Browse CVEs

HIGH 7.5 CVE-2025-66622 matrix-sdk-base is the base component to build a Matrix client library. Versions 0.14.1 and prior are unable to handle responses that include custom … Matrix Rust Sdk 0.16.0+ Fix from $1,9502025-12-09 HIGH 7.5 CVE-2025-30355 Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1… Synapse 1.127.1+ Fix from $1,9502025-03-27 CRITICAL 9.1 CVE-2024-53863 Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the dynamic_thumbnails option or processing a specially cra… Synapse 1.120.1+ Fix from $2,3002024-12-03 HIGH 7.5 CVE-2024-52805 Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increa… Synapse 1.120.1+ Fix from $1,9502024-12-03 MEDIUM 5.3 CVE-2024-52815 Synapse is an open-source Matrix homeserver. Synapse versions before 1.120.1 fail to properly validate invites received over federation. This vulnera… Synapse 1.120.1+ Fix from $1,6002024-12-03 HIGH 7.5 CVE-2024-37302 Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary c… Synapse 1.106.0+ Fix from $1,9502024-12-03 MEDIUM 5.3 CVE-2024-37303 Synapse is an open-source Matrix homeserver. Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a downloa… Synapse 1.106.0+ Fix from $1,6002024-12-03 MEDIUM 5.3 CVE-2024-45191 An issue was discovered in Matrix libolm through 3.2.16. The AES implementation is vulnerable to cache-timing attacks due to use of S-boxes. This is … Olm after 3.2.16 Fix from $1,6002024-08-22 MEDIUM 5.3 CVE-2024-45192 An issue was discovered in Matrix libolm through 3.2.16. Cache-timing attacks can occur due to use of base64 when decoding group session keys. This r… Olm after 3.2.16 Fix from $1,6002024-08-22 MEDIUM 5.3 CVE-2024-42369 matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that th… Javascript Sdk 34.3.1+ Fix from $1,6002024-08-20 MEDIUM 6.5 CVE-2024-42347 matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. A malicious homeserver could manipulate a user's acco… Matrix React Sdk 3.105.1+ Fix from $1,6002024-08-06 CRITICAL 9.0 CVE-2023-43656 matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances that have enabled transformation f… Hookshot 4.5.0+ Fix from $2,3002023-09-27 MEDIUM 6.5 CVE-2023-38691 matrix-appservice-bridge provides an API for setting up bridges. Starting in version 4.0.0 and prior to versions 8.1.2 and 9.0.1, a malicious Matrix … Matrix Appservice Bridge 8.1.2+ Fix from $1,6002023-08-04 CRITICAL 9.8 CVE-2023-38690 matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be … Matrix Irc Bridge 1.0.1+ Fix from $2,3002023-08-04 MEDIUM 5.3 CVE-2023-38686 Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to send emails using TLS, Sydent does not … Sydent 2.5.6+ Fix from $1,6002023-08-04 MEDIUM 5.4 CVE-2023-32682 Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user … Synapse 1.85.0+ Fix from $1,6002023-06-06 MEDIUM 5.4 CVE-2023-32683 Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. A discovered oEmbed or image URL can bypass the `url_preview_ur… Synapse 1.85.0+ Fix from $1,6002023-06-06 MEDIUM 6.5 CVE-2022-39374 Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joine… Synapse 1.68.0+ Fix from $1,6002023-05-26 MEDIUM 5.0 CVE-2022-39335 Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix Federation API allows remote homeservers … Synapse 1.69.0+ Fix from $1,6002023-05-26 MEDIUM 5.3 CVE-2023-29529 matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in a room where an MSC3401 group call is taking plac… Javascript Sdk 24.1.0+ Fix from $1,6002023-04-14 HIGH 8.2 CVE-2023-28427 matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key pl… Javascript Sdk 24.0.0+ Fix from $1,9502023-03-28 MEDIUM 5.3 CVE-2022-36059 matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 19.4.0 events sent with special strings in key pl… Javascript Sdk 19.4.0+ Fix from $1,6002023-03-28 MEDIUM 5.3 CVE-2022-36060 matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. Events sent with special strings in key places can temporarily disrupt or impede… React Sdk 3.53.0+ Fix from $1,6002023-03-28 MEDIUM 5.3 CVE-2022-41952 Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting co… Synapse 1.53.0+ Fix from $1,6002022-11-22 MEDIUM 5.6 CVE-2022-3971 A vulnerability was found in matrix-appservice-irc up to 0.35.1. It has been declared as critical. This vulnerability affects unknown code of the fil… Matrix Irc Bridge after 0.36.0 Fix from $1,6002022-11-13 HIGH 7.5 CVE-2022-39252 matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library. Prior to vers… Matrix Rust Sdk 0.6+ Fix from $1,9502022-09-29 HIGH 7.5 CVE-2022-39250 Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating wit… Javascript Sdk 19.7.0+ Fix from $1,9502022-09-29 HIGH 7.5 CVE-2022-39257 Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeser… Software Development Kit 0.23.19+ Fix from $1,9502022-09-28 HIGH 7.5 CVE-2022-39255 Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeser… Software Development Kit 0.23.19+ Fix from $1,9502022-09-28 HIGH 7.5 CVE-2022-39249 Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver ca… Javascript Sdk 19.7.0+ Fix from $1,9502022-09-28