bookwyrm-social bookwyrm

• CVE-2026-86113 Medium 6.5 BookWyrm through 0.9.1 Insecure Direct Object Reference in edit-readthrough Allows Tampering with Other Users' Reading Records 0.4%
• CVE-2026-86112 Medium 5.4 BookWyrm through 0.9.1 Missing Authorization on the Favorite and Unfavorite Endpoints 0.3%
• CVE-2026-86111 Medium 6.5 BookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes Followers-Only and Direct Statuses 0.4%
• CVE-2022-35953 High 7.1 URL Redirection to Untrusted Site ('Open Redirect') in bookwyrm 0.6%
• CVE-2022-35925 Medium 5.3 Missing rate limit in Authentication in bookwyrm 1.8%
• CVE-2022-31136 Medium 6.3 Cross-site Scripting in BookWyrm 0.6%
• CVE-2022-23644 High 8.8 Server-side request forgery in BookWyrm 0.9%