# cve.now: Element-hq

The newest entries naming Element-hq as an affected vendor (up to 200), of 30 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-62347](https://cve.now/CVE-2026-62347.md): Element Call exposes shared passwords in logs (CVSS 5.9)
- [CVE-2026-119407](https://cve.now/CVE-2026-119407.md): Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters (CVSS 7.1)
- [CVE-2026-55644](https://cve.now/CVE-2026-55644.md): Element X iOS: io.element.call deeplink allows attacker-controlled HTTPS origin and may grant mic/camera to that origin (CVSS 5.1)
- [CVE-2026-55850](https://cve.now/CVE-2026-55850.md): Element Web: A malicious homeserver can inject HTML in Element Web using its homepage (CVSS 5.3)
- [CVE-2026-48007](https://cve.now/CVE-2026-48007.md): Element Call reports full URLs of visited pages to analytics server (CVSS 8.6)
- [CVE-2026-45078](https://cve.now/CVE-2026-45078.md): Synapse CPU starvation (Denial of Service) (CVSS 6.8)
- [CVE-2026-45076](https://cve.now/CVE-2026-45076.md): Synapse pagination denial of service (CVSS 5.1)
- [CVE-2026-24044](https://cve.now/CVE-2026-24044.md): ESS Community Helm Chart has a weak server key generation method (CVSS 9.2)
- [CVE-2025-62425](https://cve.now/CVE-2025-62425.md): Matrix Authentication Service account password can be changed using an authenticated session without supplying the current password (CVSS 8.3)
- [CVE-2025-61672](https://cve.now/CVE-2025-61672.md): Synapse: Invalid device keys degrade federation functionality (CVSS 5.3)
- [CVE-2025-59161](https://cve.now/CVE-2025-59161.md): In Element Web and Element Desktop, a malicious room can hide an unrelated room and cause it to be left when the malicious room is left (CVSS 2.7)
- [CVE-2025-27599](https://cve.now/CVE-2025-27599.md): Element X Android vulnerable to loading malicious web pages via received intent (CVSS 6.5)
- [CVE-2025-32026](https://cve.now/CVE-2025-32026.md): Element Web could load a malicious instance of Element Call leaking media encryption keys (CVSS 3.8)
- [CVE-2025-31126](https://cve.now/CVE-2025-31126.md): Element X iOS allows the entity in control of the well-known file to break the confidentiality of embedded Element Call (CVSS 5.3)
- [CVE-2025-31127](https://cve.now/CVE-2025-31127.md): Element X Android allows the entity in control of the well-known file to break the confidentiality embedded Element Call (CVSS 5.3)
- [CVE-2025-30355](https://cve.now/CVE-2025-30355.md): Synapse vulnerable to federation denial of service via malformed events (CVSS 7.1)
- [CVE-2025-27606](https://cve.now/CVE-2025-27606.md): Element Android PIN autologout bypass (CVSS 5.1)
- [CVE-2024-37303](https://cve.now/CVE-2024-37303.md): Synapse unauthenticated writes to the media repository allow planting of problematic content (CVSS 5.3)
- [CVE-2024-37302](https://cve.now/CVE-2024-37302.md): Synapse denial of service through media disk space consumption (CVSS 7.5)
- [CVE-2024-52805](https://cve.now/CVE-2024-52805.md): Synapse allows unsupported content types to lead to memory exhaustion (CVSS 8.2)
- [CVE-2024-52815](https://cve.now/CVE-2024-52815.md): Synapse allows a a malformed invite to break the invitee's \`/sync\` (CVSS 8.7)
- [CVE-2024-53867](https://cve.now/CVE-2024-53867.md): Synapse Matrix has a partial room state leak via Sliding Sync (CVSS 4.3)
- [CVE-2024-53863](https://cve.now/CVE-2024-53863.md): Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders (CVSS 8.2)
- [CVE-2024-51750](https://cve.now/CVE-2024-51750.md): Element allows a malicious homeserver can modify events leading to unrenderable events or rooms (CVSS 5.0)
- [CVE-2024-51749](https://cve.now/CVE-2024-51749.md): Element's thumbnails can be abused to misrepresent the content of an attachment (CVSS 3.5)
- [CVE-2024-47779](https://cve.now/CVE-2024-47779.md): Element Web vulnerable to potential exposure of access token via authenticated media (CVSS 7.0)
- [CVE-2024-47771](https://cve.now/CVE-2024-47771.md): Element Desktop vulnerable to potential exposure of access token via authenticated media (CVSS 7.0)
- [CVE-2024-31208](https://cve.now/CVE-2024-31208.md): Synapse's V2 state resolution weakness allows DoS from remote room members (CVSS 6.5)
- [CVE-2024-26132](https://cve.now/CVE-2024-26132.md): Element Android can be asked to share internal files. (CVSS 4.0)
- [CVE-2024-26131](https://cve.now/CVE-2024-26131.md): Element Android Intent Redirection (CVSS 8.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/element-hq
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.