MA
Vendor
matrix-org
13
CVEs
0
On KEV
0
New 30D
Products
MA7.5
matrix-rust-sdk
matrix-org
7 CVEs0 on KEV0 new
DE6.5
dendrite
matrix-org
3 CVEs0 on KEV0 new
MA7.5
matrix-js-sdk
matrix-org
2 CVEs0 on KEV0 new
MA4.9
matrix-sdk-ui
matrix-org
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-45056 | MA matrix-rust-sdk matrix-org | 6.9 | Sep 11 | Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution |
| CVE-2026-45057 | MA matrix-sdk-ui matrix-org | 4.9 | Sep 11 | matrix-sdk-ui: Incomplete edit validation |
| CVE-2026-63097 | DE dendrite matrix-org | 4.3 | Jul 17 | Dendrite 0.13.8 syncapi /context Endpoint Post-Leave State Exposure |
| CVE-2026-63096 | DE dendrite matrix-org | 5.8 | Jul 17 | Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint |
| CVE-2026-63095 | DE dendrite matrix-org | 6.5 | Jul 17 | Dendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint |
| CVE-2025-66622 | MA matrix-rust-sdk matrix-org | 7.5 | Dec 9 | matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event values |
| CVE-2025-59160 | MA matrix-js-sdk matrix-org | 2.7 | Sep 16 | matrix-js-sdk has insufficient validation when considering a room to be upgraded by another |
| CVE-2025-59047 | MA matrix-rust-sdk matrix-org | 2.7 | Sep 11 | matrix-sdk-base has panic in the `RoomMember::normalized_power_level()` method |
| CVE-2025-53549 | MA matrix-rust-sdk matrix-org | 5.2 | Jul 10 | Matrix Rust SDK allows SQL injection in the EventCache implementation |
| CVE-2025-48937 | MA matrix-rust-sdk matrix-org | 4.9 | Jun 10 | matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator |
| CVE-2024-52813 | MA matrix-rust-sdk matrix-org | 4.3 | Jan 7 | matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity |
| CVE-2022-39252 | MA matrix-rust-sdk matrix-org | 7.5 | Sep 29 | When matrix-rust-sdk recieves forwarded room keys, the reciever doesn't check if it requested the key from the forwarder |
| CVE-2022-39250 | MA matrix-js-sdk matrix-org | 7.5 | Sep 29 | Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification |