SY
Product
Synapse
40
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 13Medium 22Low 3
Watch
Add Synapse to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-16515 | 8.8 | Sep 18 | Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature… Affected: before 0.33.3.1 |
| CVE-2021-21332 | 8.2 | Mar 26 | Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse) Affected: before 1.27.0 |
| CVE-2025-30355 | 7.5 | Mar 27 | Synapse is an open source Matrix homeserver implementation Affected: before 1.127.1 |
| CVE-2024-52805 | 7.5 | Dec 3 | Synapse is an open-source Matrix homeserver Affected: before 1.120.1 |
| CVE-2024-37302 | 7.5 | Dec 3 | Synapse is an open-source Matrix homeserver Affected: before 1.106.0 |
| CVE-2022-31152 | 7.5 | Sep 2 | Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation Affected: before 1.62.0 |
| CVE-2021-41281 | 7.5 | Nov 23 | Synapse is a package for Matrix homeservers written in Python 3/Twisted Affected: before 1.47.1 |
| CVE-2020-26890 | 7.5 | Nov 24 | Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, allowing remote attackers to execute a… Affected: before 1.20.0 |
| CVE-2019-11842 | 7.5 | May 9 | An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1 Affected: before 0.99.3.1 |
| CVE-2019-5885 | 7.5 | Mar 19 | Matrix Synapse before 0.34.0.1, when the macaroon_secret_key authentication parameter is not set, uses a predictable value to derive a secret key and other secrets which could… Affected: before 0.34.0.1 |
| CVE-2018-12423 | 7.5 | Jun 14 | In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.power_levels event in force Affected: before 0.31.2 |
| CVE-2018-12291 | 7.5 | Jun 13 | The on_get_missing_events function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the get_missing_events federation API where event visibility… Affected: before 0.31.1 |
| CVE-2018-10657 | 7.5 | May 2 | Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to… Affected: before 0.28.1 |
Showing 13