Login Request a demo
CH
Product
chatwoot
by chatwoot · last CVE Oct 23, 2026
24
CVEs
0
On KEV
9.8
Max CVSS
2
New 30D
Vulnerabilities24In the news0Timeline
Severity mix
Critical 1High 6Medium 17Low 0
Severity
All severities24Critical1High6Medium17Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add chatwoot to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-44707
6.8
0%
May 26
Chatwoot: Pre-Account Takeover via OAuth on Unconfirmed Accounts
Affected: >= 2.14.0, < 4.13.0
CVE-2021-3740
6.8
0%
Nov 15
Session Fixation in chatwoot/chatwoot
Affected: before 2.4.0
CVE-2026-72719
6.7
1%
Aug 10
Chatwoot: Cross-Account Resource Transfer via `account_id` Parameter
Affected: < 4.9.0
CVE-2021-3813
6.5
1%
Feb 9
Improper Privilege Management in GitHub repository chatwoot/chatwoot prior to v2.2
Affected: through 2.1.1
CVE-2026-92527
6.3
0%
Sep 16
chatwoot Shopify OAuth callbacks_controller.rb server-side request forgery
Affected: 4.17.0; 4.17.1
CVE-2025-12246
6.1
0%
Oct 27
chatwoot Admin IframeLoader.vue cross site scripting
Affected: through 4.7.0
CVE-2023-2109
6.1
0%
Apr 17
Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.14.0
Affected: before 2.14.0
CVE-2022-0542
6.1
1%
Aug 19
Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.7.0
Affected: before 2.7.0
CVE-2022-0527
6.1
1%
Feb 9
Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0
Affected: through 2.1.1
CVE-2022-0526
6.1
1%
Feb 9
Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0
Affected: through 2.1.1
CVE-2021-3741
5.4
0%
Nov 15
Stored Cross-site Scripting (XSS) in chatwoot/chatwoot
Affected: before 2.6.0
CVE-2022-1021
5.4
1%
Aug 19
Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0
Affected: before 2.6.0
CVE-2022-1022
5.4
4%
Apr 21
Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.5.0
Affected: before 2.5.0
CVE-2025-12245
5.3
0%
Oct 27
chatwoot Widget IFrameHelper.js initPostMessageCommunication origin validation
Affected: through 4.7.0
CVE-2026-113355
4.8
0%
Oct 20
Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links
Affected: before 4.14.0
CVE-2024-0640
4.8
0%
Mar 20
Stored XSS in chatwoot/chatwoot
Affected: before 3.5.2
CVE-2026-115725
New
4.2
0%
Oct 23
Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id
Affected: before 4.17.0
Showing 17