Eelement-hq

Products

Exploited and recent CVEs

• CVE-2026-62347 Medium 5.9 Element Call exposes shared passwords in logs 0.3%
• CVE-2026-119407 High 7.1 Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters 0.1%
• CVE-2026-119407 High 7.1 Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters 0.1%
• CVE-2026-55644 Medium 5.1 Element X iOS: io.element.call deeplink allows attacker-controlled HTTPS origin and may grant mic/camera to that origin 0.4%
• CVE-2026-55850 Medium 5.3 Element Web: A malicious homeserver can inject HTML in Element Web using its homepage 0.5%
• CVE-2026-48007 High 8.6 Element Call reports full URLs of visited pages to analytics server 0.3%
• CVE-2026-45078 Medium 6.8 Synapse CPU starvation (Denial of Service) 0.1%
• CVE-2026-45076 Medium 5.1 Synapse pagination denial of service 0.4%
• CVE-2026-24044 Critical 9.2 ESS Community Helm Chart has a weak server key generation method 0.3%
• CVE-2026-24044 Critical 9.2 ESS Community Helm Chart has a weak server key generation method 0.3%
• CVE-2025-62425 High 8.3 Matrix Authentication Service account password can be changed using an authenticated session without supplying the current password 0.5%
• CVE-2025-61672 Medium 5.3 Synapse: Invalid device keys degrade federation functionality 0.5%
• CVE-2025-59161 Low 2.7 In Element Web and Element Desktop, a malicious room can hide an unrelated room and cause it to be left when the malicious room is left 0.4%
• CVE-2025-27599 Medium 6.5 Element X Android vulnerable to loading malicious web pages via received intent 0.4%
• CVE-2025-32026 Low 3.8 Element Web could load a malicious instance of Element Call leaking media encryption keys 0.2%
• CVE-2025-31126 Medium 5.3 Element X iOS allows the entity in control of the well-known file to break the confidentiality of embedded Element Call 0.2%
• CVE-2025-31127 Medium 5.3 Element X Android allows the entity in control of the well-known file to break the confidentiality embedded Element Call 0.2%
• CVE-2025-30355 High 7.1 Synapse vulnerable to federation denial of service via malformed events 1.2%
• CVE-2025-27606 Medium 5.1 Element Android PIN autologout bypass 0.2%
• CVE-2024-37303 Medium 5.3 Synapse unauthenticated writes to the media repository allow planting of problematic content 0.4%
• CVE-2024-37302 High 7.5 Synapse denial of service through media disk space consumption 0.6%
• CVE-2024-52805 High 8.2 Synapse allows unsupported content types to lead to memory exhaustion 0.7%
• CVE-2024-52815 High 8.7 Synapse allows a a malformed invite to break the invitee's `/sync` 0.6%
• CVE-2024-53867 Medium 4.3 Synapse Matrix has a partial room state leak via Sliding Sync 0.4%
• CVE-2024-53863 High 8.2 Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders 0.6%
• CVE-2024-51750 Medium 5.0 Element allows a malicious homeserver can modify events leading to unrenderable events or rooms 0.5%
• CVE-2024-51749 Low 3.5 Element's thumbnails can be abused to misrepresent the content of an attachment 0.4%
• CVE-2024-47779 High 7.0 Element Web vulnerable to potential exposure of access token via authenticated media 0.4%
• CVE-2024-47771 High 7.0 Element Desktop vulnerable to potential exposure of access token via authenticated media 0.6%
• CVE-2024-31208 Medium 6.5 Synapse's V2 state resolution weakness allows DoS from remote room members 1.5%