own puppeted user
CVE-2025-23197
MA
matrix-hookshot
matrix-org
6.5
0%
Jan 27matrix-hookshot has a Potential Denial of Service when Hookshot is configured with GitHub support
CVE-2025-24024
MJ
mjolnir
matrix-org
9.1
1%
Jan 21Mjolnir v1.9.0 accepts commands from any room
CVE-2024-52594
GO
gomatrixserverlib
matrix-org
4.3
0%
Jan 16Server-Side Request Forgery (SSRF) on redirects and federation in gomatrixserverlib
CVE-2024-52813
MA
matrix-rust-sdk
matrix-org
4.3
0%
Jan 7matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity
CVE-2024-52505
MA
matrix-appservice-irc
matrix-org
5.4
0%
Nov 14matrix-appservice-irc allows IRC Command injection in provisioning API
CVE-2024-50336
MA
matrix-js-sdk
matrix-org
5.3
1%
Nov 12matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal
CVE-2024-47824
MA
matrix-react-sdk
matrix-org
8.7
1%
Oct 15Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room
CVE-2024-47080
MA
matrix-js-sdk
matrix-org
8.7
1%
Oct 15matrix-js-sdk keys sent via `sendSharedHistoryKeys` vulnerable to interception by malicious homeserver
CVE-2024-42369
MA
matrix-js-sdk
matrix-org
5.3
0%
Aug 20A room with itself as a its predecessor will freeze matrix-js-sdk
CVE-2024-42347
MA
matrix-react-sdk
matrix-org
6.5
0%
Aug 6URL preview setting for a room is controllable by the homeserver in matrix-react-sdk
CVE-2024-40648
MA
matrix-rust-sdk
matrix-org
5.4
0%
Jul 18`UserIdentity::is_verified` not checking verification status of own user identity while performing the check in matrix-rust-sdk
CVE-2024-40640
VO
vodozemac
matrix-org
2.9
0%
Jul 17Usage of non-constant time base64 decoder could lead to leakage of secret key material in vodozemac
CVE-2024-39691
MA
matrix-appservice-irc
matrix-org
4.3
0%
Jul 5Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access to
CVE-2024-34353
MA
matrix-sdk-crypto
matrix-org
5.5
0%
May 13matrix-sdk-crypto contains a log exposure of private key of the server-side key backup
CVE-2024-34063
VO
vodozemac
matrix-org
2.5
0%
May 3Degraded secret zeroization capabilities in vodozemac
CVE-2024-32000
MA
matrix-appservice-irc
matrix-org
4.3
0%
Apr 12Truncated content of messages can be leaked from matrix-appservice-irc
CVE-2023-43796
SY
synapse
matrix-org
5.3
1%
Oct 31Synapse vulnerable to leak of remote user device information
CVE-2023-45129
SY
synapse
matrix-org
4.9
1%
Oct 10matrix-synapse vulnerable to denial of service due to malicious server ACL events
CVE-2023-43656
MA
matrix-hookshot
matrix-org
9.0
0%
Sep 27Sandbox escape for instances that have enabled transformation functions in matrix-hookshot
CVE-2023-41335
SY
synapse
matrix-org
3.7
0%
Sep 26Temporary storage of plaintext passwords during password changes in matrix synapse
CVE-2023-42453
SY
synapse
matrix-org
4.3
1%
Sep 26Improper validation of receipts allows forged read receipts in matrix synapse
CVE-2023-38700
MA
matrix-appservice-irc
matrix-org
3.7
1%
Aug 4matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms
CVE-2023-38691
MA
matrix-appservice-bridge
matrix-org
6.5
0%
Aug 4matrix-appservice-bridge doesn't verify the sub parameter of an openId token exhange, allowing unauthorized access to provisioning APIs
CVE-2023-38690
MA
matrix-appservice-irc
matrix-org
9.8
1%
Aug 4matrix-appservice-irc IRC command injection via admin commands containing newlines
CVE-2023-38686
SY
sydent
matrix-org
5.3
0%
Aug 4Sydent does not verify email server certificates
CVE-2023-37259
MA
matrix-react-sdk
matrix-org
5.4
0%
Jul 18Cross site scripting in Export Chat feature
CVE-2023-32683
SY
synapse
matrix-org
5.4
1%
Jun 6URL deny list bypass via oEmbed and image URLs when generating previews in Synapse
CVE-2023-32682
SY
synapse
matrix-org
5.4
1%
Jun 6Improper checks for deactivated users during login in synapse
CVE-2022-39374
SY
synapse
matrix-org
6.5
1%
May 26Synapse Denial of service due to incorrect application of event authorization rules during state resolution
CVE-2022-39335
SY
synapse
matrix-org
5.0
1%
May 26Synapse does not apply enough checks to servers requesting auth events of events in a room
CVE-2023-32323
SY
synapse
matrix-org
4.3
1%
May 26Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites
CVE-2023-30609
MA
matrix-react-sdk
matrix-org
4.7
1%
Apr 25matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting
CVE-2023-29529
MA
matrix-js-sdk
matrix-org
5.3
1%
Apr 14matrix-js-sdk vulnerable to invisible eavesdropping in group calls
CVE-2022-36060
MA
matrix-react-sdk
matrix-org
5.3
1%
Mar 28Prototype pollution in matrix-react-sdk
CVE-2023-28103
MA
matrix-react-sdk
matrix-org
8.2
1%
Mar 28Prototype pollution in matrix-react-sdk
CVE-2023-28427
MA
matrix-js-sdk
matrix-org
8.2
1%
Mar 28Prototype pollution in matrix-js-sdk
CVE-2022-36059
MA
matrix-js-sdk
matrix-org
5.3
1%
Mar 28Prototype pollution in matrix-js-sdk
CVE-2022-41952
SY
synapse
matrix-org
5.3
1%
Nov 22Uncontrolled Resource Consumption in Matrix Synapse
CVE-2022-39252
MA
matrix-rust-sdk
matrix-org
7.5
1%
Sep 29When matrix-rust-sdk recieves forwarded room keys, the reciever doesn't check if it requested the key from the forwarder
CVE-2022-39250
MA
matrix-js-sdk
matrix-org
7.5
1%
Sep 29Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification