Login Request a demo
CH
Product
chatwoot
by chatwoot · last CVE Oct 23, 2026
24
CVEs
0
On KEV
9.8
Max CVSS
2
New 30D
Vulnerabilities24In the news0Timeline
Severity mix
Critical 1High 6Medium 17Low 0
Severity
All severities24Critical1High6Medium17Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add chatwoot to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-21628
8.8
1%
Jan 9
Chatwoot has a Blind SQL-injection in Conversation and Contacts filters
Affected: >= 2.16.1, < 3.16.0
CVE-2021-3742
8.8
0%
Nov 15
Server-Side Request Forgery (SSRF) in chatwoot/chatwoot
Affected: before 2.5.0
CVE-2026-44706
8.5
0%
May 26
Chatwoot: SQL Injection in Conversation/Contact Filter API via Custom Attribute Values
Affected: >= 2.2.0, < 4.11.2
CVE-2026-63765
8.2
1%
Jul 23
Chatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Upload Arbitrary Blob Creation
Affected: before 4.16.0
CVE-2021-3649
7.5
1%
Jul 16
chatwoot is vulnerable to Inefficient Regular Expression Complexity
Affected: before 1.18.0
CVE-2022-2901
7.1
1%
Sep 6
Improper Authorization in GitHub repository chatwoot/chatwoot prior to 2.8
Affected: before 2.8.0
Showing 6