CH
Product
chatwoot
24
CVEs
0
On KEV
9.8
Max CVSS
2
New 30D
Severity mix
Critical 1High 6Medium 17Low 0
Watch
Add chatwoot to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-3741 | 9.8 | Oct 28 | Improper Restriction of Excessive Authentication Attempts in chatwoot/chatwoot Affected: before 2.10.0 |
| CVE-2025-21628 | 8.8 | Jan 9 | Chatwoot has a Blind SQL-injection in Conversation and Contacts filters Affected: >= 2.16.1, < 3.16.0 |
| CVE-2021-3742 | 8.8 | Nov 15 | Server-Side Request Forgery (SSRF) in chatwoot/chatwoot Affected: before 2.5.0 |
| CVE-2026-44706 | 8.5 | May 26 | Chatwoot: SQL Injection in Conversation/Contact Filter API via Custom Attribute Values Affected: >= 2.2.0, < 4.11.2 |
| CVE-2026-63765 | 8.2 | Jul 23 | Chatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Upload Arbitrary Blob Creation Affected: before 4.16.0 |
| CVE-2021-3649 | 7.5 | Jul 16 | chatwoot is vulnerable to Inefficient Regular Expression Complexity Affected: before 1.18.0 |
| CVE-2022-2901 | 7.1 | Sep 6 | Improper Authorization in GitHub repository chatwoot/chatwoot prior to 2.8 Affected: before 2.8.0 |
| CVE-2026-44707 | 6.8 | May 26 | Chatwoot: Pre-Account Takeover via OAuth on Unconfirmed Accounts Affected: >= 2.14.0, < 4.13.0 |
| CVE-2021-3740 | 6.8 | Nov 15 | Session Fixation in chatwoot/chatwoot Affected: before 2.4.0 |
| CVE-2026-72719 | 6.7 | Aug 10 | Chatwoot: Cross-Account Resource Transfer via `account_id` Parameter Affected: < 4.9.0 |
| CVE-2021-3813 | 6.5 | Feb 9 | Improper Privilege Management in GitHub repository chatwoot/chatwoot prior to v2.2 Affected: through 2.1.1 |
| CVE-2026-92527 | 6.3 | Sep 16 | chatwoot Shopify OAuth callbacks_controller.rb server-side request forgery Affected: 4.17.0; 4.17.1 |
| CVE-2025-12246 | 6.1 | Oct 27 | chatwoot Admin IframeLoader.vue cross site scripting Affected: through 4.7.0 |
| CVE-2023-2109 | 6.1 | Apr 17 | Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.14.0 Affected: before 2.14.0 |
| CVE-2022-0542 | 6.1 | Aug 19 | Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.7.0 Affected: before 2.7.0 |
| CVE-2022-0527 | 6.1 | Feb 9 | Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0 Affected: through 2.1.1 |
| CVE-2022-0526 | 6.1 | Feb 9 | Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0 Affected: through 2.1.1 |
| CVE-2021-3741 | 5.4 | Nov 15 | Stored Cross-site Scripting (XSS) in chatwoot/chatwoot Affected: before 2.6.0 |
| CVE-2022-1021 | 5.4 | Aug 19 | Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0 Affected: before 2.6.0 |
| CVE-2022-1022 | 5.4 | Apr 21 | Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.5.0 Affected: before 2.5.0 |
| CVE-2025-12245 | 5.3 | Oct 27 | chatwoot Widget IFrameHelper.js initPostMessageCommunication origin validation Affected: through 4.7.0 |
| CVE-2026-113355 | 4.8 | Oct 20 | Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links Affected: before 4.14.0 |
| CVE-2024-0640 | 4.8 | Mar 20 | Stored XSS in chatwoot/chatwoot Affected: before 3.5.2 |
| CVE-2026-115725 New | 4.2 | Oct 23 | Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id Affected: before 4.17.0 |
Showing 24