Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
49 results
Oct 27, 2026When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it.CVE-2026-118180 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all further Matrix requests of that session to local files or, on Windows, to an attacker-controlled network share, which could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Aug 21, 2026Runtipi is a personal homeserver orchestrator.CVE-2026-55168 · Other software · runtipi · reported by GitHubMedium 6.5
Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an arbitrary reachable path and then send PUT /api/user-config/demoapp3:_user with attacker-controlled appEnv content. FilesystemService.writeTextFile() follows the planted link, allowing content to be written outside the intended restore and user-config directory boundary with Runtipi process permissions. This issue is fixed in version 4.10.1.
- Product
- runtipi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026Runtipi is a personal homeserver orchestrator.CVE-2026-47277 · Other software · runtipi · reported by GitHubMedium 6.5
Runtipi is a personal homeserver orchestrator. In versions 4.9.1 through 4.9.3, Runtipi serves marketplace app logos from files inside cloned app-store repositories through an unauthenticated endpoint, which leads to arbitrary file read through app-store logo symlinks. The path guard checks only the lexical path before Node reads the file, so a Git app store that contains metadata/logo.jpg as a symbolic link can cause Runtipi to read and return the symlink target. Because the endpoint is public and the symlink target may point outside the cloned repository, this can expose local files from the Runtipi container such as /data/.env, /data/state/seed, logs, or application files. This can disclose JWT secrets, service credentials, local configuration, and operational logs depending on the instance. The issue has been fixed in version 4.10.0.
- Product
- runtipi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026Synapse is an open source Matrix homeserver implementation.CVE-2026-45078 · Other software · element-hq · reported by GitHubMedium 6.8
Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, local authenticated users can cause Synapse to starve other requests of CPU and lead to other requests failing, causing other users to be denied service. This vulnerability is fixed in 1.152.1.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026Synapse is an open source Matrix homeserver implementation.CVE-2026-45076 · Other software · element-hq · reported by GitHubMedium 5.1
Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients. Clients could therefore fail to display room history. This vulnerability is fixed in 1.152.1.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Runtipi is a personal homeserver orchestrator.CVE-2026-32729 · Other software · runtipi · reported by GitHubHigh 8.1
Runtipi is a personal homeserver orchestrator. Prior to 4.8.1, The Runtipi /api/auth/verify-totp endpoint does not enforce any rate limiting, attempt counting, or account lockout mechanism. An attacker who has obtained a user's valid credentials (via phishing, credential stuffing, or data breach) can brute-force the 6-digit TOTP code to completely bypass two-factor authentication. The TOTP verification session persists for 24 hours (default cache TTL), providing an excessive window during which the full 1,000,000-code keyspace (000000–999999) can be exhausted. At practical request rates (~500 req/s), the attack completes in approximately 33 minutes in the worst case. This vulnerability is fixed in 4.8.1.
- Product
- runtipi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026Runtipi is a personal homeserver orchestrator.CVE-2026-31881 · Other software · runtipi · reported by GitHubHigh 7.7
Runtipi is a personal homeserver orchestrator. Prior to 4.8.0, an unauthenticated attacker can reset the operator (admin) password when a password-reset request is active, resulting in full account takeover. The endpoint POST /api/auth/reset-password is exposed without authentication/authorization checks. During the 15-minute reset window, any remote user can set a new operator password and log in as admin. This vulnerability is fixed in 4.8.0.
- Product
- runtipi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026continuwuity is a Matrix homeserver written in Rust.CVE-2026-24471 · Other software · continuwuity · reported by GitHubCritical 9.3
continuwuity is a Matrix homeserver written in Rust. This vulnerability allows an attacker with a malicious remote server to cause the local server to sign an arbitrary event upon user interaction. Upon a user account leaving a room (rejecting an invite), joining a room or knocking on a room, the victim server may ask a remote server for assistance. If the victim asks the attacker server for assistance the attacker is able to provide an arbitrary event, which the victim will sign and return to the attacker. For the /leave endpoint, this works for any event with a supported room version, where the origin and origin_server_ts is set by the victim. For the /join endpoint, an additionally victim-set content field in the format of a join membership is needed. For the /knock endpoint, an additional victim-set content field in the format of a knock membership and a room version not between 1 and 6 is needed. This was exploited as a part of a larger chain against the continuwuity.org homeserver. This vulnerability affects all Conduit-derived servers. This vulnerability is fixed in Continuwuity 0.5.1, Conduit 0.10.11, Grapevine 0aae932b, and Tuwunel 1.4.9.
- Product
- continuwuity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforgejo.ellis.linkgithub.com
Jan 29, 2026Runtipi is a personal homeserver orchestrator.CVE-2026-25116 · Other software · runtipi · reported by GitHubHigh 7.6
Runtipi is a personal homeserver orchestrator. Starting in version 4.5.0 and prior to version 4.7.2, an unauthenticated Path Traversal vulnerability in the `UserConfigController` allows any remote user to overwrite the system's `docker-compose.yml` configuration file. By exploiting insecure URN parsing, an attacker can replace the primary stack configuration with a malicious one, resulting in full Remote Code Execution (RCE) and host filesystem compromise the next time the instance is restarted by the operator. Version 4.7.2 fixes the vulnerability.
- Product
- runtipi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Runtipi is a Docker-based, personal homeserver orchestrator that facilitates multiple services on a single server.CVE-2026-24129 · Other software · runtipi · reported by GitHubHigh 8
Runtipi is a Docker-based, personal homeserver orchestrator that facilitates multiple services on a single server. Versions 3.7.0 and above allow an authenticated user to execute arbitrary system commands on the host server by injecting shell metacharacters into backup filenames. The BackupManager fails to sanitize the filenames of uploaded backups. The system persists user-uploaded files directly to the host filesystem using the raw originalname provided in the request. This allows an attacker to stage a file containing shell metacharacters (e.g., $(id).tar.gz) at a predictable path, which is later referenced during the restore process. The successful storage of the file is what allows the subsequent restore command to reference and execute it. This issue has been fixed in version 4.7.0.
- Product
- runtipi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025MAS (Matrix Authentication Service) is a user management and authentication service for Matrix homeservers, written and maintained by Element.CVE-2025-62425 · Other software · element-hq · reported by GitHubHigh 8.3
MAS (Matrix Authentication Service) is a user management and authentication service for Matrix homeservers, written and maintained by Element. A logic flaw in matrix-authentication-service 0.20.0 through 1.4.0 allows an attacker with access to an authenticated MAS session to perform sensitive operations without entering the current password. These include changing the current password, adding or removing an e-mail address and deactivating the account. The vulnerability only affects instances which have the local password database feature enabled (passwords section in the config). Patched in matrix-authentication-service 1.4.1.
- Product
- matrix-authentication-service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2025Synapse is an open source Matrix homeserver implementation.CVE-2025-61672 · Other software · element-hq · reported by GitHubMedium 5.3
Synapse is an open source Matrix homeserver implementation. Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade federation functionality, unpredictably breaking outbound federation to other homeservers. The issue is patched in Synapse 1.138.3, 1.138.4, 1.139.1, and 1.139.2. Note that even though 1.138.3 and 1.139.1 fix the vulnerability, they inadvertently introduced an unrelated regression. For this reason, the maintainers of Synapse recommend skipping these releases and upgrading straight to 1.138.4 and 1.139.2.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025Synapse is an open source Matrix homeserver implementation.CVE-2025-30355 · Other software · element-hq · reported by GitHubHigh 7.1
Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild and has been fixed in Synapse v1.127.1. No known workarounds are available.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix.CVE-2024-56515 · Other software · t2bot · reported by GitHubMedium 6.8
Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. If SVG or JPEGXL thumbnailers are enabled (they are disabled by default), a user may upload a file which claims to be either of these types and request a thumbnail to invoke a different decoder in ImageMagick. In some ImageMagick installations, this includes the capability to run Ghostscript to decode the image/file. If MP4 thumbnailers are enabled (also disabled by default), the same issue as above may occur with the ffmpeg installation instead. MMR uses a number of other decoders for all other file types when preparing thumbnails. Theoretical issues are possible with these decoders, however in testing they were not possible to exploit. This is fixed in MMR v1.3.8. MMR now inspects the mimetype of media prior to thumbnailing, and picks a thumbnailer based on those results instead of relying on user-supplied values. This may lead to fewer thumbnails when obscure file shapes are used. This also helps narrow scope of theoretical issues with all decoders MMR uses for thumbnails. Users are advised to upgrade. Users unable to upgrade may disable the SVG, JPEGXL, and MP4 thumbnail types in the
- Product
- matrix-media-repo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix.CVE-2024-52791 · Other software · t2bot · reported by GitHubMedium 5.3
Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR makes requests to other servers as part of normal operation, and these resource owners can return large amounts of JSON back to MMR for parsing. In parsing, MMR can consume large amounts of memory and exhaust available memory. This is fixed in MMR v1.3.8. Users are advised to upgrade. For users unable to upgrade; forward proxies can be configured to block requests to unsafe hosts. Alternatively, MMR processes can be configured with memory limits and auto-restart. Running multiple MMR processes concurrently can help ensure a restart does not overly impact users.
- Product
- matrix-media-repo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix.CVE-2024-52602 · Other software · t2bot · reported by GitHubMedium 5
Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. Matrix Media Repo (MMR) is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. This is fixed in MMR v1.3.8. Users are advised to upgrade. Restricting which hosts MMR is allowed to contact via (local) firewall rules or a transparent proxy and may provide a workaround for users unable to upgrade.
- Product
- matrix-media-repo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix.CVE-2024-36403 · Other software · t2bot · reported by GitHubMedium 5.3
Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR before version 1.3.5 is vulnerable to unbounded disk consumption, where an unauthenticated adversary can induce it to download and cache large amounts of remote media files. MMR's typical operating environment uses S3-like storage as a backend, with file-backed store as an alternative option. Instances using a file-backed store or those which self-host an S3 storage system are therefore vulnerable to a disk fill attack. Once the disk is full, authenticated users will be unable to upload new media, resulting in denial of service. For instances configured to use a cloud-based S3 storage option, this could result in high service fees instead of a denial of service. MMR 1.3.5 introduces a new default-on "leaky bucket" rate limit to reduce the amount of data a user can request at a time. This does not fully address the issue, but does limit an unauthenticated user's ability to request large amounts of data. Operators should note that the leaky bucket implementation introduced in MMR 1.3.5 requires the IP address associated with the request to be forwarded, to avoid mistakenly applying the
- Product
- matrix-media-repo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.wikipedia.orggithub.com
Jan 16, 2025Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix.CVE-2024-36402 · Other software · t2bot · reported by GitHubMedium 5.3
Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR before version 1.3.5 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticated way. The implication is that unauthenticated remote adversaries can use this functionality to plant problematic content into the media repository. MMR 1.3.5 introduces a partial mitigation in the form of new endpoints which require authentication for media downloads. The unauthenticated endpoints will be frozen in a future release, closing the attack vector. Though extremely limited, server operators can use more strict rate limits based on IP address as a partial workaround.
- Product
- matrix-media-repo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024Synapse is an open-source Matrix homeserver.CVE-2024-53867 · Other software · element-hq · reported by GitHubMedium 4.3
Synapse is an open-source Matrix homeserver. The Sliding Sync feature on Synapse versions between 1.113.0rc1 and 1.120.0 can leak partial room state changes to users no longer in a room. Non-state events, like messages, are unaffected. This vulnerability is fixed in 1.120.1.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024Synapse is an open-source Matrix homeserver.CVE-2024-53863 · Other software · element-hq · reported by GitHubHigh 8.2
Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the dynamic_thumbnails option or processing a specially crafted request could trigger the decoding and thumbnail generation of uncommon image formats, potentially invoking external tools like Ghostscript for processing. This significantly expands the attack surface in a historically vulnerable area, presenting a risk that far outweighs the benefit, particularly since these formats are rarely used on the open web or within the Matrix ecosystem. Synapse 1.120.1 addresses the issue by restricting thumbnail generation to images in the following widely used formats: PNG, JPEG, GIF, and WebP. This vulnerability is fixed in 1.120.1.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024Synapse is an open-source Matrix homeserver.CVE-2024-52815 · Other software · element-hq · reported by GitHubHigh 8.7
Synapse is an open-source Matrix homeserver. Synapse versions before 1.120.1 fail to properly validate invites received over federation. This vulnerability allows a malicious server to send a specially crafted invite that disrupts the invited user's /sync functionality. Synapse 1.120.1 rejects such invalid invites received over federation and restores the ability to sync for affected users.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024Synapse is an open-source Matrix homeserver.CVE-2024-52805 · Other software · element-hq · reported by GitHubHigh 8.2
Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024Synapse is an open-source Matrix homeserver.CVE-2024-37303 · Other software · element-hq · reported by GitHubMedium 5.3
Synapse is an open-source Matrix homeserver. Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticated way. The implication is that unauthenticated remote adversaries can use this functionality to plant problematic content into the media repository. Synapse 1.106 introduces a partial mitigation in the form of new endpoints which require authentication for media downloads. The unauthenticated endpoints will be frozen in a future release, closing the attack vector.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024Synapse is an open-source Matrix homeserver.CVE-2024-37302 · Other software · element-hq · reported by GitHubHigh 7.5
Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can lead to a denial of service, ranging from further media uploads/downloads failing to completely unavailability of the Synapse process, depending on how Synapse was deployed. Synapse 1.106 introduces a new "leaky bucket" rate limit on remote media downloads to reduce the amount of data a user can request at a time. This does not fully address the issue, but does limit an unauthenticated user's ability to request large amounts of data to be cached.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2024An incorrect access control issue in HomeServe Home Repair' android app - 3.3.4 allows a physically proximate attacker to escalate privileges via the fingerprinCVE-2024-40240 · Other software · homeserveusa · reported by MITREMedium 6.8
An incorrect access control issue in HomeServe Home Repair' android app - 3.3.4 allows a physically proximate attacker to escalate privileges via the fingerprint authentication function.
- Product
- homeserve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapkpure.comzzzxiin.github.io
Apr 23, 2024Synapse is an open-source Matrix homeserver.CVE-2024-31208 · Other software · element-hq · reported by GitHubMedium 6.5
Synapse is an open-source Matrix homeserver. A remote Matrix user with malicious intent, sharing a room with Synapse instances before 1.105.1, can dispatch specially crafted events to exploit a weakness in the V2 state resolution algorithm. This can induce high CPU consumption and accumulate excessive data in the database of such instances, resulting in a denial of service. Servers in private federations, or those that do not federate, are not affected. Server administrators should upgrade to 1.105.1 or later. Some workarounds are available. One can ban the malicious users or ACL block servers from the rooms and/or leave the room and purge the room using the admin API.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse.CVE-2023-43796 · Other software · matrix-org · reported by GitHubMedium 5.3
Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. System administrators are encouraged to upgrade to Synapse 1.95.1 or 1.96.0rc1 to receive a patch. As a workaround, the `federation_domain_whitelist` can be used to limit federation traffic with a homeserver.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation.CVE-2023-45129 · Other software · matrix-org · reported by GitHubMedium 4.9
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Prior to version 1.94.0, a malicious server ACL event can impact performance temporarily or permanently leading to a persistent denial of service. Homeservers running on a closed federation (which presumably do not need to use server ACLs) are not affected. Server administrators are advised to upgrade to Synapse 1.94.0 or later. As a workaround, rooms with malicious server ACL events can be purged and blocked using the admin API.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation.CVE-2023-42453 · Other software · matrix-org · reported by GitHubLow 3.1
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Users were able to forge read receipts for any event (if they knew the room ID and event ID). Note that the users were not able to view the events, but simply mark it as read. This could be confusing as clients will show the event as read by the user, even if they are not in the room. This issue has been patched in version 1.93.0. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation.CVE-2023-41335 · Other software · matrix-org · reported by GitHubLow 3.7
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. When users update their passwords, the new credentials may be briefly held in the server database. While this doesn't grant the server any added capabilities—it already learns the users' passwords as part of the authentication process—it does disrupt the expectation that passwords won't be stored in the database. As a result, these passwords could inadvertently be captured in database backups for a longer duration. These temporarily stored passwords are automatically erased after a 48-hour window. This issue has been addressed in version 1.93.0. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2023Synapse is a Matrix protocol homeserver written in Python with the Twisted framework.CVE-2023-32683 · Other software · matrix-org · reported by GitHubLow 3.5
Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. A discovered oEmbed or image URL can bypass the `url_preview_url_blacklist` setting potentially allowing server side request forgery or bypassing network policies. Impact is limited to IP addresses allowed by the `url_preview_ip_range_blacklist` setting (by default this only allows public IPs) and by the limited information returned to the client: 1. For discovered oEmbed URLs, any non-JSON response or a JSON response which includes non-oEmbed information is discarded. 2. For discovered image URLs, any non-image response is discarded. Systems which have URL preview disabled (via the `url_preview_enabled` setting) or have not configured a `url_preview_url_blacklist` are not affected. This issue has been addressed in version 1.85.0. Users are advised to upgrade. User unable to upgrade may also disable URL previews.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2023Synapse is a Matrix protocol homeserver written in Python with the Twisted framework.CVE-2023-32682 · Other software · matrix-org · reported by GitHubMedium 5.4
Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for login via the `jwt_config.enabled` configuration setting. 2. The local password database is enabled via the `password_config.enabled` and `password_config.localdb_enabled` configuration settings *and* a user's password is updated via an admin API after a user is deactivated. Note that the local password database is enabled by default, but it is uncommon to set a user's password after they've been deactivated. Installations that are configured to only allow login via Single Sign-On (SSO) via CAS, SAML or OpenID Connect (OIDC); or via an external password provider (e.g. LDAP) are not affected. If not using JSON Web Tokens, ensure that deactivated users do not have a password set. This issue has been addressed in version 1.85.0. Users are advised to upgrade.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2023Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation.CVE-2023-32323 · Other software · matrix-org · reported by GitHubMedium 5
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disabled are not affected. In versions of Synapse up to and including 1.73, Synapse did not limit the size of `invite_room_state`, meaning that it was possible to create an arbitrarily large invite event. Synapse 1.74 refuses to create oversized `invite_room_state` fields. Server operators should upgrade to Synapse 1.74 or newer urgently.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2023Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation.CVE-2022-39374 · Other software · matrix-org · reported by GitHubMedium 6.5
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2023Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation.CVE-2022-39335 · Other software · matrix-org · reported by GitHubMedium 5
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix Federation API allows remote homeservers to request the authorization events in a room. This is necessary so that a homeserver receiving some events can validate that those events are legitimate and permitted in their room. However, in versions of Synapse up to and including 1.68.0, a Synapse homeserver answering a query for authorization events does not sufficiently check that the requesting server should be able to access them. The issue was patched in Synapse 1.69.0. Homeserver administrators are advised to upgrade.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2023A vulnerability classified as problematic was found in Gira HomeServer up to 4.12.0.220829 beta.CVE-2023-2739 · Other software · Gira · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in Gira HomeServer up to 4.12.0.220829 beta. This vulnerability affects unknown code of the file /hslist. The manipulation of the argument lst with the input debug%27"><img%20src=x%20onerror=alert(document.cookie)> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-229150 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- HomeServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022Dendrite is a Matrix homeserver written in Go.CVE-2022-39200 · Other software · matrix-org · reported by GitHubHigh 7.3
Dendrite is a Matrix homeserver written in Go. In affected versions events retrieved from a remote homeserver using the `/get_missing_events` path did not have their signatures verified correctly. This could potentially allow a remote homeserver to provide invalid/modified events to Dendrite via this endpoint. Note that this does not apply to events retrieved through other endpoints (e.g. `/event`, `/state`) as they have been correctly verified. Homeservers that have federation disabled are not vulnerable. The problem has been fixed in Dendrite 0.9.8. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- dendrite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2022Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation.CVE-2022-31152 · Other software · matrix-org · reported by GitHubMedium 6.4
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specification specifies a list of [event authorization rules](https://spec.matrix.org/v1.2/rooms/v9/#authorization-rules) which must be checked when determining if an event should be accepted into a room. In versions of Synapse up to and including version 1.61.0, some of these rules are not correctly applied. An attacker could craft events which would be accepted by Synapse but not a spec-conformant server, potentially causing divergence in the room state between servers. Administrators of homeservers with federation enabled are advised to upgrade to version 1.62.0 or higher. Federation can be disabled by setting [`federation_domain_whitelist`](https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#federation_domain_whitelist) to an empty list (`[]`) as a workaround.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2021Synapse is a package for Matrix homeservers written in Python 3/Twisted.CVE-2021-41281 · Other software · matrix-org · reported by GitHubHigh 7.5
Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. The last 2 directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact. Homeservers with the media repository disabled are unaffected. Homeservers with a federation whitelist are also unaffected, since Synapse will check the remote hostname, including the trailing `../`s, against the whitelist. Server administrators should upgrade to 1.47.1 or later. Server administrators using a reverse proxy could, at the expense of losing media functionality, may block the certain endpoints as a workaround. Alternatively, non-containerized deployments can be adapted to use the hardened systemd config.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2021A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12.4.1 allows a malicious Matrix homeserver present in aCVE-2021-40823 · Other software · Matrix · reported by MITREMedium 5.9
A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12.4.1 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys (via crafted Matrix protocol messages) that were originally sent by affected Matrix clients participating in that room. This allows the homeserver to decrypt end-to-end encrypted messages sent by affected clients.
- Product
- Javascript SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2021Matrix libolm before 3.2.3 allows a malicious Matrix homeserver to crash a client (while it is attempting to retrieve an Olm encrypted room key backup from the CVE-2021-34813 · Other software · Matrix · reported by MITRECritical 9.8
Matrix libolm before 3.2.3 allows a malicious Matrix homeserver to crash a client (while it is attempting to retrieve an Olm encrypted room key backup from the homeserver) because olm_pk_decrypt has a stack-based buffer overflow. Remote code execution might be possible for some nonstandard build configurations.
- Product
- OLM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.matrix.orggitlab.matrix.org
May 11, 2021Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse).CVE-2021-29471 · Other software · matrix-org · reported by GitHubLow 3.7
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.33.2 "Push rules" can specify conditions under which they will match, including `event_match`, which matches event content against a pattern including wildcards. Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events. The issue is patched in version 1.33.2. A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2021Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse).CVE-2021-21393 · Other software · matrix-org · reported by GitHubMedium 5.3
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them. Refer to referenced GitHub security advisory for additional details including workarounds.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2021Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse).CVE-2021-21392 · Other software · matrix-org · reported by GitHubMedium 6.3
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 requests to user provided domains were not restricted to external IP addresses when transitional IPv6 addresses were used. Outbound requests to federation, identity servers, when calculating the key validity for third-party invite events, sending push notifications, and generating URL previews are affected. This could cause Synapse to make requests to internal infrastructure on dual-stack networks. See referenced GitHub security advisory for details and workarounds.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2021Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse).CVE-2021-21394 · Other software · matrix-org · reported by GitHubMedium 5.3
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them. Refer to referenced GitHub security advisory for additional details including workarounds.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2021Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse).CVE-2021-21333 · Other software · matrix-org · reported by GitHubMedium 6.1
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email. The account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker. This is fixed in version 1.27.0.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2021Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse).CVE-2021-21332 · Other software · matrix-org · reported by GitHubMedium 6.9
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains. This is fixed in version 1.27.0.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2021Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse).CVE-2021-21274 · Other software · matrix-org · reported by GitHubMedium 4.3
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a malicious homeserver could redirect requests to their .well-known file to a large file. This can lead to a denial of service attack where homeservers will consume significantly more resources when requesting the .well-known file of a malicious homeserver. This affects any server which accepts federation requests from untrusted servers. Issue is resolved in version 1.25.0. As a workaround the `federation_domain_whitelist` setting can be used to restrict the homeservers communicated with over federation.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2021Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse).CVE-2021-21273 · Other software · matrix-org · reported by GitHubLow 3.1
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, requests to user provided domains were not restricted to external IP addresses when calculating the key validity for third-party invite events and sending push notifications. This could cause Synapse to make requests to internal infrastructure. The type of request was not controlled by the user, although limited modification of request bodies was possible. For the most thorough protection server administrators should remove the deprecated `federation_ip_range_blacklist` from their settings after upgrading to Synapse v1.25.0 which will result in Synapse using the improved default IP address restrictions. See the new `ip_range_blacklist` and `ip_range_whitelist` settings if more specific control is necessary.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.