Rocket.Chat vulnerabilities

CVEs whose affected-version data names the Rocket.Chat package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-75575Medium· 5.3

4w ago

Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes

Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAno…

▾ SunlitRocketChat · Rocket.ChatEPSS 0.23%via NVD