element-hq element-web vulnerabilities

CVEs per yearBy the year they were published

1. 20243
2. 20252
3. 20262

Newest CVEs

• CVE-2026-119407

  Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters

  element-hq · element-web

  High7.1
• CVE-2026-55850

  Element Web: A malicious homeserver can inject HTML in Element Web using its homepage

  element-hq · element-web

  Medium5.3
• CVE-2025-59161

  In Element Web and Element Desktop, a malicious room can hide an unrelated room and cause it to be left when the malicious room is left

  element-hq · element-web

  Low2.7
• CVE-2025-32026

  Element Web could load a malicious instance of Element Call leaking media encryption keys

  element-hq · element-web

  Low3.8
• CVE-2024-51750

  Element allows a malicious homeserver can modify events leading to unrenderable events or rooms

  element-hq · element-web

  Medium5.0
• CVE-2024-51749

  Element's thumbnails can be abused to misrepresent the content of an attachment

  element-hq · element-web

  Low3.5
• CVE-2024-47779

  Element Web vulnerable to potential exposure of access token via authenticated media

  element-hq · element-web

  High7.0