Latest vulnerabilities for vendor "element"

Where

Sort:

Software

element desktop

element element android

element element iphone os

pip/matrix-synapseSynapse pagination denial of service

Risk 23

Severity

5.1

First published (updated )

CVE-2026-45076

pip/matrix-synapseSynapse CPU starvation (Denial of Service)

Risk 37

Severity

6.8

First published (updated )

CVE-2026-45078

Element Matrix Authentication ServiceMatrix Authentication Service account password can be changed using an authenticated session without supplying the current password

Risk 69

Severity

8.3

First published (updated )

CVE-2025-62425

Element WebIn Element Web and Element Desktop, a malicious room can hide an unrelated room and cause it to be left when the malicious room is left

Risk 18

Severity

2.7

First published (updated )

CVE-2025-59161

Element Element X AndroidElement X Android vulnerable to loading malicious web pages via received intent

Risk 40

Severity

6.5

First published (updated )

CVE-2025-27599

Element Element WebElement Web could load a malicious instance of Element Call leaking media encryption keys

Risk 20

Severity

3.8

EPSS

0.02%

First published (updated )

CVE-2025-32026

Element Element X iOSElement X iOS allows the entity in control of the well-known file to break the confidentiality of embedded Element Call

Risk 19

Severity

5.3

EPSS

0.02%

First published (updated )

CVE-2025-31126

Element Element X AndroidElement X Android allows the entity in control of the well-known file to break the confidentiality embedded Element Call

Risk 19

Severity

5.3

EPSS

0.02%

First published (updated )

CVE-2025-31127

Element Element AndroidElement Android PIN autologout bypass

Risk 23

Severity

5.1

EPSS

0.02%

First published (updated )

CVE-2025-27606

Element Element WebElement allows a malicious homeserver can modify events leading to unrenderable events or rooms

Risk 26

Severity

First published (updated )

CVE-2024-51750

Element Element WebElement's thumbnails can be abused to misrepresent the content of an attachment

Risk 19

Severity

3.5

First published (updated )

CVE-2024-51749

Element Element WebElement Web vulnerable to potential exposure of access token via authenticated media

Risk 54

Severity

First published (updated )

CVE-2024-47779

Element DesktopElement Desktop vulnerable to potential exposure of access token via authenticated media

Risk 54

Severity

First published (updated )

CVE-2024-47771

Element Element AndroidElement Android can be asked to share internal files.

Risk 15

Severity

EPSS

0.04%

First published (updated )

CVE-2024-26132

Element Element AndroidElement Android Intent Redirection

Risk 54

Severity

8.4

EPSS

0.04%

First published (updated )

CVE-2024-26131

Element Element Iphone OsElement iOS is vulnerable due to missing decoration for events decrypted with untrusted Megolm sessions

Risk 40

Severity

6.5

First published (updated )

CVE-2022-41904

Element Desktop Node.jsRemote program execution with user interaction

Risk 77

Severity

8.8

First published (updated )

CVE-2022-23597

Trending

Vendor Risk Score

Software

pip/matrix-synapseSynapse pagination denial of service

pip/matrix-synapseSynapse CPU starvation (Denial of Service)

Element Matrix Authentication ServiceMatrix Authentication Service account password can be changed using an authenticated session without supplying the current password

Element WebIn Element Web and Element Desktop, a malicious room can hide an unrelated room and cause it to be left when the malicious room is left

Element Element X AndroidElement X Android vulnerable to loading malicious web pages via received intent

Don't miss critical vulnerabilities

Element Element WebElement Web could load a malicious instance of Element Call leaking media encryption keys

Element Element X iOSElement X iOS allows the entity in control of the well-known file to break the confidentiality of embedded Element Call

Element Element X AndroidElement X Android allows the entity in control of the well-known file to break the confidentiality embedded Element Call

Element Element AndroidElement Android PIN autologout bypass

Element Element WebElement allows a malicious homeserver can modify events leading to unrenderable events or rooms

Don't miss critical vulnerabilities

Element Element WebElement's thumbnails can be abused to misrepresent the content of an attachment

Element Element WebElement Web vulnerable to potential exposure of access token via authenticated media

Element DesktopElement Desktop vulnerable to potential exposure of access token via authenticated media

Element Element AndroidElement Android can be asked to share internal files.

Element Element AndroidElement Android Intent Redirection

Don't miss critical vulnerabilities

Element Element Iphone OsElement iOS is vulnerable due to missing decoration for events decrypted with untrusted Megolm sessions

Element Desktop Node.jsRemote program execution with user interaction

Company

Resources

Contact