Product by Element-hq
Element-web
7 known vulnerabilities in Element-web (Element-hq), 0 of them actively exploited (CISA KEV).
Key figures
7
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Medium | CVE-2026-55850 | Element Web: A malicious homeserver can inject HTML in Element Web using its homepage | — | |
| High | CVE-2026-119407 | Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters | 7.1 | |
| High | CVE-2024-47779 | Element Web vulnerable to potential exposure of access token via authenticated media | — | |
| Medium | CVE-2024-51750 | Element allows a malicious homeserver can modify events leading to unrenderable events or rooms | 5.0 | |
| Low | CVE-2025-59161 | Element-hq Element-web: Improper Input Validation | — | |
| Low | CVE-2024-51749 | Element's thumbnails can be abused to misrepresent the content of an attachment | 3.5 | |
| Low | CVE-2025-32026 | Element Web could load a malicious instance of Element Call leaking media encryption keys | 3.8 |