Vendor
Element-hq
30 known vulnerabilities in products by Element-hq, 0 of them actively exploited (CISA KEV).
Key figures
30
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2025-30355 | Synapse vulnerable to federation denial of service via malformed events | 7.1 | |
| Medium | CVE-2024-31208 | Synapse's V2 state resolution weakness allows DoS from remote room members | 6.5 | |
| High | CVE-2024-52805 | Synapse allows unsupported content types to lead to memory exhaustion | 7.5 | |
| Critical | CVE-2024-53863 | Element-hq Synapse: Unrestricted Upload of File with Dangerous Type | 9.1 | |
| High | CVE-2024-52815 | Synapse allows a a malformed invite to break the invitee's `/sync` | 5.3 | |
| High | CVE-2026-48007 | Element Call reports full URLs of visited pages to analytics server | — | |
| Medium | CVE-2026-55850 | Element Web: A malicious homeserver can inject HTML in Element Web using its homepage | — | |
| High | CVE-2026-119407 | Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters | 7.1 | |
| Critical | CVE-2026-24044 | ESS Community Helm Chart has a weak server key generation method | — | |
| High | CVE-2025-62425 | Element-hq Matrix-authentication-service: Unverified Password Change | 8.3 | |
| Medium | CVE-2026-55644 | Element-hq Element-x-ios: Improper Input Validation | — | |
| High | CVE-2024-37302 | Synapse denial of service through media disk space consumption | 7.5 | |
| High | CVE-2024-47771 | Element Desktop vulnerable to potential exposure of access token via authenticated media | — | |
| High | CVE-2024-26131 | Element Android Intent Redirection | 8.4 | |
| Medium | CVE-2026-62347 | Element Call exposes shared passwords in logs | — | |
| High | CVE-2024-47779 | Element Web vulnerable to potential exposure of access token via authenticated media | — | |
| Medium | CVE-2026-45078 | Synapse CPU starvation (Denial of Service) | 5.5 | |
| Medium | CVE-2025-61672 | Synapse: Invalid device keys degrade federation functionality | — | |
| Medium | CVE-2026-45076 | Synapse pagination denial of service | 2.7 | |
| Medium | CVE-2025-27599 | Element X Android vulnerable to loading malicious web pages via received intent | 6.5 | |
| Medium | CVE-2024-51750 | Element allows a malicious homeserver can modify events leading to unrenderable events or rooms | 5.0 | |
| Medium | CVE-2024-37303 | Synapse unauthenticated writes to the media repository allow planting of problematic content | 5.3 | |
| Medium | CVE-2024-53867 | Synapse Matrix has a partial room state leak via Sliding Sync | 4.3 | |
| Medium | CVE-2025-31126 | Element-hq Element-x-ios: Exposure of Sensitive Information to an Unauthorized Actor | 5.3 | |
| Medium | CVE-2025-31127 | Element-hq Element-x-android: Exposure of Sensitive Information to an Unauthorized Actor | 5.3 |
Products
| Synapse | 11 | 0 |
| Element-web | 7 | 0 |
| Element-android | 3 | 0 |