matrix-org vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 202118
3. 202221
4. 202317
5. 20259
6. 202514
7. 20265

Newest CVEs

• CVE-2026-45056

  Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution

  matrix-org · matrix-rust-sdk

  Medium6.9
• CVE-2026-45057

  matrix-sdk-ui: Incomplete edit validation

  matrix-org · matrix-sdk-ui

  Medium4.9
• CVE-2026-63097

  Dendrite 0.13.8 syncapi /context Endpoint Post-Leave State Exposure

  matrix-org · dendrite

  Medium5.3
• CVE-2026-63096

  Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint

  matrix-org · dendrite

  Medium6.9
• CVE-2026-63095

  Dendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint

  matrix-org · dendrite

  High7.1
• CVE-2025-66622

  matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event values

  matrix-org · matrix-rust-sdk

  Low1.3
• CVE-2025-59160

  matrix-js-sdk has insufficient validation when considering a room to be upgraded by another

  matrix-org · matrix-js-sdk

  Low2.7
• CVE-2025-59047

  matrix-sdk-base has panic in the `RoomMember::normalized_power_level()` method

  matrix-org · matrix-rust-sdk

  Low2.7
• CVE-2025-53549

  Matrix Rust SDK allows SQL injection in the EventCache implementation

  matrix-org · matrix-rust-sdk

  Medium5.2
• CVE-2025-48937

  matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator

  matrix-org · matrix-rust-sdk

  Medium4.9