LemmyNet lemmy

• CVE-2026-54738 Medium 6.5 Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo 0.6%
• CVE-2026-54743 Medium 6.4 Lemmy: Stored XSS via markdown image alt-text in lemmy-ui html5-embed 0.5%
• CVE-2026-54739 Medium 6.9 Lemmy: Login Endpoint User Enumeration via HTTP Response Code Differential 0.6%
• CVE-2026-54740 Medium 6.5 Lemmy: Lower-ranked federated moderator can remove higher-ranked moderators 0.4%
• CVE-2026-54741 Medium 5.3 Lemmy: Blocked users can edit private messages sent before the block 0.5%
• CVE-2026-54742 Medium 5.1 Lemmy: `CollectionAdd::Featured` does not check the post is in the community 0.5%
• CVE-2026-42180 Medium 6.3 Lemmy: SSRF in /api/v3/post via Webmention dispatch 0.2%
• CVE-2026-42181 Medium 6.5 Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:image 0.3%
• CVE-2026-33693 Medium 6.5 Lemmy's Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid() 0.4%
• CVE-2026-29178 High 7.7 Lemmy: Unauthenticated SSRF via file_type query parameter injection in image endpoint 0.3%
• CVE-2025-25194 Medium 4.0 Server-Side Request Forgery (SSRF) in activitypub_federation 0.4%
• CVE-2024-23649 High 7.5 Any authenticated user may obtain private message details from other users on the same instance 0.5%