63 matches found
CVE-2026-55850
Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode. A malicious...
CVE-2026-55850 Element Web: A malicious homeserver can inject HTML in Element Web using its homepage
Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode. A malicious...
PT-2026-79429
Name of the Vulnerable Software and Affected Versions Element Web versions prior to 1.12.22 Description The EmbeddedPage component in apps/web/src/components/structures/EmbeddedPage.tsx renders homepage content supplied by the homeserver using dangerouslySetInnerHTML without utilizing...
CVE-2026-63095
CVE-2026-63095 affects Dendrite up to version 0.13.8. An improper authorization flaw in the Matrix Client-Server API allows any authenticated local user to delete another user’s third-party identifier (3PID) bindings by submitting an arbitrary address/medium to the account deletion endpoint witho...
CVE-2026-63095
Dendrite through 0.13.8 contains an improper authorization vulnerability in the Matrix Client-Server API that allows any authenticated local user to delete third-party identifier bindings belonging to other users by submitting an arbitrary address and medium to the account deletion endpoint witho...
CVE-2026-63095: Authorization Bypass Through User-Controlled Key
Dendrite through 0.13.8 contains an improper authorization vulnerability in the Matrix Client-Server API that allows any authenticated local user to delete third-party identifier bindings belonging to other users by submitting an arbitrary address and medium to the account deletion endpoint witho...
CVE-2026-42553
Cinny is a Matrix client. Prior to 4.10.3, A remote authenticated attacker who shares a room with a victim and has permissions to create room emotes for example in a DM can cause the victim's client to send their Matrix access token to an attacker-controlled server. This occurs when the victim...
CVE-2026-42553 Cinny: Access token disclosure via invalidated emoji pack avatar URL in service worker
Cinny is a Matrix client. Prior to 4.10.3, A remote authenticated attacker who shares a room with a victim and has permissions to create room emotes for example in a DM can cause the victim's client to send their Matrix access token to an attacker-controlled server. This occurs when the victim...
CVE-2025-66622 matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event values
matrix-sdk-base is the base component to build a Matrix client library. Versions 0.14.1 and prior are unable to handle responses that include custom m.room.joinrules values due to a serialization bug. This can be exploited to cause a denial-of-service condition, if a user is invited to a room wit...
EUVD-2022-6957
Malicious code in bioql PyPI...
EUVD-2024-2936
Malicious code in bioql PyPI...
EUVD-2023-1214
Malicious code in bioql PyPI...
EUVD-2024-2249
Malicious code in bioql PyPI...
EUVD-2024-23422
Malicious code in bioql PyPI...
EUVD-2025-29626
Malicious code in bioql PyPI...
EUVD-2025-0042
Malicious code in bioql PyPI...
CVE-2025-59161 In Element Web and Element Desktop, a malicious room can hide an unrelated room and cause it to be left when the malicious room is left
Element Web is a Matrix web client built using the Matrix React SDK. Element Web and Element Desktop before version 1.11.112 have insufficient validation of room predecessor links, allowing a remote attacker to attempt to impermanently replace a room's entry in the room list with an unrelated...
CVE-2025-59161
CVE-2025-59161 affects Element Web and Element Desktop prior to 1.11.112. The issue stems from insufficient validation of room predecessor links, which could allow a remote attacker to impermanently replace a room’s entry in the room list with an attacker-supplied room. The effect is described as...
CVE-2025-59160
Removed by vendor...
matrix-js-sdk data manipulation vulnerability
matrix-js-sdk is an application component of Matrix open source. A data forgery issue vulnerability exists in matrix-js-sdk versions prior to 38.2.0, which stems from insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, which could lead to an attacker replacing a...