Low
CVE-2025-27146
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 59
Reset filters
Medium
CVE-2025-21610
Trix allows Cross-site Scripting via `javascript:` url in a link
Medium
CVE-2024-53847
Trix editor subject to XSS vulnerabilities on copy & paste
Medium
CVE-2024-50336
matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal
High
CVE-2024-47824
Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room
High
CVE-2024-47080
Matrix JavaScript SDK's key history sharing could share keys to malicious devices
Medium
CVE-2024-42369
matrix-js-sdk will freeze when a user sets a room with itself as a its predecessor
Medium
CVE-2024-43368
Trix has a cross-site Scripting vulnerability on copy & paste
Medium
CVE-2024-42347
Matrix SDK for React's URL preview setting for a room is controllable by the homeserver
Medium
CVE-2024-39691
Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access to
Medium
CVE-2024-34341
Trix Editor Arbitrary Code Execution Vulnerability
Medium
CVE-2024-32000
Matrix IRC Bridge truncated content of messages can be leaked
Medium
CVE-2023-38690
matrix-appservice-irc IRC command injection via admin commands containing newlines
Medium
CVE-2023-38691
matrix-appservice-bridge doesn't verify the sub parameter of an openId token exhange, allowing unauthorized access to provisioning APIs
Low
CVE-2023-38700
matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms
Medium
CVE-2023-37259
matrix-react-sdk vulnerable to XSS in Export Chat feature
High
CVE-2023-30609
HTML injection in search results via plaintext message highlighting
Medium
CVE-2023-29529
matrix-js-sdk vulnerable to invisible eavesdropping in group calls
High
CVE-2023-28427
Prototype pollution in matrix-js-sdk (part 2)
High
CVE-2023-28103
Prototype pollution in matrix-react-sdk
High
CVE-2022-36060
matrix-react-sdk Prototype pollution vulnerability
High
CVE-2022-36059
matrix-js-sdk Prototype Pollution vulnerability
Medium
CVE-2022-3971
Matrix-appservice-irc vulnerable to sql injection via roomIds argument
High
CVE-2022-39250
matrix-js-sdk subject to user impersonation due to key/device identifier confusion in SAS verification
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.