EL
Vendor
element-hq
26
CVEs
0
On KEV
1
New 30D
Products
EL5.3
element-x-ios
element-hq
2 CVEs0 on KEV1 new
SY9.1
synapse
element-hq
10 CVEs0 on KEV0 new
EL7.0
element-web
element-hq
6 CVEs0 on KEV0 new
EL6.5
element-x-android
element-hq
2 CVEs0 on KEV0 new
EL4.6
element-android
element-hq
1 CVEs0 on KEV0 new
EL8.6
element-call
element-hq
1 CVEs0 on KEV0 new
EL7.0
element-desktop
element-hq
1 CVEs0 on KEV0 new
ES9.2
ess-helm
element-hq
1 CVEs0 on KEV0 new
MA8.3
matrix-authentication-service
element-hq
1 CVEs0 on KEV0 new
MA9.2
matrix-tools
element-hq
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-55644 | EL element-x-ios element-hq | 5.1 | Oct 19 | Element X iOS: io.element.call deeplink allows attacker-controlled HTTPS origin and may grant mic/camera to that origin |
| CVE-2026-55850 | EL element-web element-hq | 5.3 | Aug 21 | Element Web: A malicious homeserver can inject HTML in Element Web using its homepage |
| CVE-2026-48007 | EL element-call element-hq | 8.6 | Aug 7 | Element Call reports full URLs of visited pages to analytics server |
| CVE-2026-45078 | SY synapse element-hq | 5.5 | May 28 | Synapse CPU starvation (Denial of Service) |
| CVE-2026-45076 | SY synapse element-hq | 2.7 | May 28 | Synapse pagination denial of service |
| CVE-2026-24044 | ES ess-helm element-hq | 9.2 | Feb 12 | ESS Community Helm Chart has a weak server key generation method |
| CVE-2025-62425 | MA matrix-authentication-service element-hq | 8.3 | Oct 16 | Matrix Authentication Service account password can be changed using an authenticated session without supplying the current password |
| CVE-2025-61672 | SY synapse element-hq | 5.3 | Oct 8 | Synapse: Invalid device keys degrade federation functionality |
| CVE-2025-59161 | EL element-web element-hq | 2.7 | Sep 16 | In Element Web and Element Desktop, a malicious room can hide an unrelated room and cause it to be left when the malicious room is left |
| CVE-2025-27599 | EL element-x-android element-hq | 6.5 | Apr 18 | Element X Android vulnerable to loading malicious web pages via received intent |
| CVE-2025-32026 | EL element-web element-hq | 3.8 | Apr 8 | Element Web could load a malicious instance of Element Call leaking media encryption keys |
| CVE-2025-31126 | EL element-x-ios element-hq | 5.3 | Apr 3 | Element X iOS allows the entity in control of the well-known file to break the confidentiality of embedded Element Call |
| CVE-2025-31127 | EL element-x-android element-hq | 5.3 | Apr 3 | Element X Android allows the entity in control of the well-known file to break the confidentiality embedded Element Call |
| CVE-2025-30355 | SY synapse element-hq | 7.5 | Mar 27 | Synapse vulnerable to federation denial of service via malformed events |
| CVE-2025-27606 | EL element-android element-hq | 4.6 | Mar 14 | Element Android PIN autologout bypass |
| CVE-2024-37303 | SY synapse element-hq | 5.3 | Dec 3 | Synapse unauthenticated writes to the media repository allow planting of problematic content |
| CVE-2024-37302 | SY synapse element-hq | 7.5 | Dec 3 | Synapse denial of service through media disk space consumption |
| CVE-2024-52805 | SY synapse element-hq | 7.5 | Dec 3 | Synapse allows unsupported content types to lead to memory exhaustion |
| CVE-2024-52815 | SY synapse element-hq | 5.3 | Dec 3 | Synapse allows a a malformed invite to break the invitee's `/sync` |
| CVE-2024-53867 | SY synapse element-hq | 4.3 | Dec 3 | Synapse Matrix has a partial room state leak via Sliding Sync |
| CVE-2024-53863 | SY synapse element-hq | 9.1 | Dec 3 | Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders |
| CVE-2024-51750 | EL element-web element-hq | 5.0 | Nov 12 | Element allows a malicious homeserver can modify events leading to unrenderable events or rooms |
| CVE-2024-51749 | EL element-web element-hq | 3.5 | Nov 12 | Element's thumbnails can be abused to misrepresent the content of an attachment |
| CVE-2024-47779 | EL element-web element-hq | 7.0 | Oct 15 | Element Web vulnerable to potential exposure of access token via authenticated media |
| CVE-2024-47771 | EL element-desktop element-hq | 7.0 | Oct 15 | Element Desktop vulnerable to potential exposure of access token via authenticated media |