# cve.now: Matrix-org

The newest entries naming Matrix-org as an affected vendor (up to 200), of 85 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-45056](https://cve.now/CVE-2026-45056.md): Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution (CVSS 6.9)
- [CVE-2026-45057](https://cve.now/CVE-2026-45057.md): matrix-sdk-ui: Incomplete edit validation (CVSS 4.9)
- [CVE-2026-63097](https://cve.now/CVE-2026-63097.md): Dendrite 0.13.8 syncapi /context Endpoint Post-Leave State Exposure (CVSS 5.3)
- [CVE-2026-63096](https://cve.now/CVE-2026-63096.md): Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint (CVSS 6.9)
- [CVE-2026-63095](https://cve.now/CVE-2026-63095.md): Dendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint (CVSS 7.1)
- [CVE-2025-66622](https://cve.now/CVE-2025-66622.md): matrix-sdk-base is vulnerable to DoS via custom m.room.join\_rules event values (CVSS 1.3)
- [CVE-2025-59160](https://cve.now/CVE-2025-59160.md): matrix-js-sdk has insufficient validation when considering a room to be upgraded by another (CVSS 2.7)
- [CVE-2025-59047](https://cve.now/CVE-2025-59047.md): matrix-sdk-base has panic in the \`RoomMember::normalized\_power\_level()\` method (CVSS 2.7)
- [CVE-2025-53549](https://cve.now/CVE-2025-53549.md): Matrix Rust SDK allows SQL injection in the EventCache implementation (CVSS 5.2)
- [CVE-2025-48937](https://cve.now/CVE-2025-48937.md): matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator (CVSS 4.9)
- [CVE-2025-27155](https://cve.now/CVE-2025-27155.md): In-memory stored Cross-site scripting (XSS) vulnerability in pineconesim (CVSS 6.1)
- [CVE-2025-27146](https://cve.now/CVE-2025-27146.md): Matrix IRC Bridge allows IRC command injection to own puppeted user (CVSS 2.7)
- [CVE-2025-23197](https://cve.now/CVE-2025-23197.md): matrix-hookshot has a Potential Denial of Service when Hookshot is configured with GitHub support (CVSS 6.5)
- [CVE-2025-24024](https://cve.now/CVE-2025-24024.md): Mjolnir v1.9.0 accepts commands from any room (CVSS 9.1)
- [CVE-2024-52594](https://cve.now/CVE-2024-52594.md): Server-Side Request Forgery (SSRF) on redirects and federation in gomatrixserverlib (CVSS 4.3)
- [CVE-2024-52813](https://cve.now/CVE-2024-52813.md): matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity (CVSS 4.3)
- [CVE-2024-52505](https://cve.now/CVE-2024-52505.md): matrix-appservice-irc allows IRC Command injection in provisioning API (CVSS 5.4)
- [CVE-2024-50336](https://cve.now/CVE-2024-50336.md): matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal (CVSS 5.3)
- [CVE-2024-47824](https://cve.now/CVE-2024-47824.md): Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room (CVSS 8.7)
- [CVE-2024-47080](https://cve.now/CVE-2024-47080.md): matrix-js-sdk keys sent via \`sendSharedHistoryKeys\` vulnerable to interception by malicious homeserver (CVSS 8.7)
- [CVE-2024-42369](https://cve.now/CVE-2024-42369.md): A room with itself as a its predecessor will freeze matrix-js-sdk (CVSS 4.1)
- [CVE-2024-42347](https://cve.now/CVE-2024-42347.md): URL preview setting for a room is controllable by the homeserver in matrix-react-sdk (CVSS 7.7)
- [CVE-2024-40648](https://cve.now/CVE-2024-40648.md): \`UserIdentity::is\_verified\` not checking verification status of own user identity while performing the check in matrix-rust-sdk (CVSS 5.4)
- [CVE-2024-40640](https://cve.now/CVE-2024-40640.md): Usage of non-constant time base64 decoder could lead to leakage of secret key material in vodozemac (CVSS 2.9)
- [CVE-2024-39691](https://cve.now/CVE-2024-39691.md): Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access to (CVSS 4.3)
- [CVE-2024-34353](https://cve.now/CVE-2024-34353.md): matrix-sdk-crypto contains a log exposure of private key of the server-side key backup (CVSS 5.5)
- [CVE-2024-34063](https://cve.now/CVE-2024-34063.md): Degraded secret zeroization capabilities in vodozemac (CVSS 2.5)
- [CVE-2024-32000](https://cve.now/CVE-2024-32000.md): Truncated content of messages can be leaked from matrix-appservice-irc (CVSS 4.3)
- [CVE-2023-43796](https://cve.now/CVE-2023-43796.md): Synapse vulnerable to leak of remote user device information (CVSS 5.3)
- [CVE-2023-45129](https://cve.now/CVE-2023-45129.md): matrix-synapse vulnerable to denial of service due to malicious server ACL events (CVSS 4.9)
- [CVE-2023-43656](https://cve.now/CVE-2023-43656.md): Sandbox escape for instances that have enabled transformation functions in matrix-hookshot (CVSS 5.6)
- [CVE-2023-41335](https://cve.now/CVE-2023-41335.md): Temporary storage of plaintext passwords during password changes in matrix synapse (CVSS 3.7)
- [CVE-2023-42453](https://cve.now/CVE-2023-42453.md): Improper validation of receipts allows forged read receipts in matrix synapse (CVSS 3.1)
- [CVE-2023-38700](https://cve.now/CVE-2023-38700.md): matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms (CVSS 3.5)
- [CVE-2023-38691](https://cve.now/CVE-2023-38691.md): matrix-appservice-bridge doesn't verify the sub parameter of an openId token exhange, allowing unauthorized access to provisioning APIs (CVSS 5.0)
- [CVE-2023-38690](https://cve.now/CVE-2023-38690.md): matrix-appservice-irc IRC command injection via admin commands containing newlines (CVSS 5.8)
- [CVE-2023-38686](https://cve.now/CVE-2023-38686.md): Sydent does not verify email server certificates (CVSS 9.3)
- [CVE-2023-37259](https://cve.now/CVE-2023-37259.md): Cross site scripting in Export Chat feature (CVSS 6.1)
- [CVE-2023-32683](https://cve.now/CVE-2023-32683.md): URL deny list bypass via oEmbed and image URLs when generating previews in Synapse (CVSS 3.5)
- [CVE-2023-32682](https://cve.now/CVE-2023-32682.md): Improper checks for deactivated users during login in synapse (CVSS 5.4)
- [CVE-2022-39374](https://cve.now/CVE-2022-39374.md): Synapse Denial of service due to incorrect application of event authorization rules during state resolution (CVSS 6.5)
- [CVE-2022-39335](https://cve.now/CVE-2022-39335.md): Synapse does not apply enough checks to servers requesting auth events of events in a room (CVSS 5.0)
- [CVE-2023-32323](https://cve.now/CVE-2023-32323.md): Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites (CVSS 5.0)
- [CVE-2023-30609](https://cve.now/CVE-2023-30609.md): matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting (CVSS 5.4)
- [CVE-2023-29529](https://cve.now/CVE-2023-29529.md): matrix-js-sdk vulnerable to invisible eavesdropping in group calls (CVSS 5.0)
- [CVE-2022-36060](https://cve.now/CVE-2022-36060.md): Prototype pollution in matrix-react-sdk (CVSS 8.2)
- [CVE-2023-28103](https://cve.now/CVE-2023-28103.md): Prototype pollution in matrix-react-sdk (CVSS 8.2)
- [CVE-2023-28427](https://cve.now/CVE-2023-28427.md): Prototype pollution in matrix-js-sdk (CVSS 8.2)
- [CVE-2022-36059](https://cve.now/CVE-2022-36059.md): Prototype pollution in matrix-js-sdk (CVSS 8.2)
- [CVE-2022-41952](https://cve.now/CVE-2022-41952.md): Uncontrolled Resource Consumption in Matrix Synapse (CVSS 6.5)
- [CVE-2022-39252](https://cve.now/CVE-2022-39252.md): When matrix-rust-sdk recieves forwarded room keys, the reciever doesn't check if it requested the key from the forwarder (CVSS 8.6)
- [CVE-2022-39250](https://cve.now/CVE-2022-39250.md): Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification (CVSS 8.6)
- [CVE-2022-39257](https://cve.now/CVE-2022-39257.md): Matrix iOS SDK vulnerable to impersonation via forwarded Megolm sessions (CVSS 7.5)
- [CVE-2022-39255](https://cve.now/CVE-2022-39255.md): Matrix iOS SDK vulnerable ton Olm/Megolm protocol confusion (CVSS 8.6)
- [CVE-2022-39248](https://cve.now/CVE-2022-39248.md): matrix-android-sdk2 vulnerable to Olm/Megolm protocol confusion (CVSS 8.6)
- [CVE-2022-39246](https://cve.now/CVE-2022-39246.md): matrix-android-sdk2 vulnerable to impersonation via forwarded Megolm sessions (CVSS 7.5)
- [CVE-2022-39251](https://cve.now/CVE-2022-39251.md): Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion (CVSS 8.6)
- [CVE-2022-39249](https://cve.now/CVE-2022-39249.md): Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions (CVSS 7.5)
- [CVE-2022-39236](https://cve.now/CVE-2022-39236.md): Matrix Javascript SDK improper beacon events can cause availability issues (CVSS 4.3)
- [CVE-2022-39203](https://cve.now/CVE-2022-39203.md): Parsing issue in matrix-org/node-irc leading to room takeovers (CVSS 8.8)
- [CVE-2022-39202](https://cve.now/CVE-2022-39202.md): IRC mode parameter confusion in matrix-appservice-irc (CVSS 4.3)
- [CVE-2022-39200](https://cve.now/CVE-2022-39200.md): Signature checks not applied to some retrieved missing events (CVSS 7.3)
- [CVE-2022-31152](https://cve.now/CVE-2022-31152.md): Synapse vulnerable to denial of service (DoS) due to incorrect application of event authorization rules (CVSS 6.4)
- [CVE-2022-36009](https://cve.now/CVE-2022-36009.md): Incorrect parsing of access level in gomatrixserverlib and dendrite (CVSS 5.0)
- [CVE-2022-31052](https://cve.now/CVE-2022-31052.md): URL previews can crash Synapse media repositories or Synapse monoliths (CVSS 6.5)
- [CVE-2022-29166](https://cve.now/CVE-2022-29166.md): Improper handling of multiline messages in matrix-appservice-irc (CVSS 8.0)
- [CVE-2021-41281](https://cve.now/CVE-2021-41281.md): Path traversal in Matrix Synapse (CVSS 7.5)
- [CVE-2021-39164](https://cve.now/CVE-2021-39164.md): Improper authorisation of /members discloses room membership to non-members (CVSS 3.1)
- [CVE-2021-39163](https://cve.now/CVE-2021-39163.md): Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner. (CVSS 3.1)
- [CVE-2021-32659](https://cve.now/CVE-2021-32659.md): Automatic room upgrade handling can be used maliciously to bridge a room non-consentually (CVSS 6.5)
- [CVE-2021-32622](https://cve.now/CVE-2021-32622.md): File upload local preview can run embedded scripts after user interaction (CVSS 4.2)
- [CVE-2021-29471](https://cve.now/CVE-2021-29471.md): Denial of service in Matrix Synapse (CVSS 3.7)
- [CVE-2021-29431](https://cve.now/CVE-2021-29431.md): SSRF in Sydent due to missing validation of hostnames (CVSS 7.7)
- [CVE-2021-29432](https://cve.now/CVE-2021-29432.md): Malicious users could control the content of invitation emails (CVSS 5.3)
- [CVE-2021-29430](https://cve.now/CVE-2021-29430.md): Denial of service attack via memory exhaustion (CVSS 7.5)
- [CVE-2021-29433](https://cve.now/CVE-2021-29433.md): Denial of service (via resource exhaustion) due to improper input validation (CVSS 4.3)
- [CVE-2021-21392](https://cve.now/CVE-2021-21392.md): Open redirect via transitional IPv6 addresses on dual-stack networks (CVSS 6.3)
- [CVE-2021-21393](https://cve.now/CVE-2021-21393.md): Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints (CVSS 5.3)
- [CVE-2021-21394](https://cve.now/CVE-2021-21394.md): Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints (CVSS 5.3)
- [CVE-2021-21333](https://cve.now/CVE-2021-21333.md): HTML injection in email and account expiry notifications (CVSS 6.1)
- [CVE-2021-21332](https://cve.now/CVE-2021-21332.md): Cross-site scripting (XSS) vulnerability in the password reset endpoint (CVSS 6.9)
- [CVE-2021-21320](https://cve.now/CVE-2021-21320.md): User content sandbox can be confused into opening arbitrary documents (CVSS 2.6)
- [CVE-2021-21273](https://cve.now/CVE-2021-21273.md): Open redirects on some federation and push requests (CVSS 3.1)
- [CVE-2021-21274](https://cve.now/CVE-2021-21274.md): Denial of service attack via .well-known lookups (CVSS 4.3)
- [CVE-2020-26257](https://cve.now/CVE-2020-26257.md): Denial of service attack via incorrect parameters to federation APIs (CVSS 6.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/matrix-org
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.