Skip to content
OpenAdvisories

Vendor

Rocket.Chat

16 known vulnerabilities.

Rocket.Chat at a glance

Last 12 months
11
Critical · all time
3
Exploited · all time
0
Public exploit · all time
2
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 3 vulnerabilities, 1 critical May 2026: 2 vulnerabilities June 2026: 2 vulnerabilities, 1 critical Jun July 2026: 1 vulnerability, 1 critical August 2026: 3 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202630
Jul 202611
Jun 202621
May 202620
Apr 202631
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202510
Aug 202500
Jul 202500
Jun 202510
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

Rocket.Chat 14 Rocket.Chat Desktop 1 Mobile 1
All Critical High Medium Low Exploited only Public exploit

16 results · Feed

  • Medium 4.3
    CVE-2026-65645

    Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP meth…

    Rocket.Chat Rocket.Chat
  • High 7.5
    CVE-2026-65644

    Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpo…

    Rocket.Chat Rocket.Chat
  • High 7.5
    CVE-2026-56845

    An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configu…

    Rocket.Chat Rocket.Chat
  • Critical 9.8
    CVE-2026-58066

    Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML…

    Rocket.Chat Rocket.Chat
  • High 7.5
    CVE-2026-48929

    Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthen…

    Rocket.Chat Rocket.Chat
  • Critical 9.3
    CVE-2026-48616

    Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerability in …

    Rocket.Chat Rocket.Chat
  • High 7.5
    CVE-2026-32995

    The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.5, <…

    Rocket.Chat Rocket.Chat
  • Medium 5.3
    CVE-2026-32994

    The /api/v1/autotranslate.translateMessage endpoint in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.6, <7.13.8…

    Rocket.Chat Rocket.Chat
  • Medium 4.3
    CVE-2026-29197

    In versions <8.4.0, <8.3.2, <8.2.2, <8.1.3, <8.0.4, <7.13.6, <7.12.7, <7.11.7, and <7.10.10, the endpoints /api/apps/lo…

    Rocket.Chat Rocket.Chat
  • Critical 9.8
    CVE-2026-29198 Public exploit

    In Rocket.Chat <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7.10.9, a NoSQL injection vulnerability …

    Rocket.Chat Rocket.Chat
  • Medium 5.3
    CVE-2026-22560

    An open redirect vulnerability in Rocket.Chat versions prior to 8.4.0 allows users to be redirected to arbitrary URLs b…

    Rocket.Chat Rocket.Chat
  • Low 3.7
    CVE-2025-7974

    rocket.chat Incorrect Authorization Information Disclosure Vulnerability

    rocket.chat Incorrect Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of rocket.chat. Authentication is not required to exploit this vulnerability. The …

    Rocket.Chat Rocket.Chat
  • Medium 5.5
    CVE-2024-8270

    macOS Rocket.Chat: TCC Policy Bypass via Dylib Injection Due to Missing Code Signing Flags and Dangerous Entitlements

    The macOS Rocket.Chat application is affected by a vulnerability that allows bypassing Transparency, Consent, and Control (TCC) policies, enabling the exploitation or abuse of permissions specified in its entitlements (e.g., microphone, camera, automation, ne…

    Rocket.Chat Rocket.Chat Desktop
  • Medium 6.7
    CVE-2024-42027

    The E2EE password entropy generated by Rocket.Chat Mobile prior to version 4.5.1 is insufficient, allowing attackers to…

    Rocket.Chat Mobile
  • High 8.6
    CVE-2024-39713 Public exploit

    Rocket.Chat Server-Side Request Forgery (SSRF) vulnerability

    A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.

    Rocket.Chat Rocket.Chat rocket.chat npm
  • Medium 6.5
    CVE-2024-37405

    Livechat messages can be leaked by combining two NoSQL injections affecting livechat:loginByToken (pre-authentication) …

    Rocket.Chat Rocket.Chat