element-hq vulnerabilities

CVEs per yearBy the year they were published

1. 202413
2. 20259
3. 20268

Newest CVEs

• CVE-2026-62347

  Element Call exposes shared passwords in logs

  element-hq · element-call

  Medium5.9
• CVE-2026-119407

  Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters

  element-hq · element-web

  High7.1
• CVE-2026-55644

  Element X iOS: io.element.call deeplink allows attacker-controlled HTTPS origin and may grant mic/camera to that origin

  element-hq · element-x-ios

  Medium5.1
• CVE-2026-55850

  Element Web: A malicious homeserver can inject HTML in Element Web using its homepage

  element-hq · element-web

  Medium5.3
• CVE-2026-48007

  Element Call reports full URLs of visited pages to analytics server

  element-hq · element-call

  High8.6
• CVE-2026-45078

  Synapse CPU starvation (Denial of Service)

  element-hq · synapse

  Medium6.8
• CVE-2026-45076

  Synapse pagination denial of service

  element-hq · synapse

  Medium5.1
• CVE-2026-24044

  ESS Community Helm Chart has a weak server key generation method

  element-hq · ess-helm

  Critical9.2
• CVE-2025-62425

  Matrix Authentication Service account password can be changed using an authenticated session without supplying the current password

  element-hq · matrix-authentication-service

  High8.3
• CVE-2025-61672

  Synapse: Invalid device keys degrade federation functionality

  element-hq · synapse

  Medium5.3