mastodon

Products

Exploited and recent CVEs

• CVE-2026-59825 High 7.4 Mastodon: Unwanted deactivation of SSL/TLS certificate verification 0.4%
• CVE-2026-72916 Medium 6.3 Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses 1.0%
• CVE-2026-72915 High 7.5 Mastodon: Personally-identifying information disclosure due to incorrect access control validation 0.5%
• CVE-2026-72914 High 7.5 Mastodon: Exhausting data by an unauthenticated request to the admin retention API 0.8%
• CVE-2026-50129 High 7.5 Mastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH_TRANSFORMER 0.5%
• CVE-2026-50128 Medium 5.3 Mastodon: Spoofing of attribution domains 0.2%
• CVE-2026-48028 Medium 6.5 Mastodon: Removal of integrity-protected JSON entries from signed activities 0.2%
• CVE-2026-47389 High 8.6 Mastodon: SSRF protection bypass on older Ruby versions 0.4%
• CVE-2026-46349 Medium 5.3 Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuring 0.2%
• CVE-2026-46348 High 8.7 Mastodon: SSRF Bypass via IPv6 Unspecified Address (::) 0.4%
• CVE-2026-47777 High 7.5 Mastodon has a consent-check bypass in its remote Collections 0.2%
• CVE-2026-41259 High 8.2 Mastodon: Insufficient verification of email addresses 0.2%
• CVE-2026-33869 Medium 4.8 Mastodon has a denial of service for quote authorization 0.2%
• CVE-2026-33868 Medium 4.3 Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>' 0.5%
• CVE-2026-27477 Medium 4.6 Mastodon has SSRF via unvalidated FASP Provider base_url 0.3%
• CVE-2026-27468 Medium 4.8 Mastodon may allow unconfirmed FASP to make subscriptions 0.3%
• CVE-2026-25540 Medium 6.5 Mastodon's signature-dependent ActivityPub collection responses cached under signature-independent keys (Web Cache Poisoning via `Rails.cache`) 0.4%
• CVE-2026-23964 Medium 6.5 Mastodon has insufficient access control to push notification settings 0.2%
• CVE-2026-23963 Medium 4.3 Mastodon missing length limits on list names, filter names, and filter keywords 0.4%
• CVE-2026-23962 High 7.5 Mastodon vulnerable to Denial of Service from a single post (client/server) 0.5%
• CVE-2026-23961 Medium 5.3 Mastodon may allow a remote suspension bypass 0.4%
• CVE-2026-22246 Medium 6.5 Local Mastodon users can enumerate and access severed relationships of every other local user 0.3%
• CVE-2026-22245 High 7.1 Mastodon has SSRF Protection bypass 0.3%
• CVE-2025-67500 Low 3.7 Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration 0.2%
• CVE-2025-62605 Medium 4.3 Mastodon quotes control can be bypassed 0.3%
• CVE-2025-62176 Medium 4.3 Mastadon streaming server allows OAuth clients without the `read` scope to subscribe to public channels 0.3%
• CVE-2025-62175 Medium 4.3 Mastodon streaming API fails to disconnect disabled and suspended users 0.2%
• CVE-2025-62174 Low 3.5 Mastodon allows continued access after password reset via CLI 0.2%
• CVE-2025-54879 Medium 5.3 Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails 0.6%
• CVE-2025-27399 Medium 5.3 Mastodon's domain blocks & rationales ignore user approval when visibility set as "users" 0.4%