Vendor
Matrix-org
85 known vulnerabilities in products by Matrix-org, 0 of them actively exploited (CISA KEV).
Key figures
85
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
4
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Medium | CVE-2020-26257 | Denial of service attack via incorrect parameters to federation APIs | 6.5 | |
| High | CVE-2021-29430 | Denial of service attack via memory exhaustion | 7.5 | |
| High | CVE-2021-41281 | Path traversal in Matrix Synapse | 7.5 | |
| High | CVE-2022-39250 | Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification | 8.6 | |
| High | CVE-2022-39251 | Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion | 8.6 | |
| Medium | CVE-2022-31052 | URL previews can crash Synapse media repositories or Synapse monoliths | 6.5 | |
| High | CVE-2023-28427 | Prototype pollution in matrix-js-sdk | 8.2 | |
| High | CVE-2022-39249 | Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions | 7.5 | |
| High | CVE-2022-39255 | Matrix iOS SDK vulnerable ton Olm/Megolm protocol confusion | 8.6 | |
| High | CVE-2022-39248 | matrix-android-sdk2 vulnerable to Olm/Megolm protocol confusion | 8.6 | |
| Medium | CVE-2021-21274 | Denial of service attack via .well-known lookups | 4.3 | |
| High | CVE-2021-29431 | SSRF in Sydent due to missing validation of hostnames | 7.7 | |
| High | CVE-2022-36059 | Prototype pollution in matrix-js-sdk | 8.2 | |
| High | CVE-2022-39203 | Parsing issue in matrix-org/node-irc leading to room takeovers | 8.8 | |
| Critical | CVE-2025-24024 | Mjolnir v1.9.0 accepts commands from any room | 9.1 | |
| High | CVE-2022-29166 | Improper handling of multiline messages in matrix-appservice-irc | 8.0 | |
| Medium | CVE-2021-21393 | Matrix-org Synapse: Improper Input Validation | 5.3 | |
| High | CVE-2021-21332 | Cross-site scripting (XSS) vulnerability in the password reset endpoint | 6.9 | |
| High | CVE-2022-36060 | Prototype pollution in matrix-react-sdk | 8.2 | |
| High | CVE-2024-47080 | Matrix-org Matrix-js-sdk: Exposure of Sensitive Information to an Unauthorized Actor | — | |
| Medium | CVE-2021-21333 | HTML injection in email and account expiry notifications | 6.1 | |
| Medium | CVE-2021-21394 | Matrix-org Synapse: Improper Input Validation | 5.3 | |
| High | CVE-2024-47824 | Matrix-org Matrix-react-sdk: Exposure of Sensitive Information to an Unauthorized Actor | — | |
| High | CVE-2022-31152 | Matrix-org Synapse: Improper Check or Handling of Exceptional Conditions | 6.4 | |
| High | CVE-2022-39257 | Matrix iOS SDK vulnerable to impersonation via forwarded Megolm sessions | 7.5 |
Products
| Synapse | 24 | 0 |
| Matrix-js-sdk | 11 | 0 |
| Matrix-appservice-irc | 9 | 0 |
| Matrix-react-sdk | 8 | 0 |
| Matrix-rust-sdk | 8 | 0 |
| Sydent | 5 | 0 |
| Dendrite | 4 | 0 |