Input Validation and Logic

Every one of the 10 is a mark on the map. Named now: 1 to 10, most at risk first.

1. Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpointsCVE-2021-21393matrix-org · CVSS 5.3 · 1.6% likely

   CWE-20

2. Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpointsCVE-2021-21394matrix-org · CVSS 5.3 · 1.5% likely

   CWE-20

3. Matrix Javascript SDK improper beacon events can cause availability issuesCVE-2022-39236matrix-org · CVSS 4.3 · 1.4% likely

   CWE-20

4. Synapse vulnerable to denial of service (DoS) due to incorrect application of event authorization rulesCVE-2022-31152matrix-org · CVSS 6.4 · 1.2% likely

   CWE-703

5. Synapse Outgoing federation to specific hosts can be disabled by sending malicious invitesCVE-2023-32323matrix-org · CVSS 5 · 1.0% likely

   CWE-20

6. Malicious users could control the content of invitation emailsCVE-2021-29432matrix-org · CVSS 5.3 · 0.9% likely

   CWE-20

7. Denial of service (via resource exhaustion) due to improper input validationCVE-2021-29433matrix-org · CVSS 4.3 · 0.9% likely

   CWE-20

8. matrix-hookshot has a Potential Denial of Service when Hookshot is configured with GitHub supportCVE-2025-23197matrix-org · CVSS 6.5 · 0.5% likely

   CWE-754

9. matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event valuesCVE-2025-66622matrix-org · CVSS 1.3 · 0.4% likely

   CWE-755

10. matrix-sdk-base has panic in the `RoomMember::normalized_power_level()` methodCVE-2025-59047matrix-org · CVSS 2.7 · 0.4% likely

    CWE-682

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.