element-hq has 2 CVEs on record. 2 were published in the last 90 days. The median CVSS is 5.1 (medium).
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.1
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
2
Total CVEs
0
Critical
0
CISA KEV
0
Exploited
element-hq vulnerabilities
CVEs affecting element-hq, newest first. Open any entry for full detail, references, and exploit status.
2 CVEsRSS
CVE-2026-55644Medium· 5.1Element X iOS: io.element.call deeplink allows attacker-controlled HTTPS origin and may grant mic/camera to that origin
Element X iOS is a Matrix iOS Client provided by Element. Element X iOS before version 26.05.0 fails to check the URL allowlist when parsing io.element.call://. If an attacker is able to trick the user into opening a maliciously crafted …
▾ Sunlitelement-hq · element-x-iosEPSS 0.38%via CVEORG
CVE-2026-48007HighElement Call is a native Matrix video conferencing application
Element Call is a native Matrix video conferencing application. Versions 0.5.17 through 0.19.3 report analytics data to a PostHog server, when configured to by a `posthog` key in config.json or by the `posthogApiHost` and `posthogApiKey`…
▾ Twilightelement-hq · @element-hq/element-call-embeddedEPSS 0.25%via NVD