MA
Product
mastodon
28
CVEs
0
On KEV
8.7
Max CVSS
0
New 30D
Severity mix
Critical 0High 11Medium 15Low 2
Watch
Add mastodon to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-46348 | 8.7 | Jun 24 | Mastodon: SSRF Bypass via IPv6 Unspecified Address (::) Affected: >= 4.5.0-beta.1, < 4.5.10 |
| CVE-2026-47389 | 8.6 | Jun 24 | Mastodon: SSRF protection bypass on older Ruby versions Affected: >= 4.5.0-beta.1, < 4.5.10 |
| CVE-2026-27468 | 8.2 | Feb 24 | Mastodon may allow unconfirmed FASP to make subscriptions Affected: >= 4.4.0, < 4.4.14; >= 4.5.0, < 4.5.7 |
| CVE-2026-72915 | 7.5 | Aug 10 | Mastodon: Personally-identifying information disclosure due to incorrect access control validation Affected: >= 4.6.0-beta.1, < 4.6.4 |
| CVE-2026-72914 | 7.5 | Aug 10 | Mastodon: Exhausting data by an unauthenticated request to the admin retention API Affected: < 4.4.21; >= 4.5.0-beta.1, < 4.5.14; >= 4.6.0-beta.1, < 4.6.4 |
| CVE-2026-50129 | 7.5 | Jun 24 | Mastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH_TRANSFORMER Affected: >= 4.5.0-beta.1, < 4.5.11; >= 4.4.0-beta.1, < 4.4.18; < 4.3.24 |
| CVE-2026-47777 | 7.5 | Jun 15 | Mastodon has a consent-check bypass in its remote Collections Affected: >= nightly.2026-03-10, < 4.6.0-beta.1 |
| CVE-2026-41259 | 7.5 | Apr 23 | Mastodon: Insufficient verification of email addresses Affected: < 4.3.22; >= 4.4.0-beta.1, < 4.4.16; >= 4.5.0-beta.1, < 4.5.9 |
| CVE-2026-23962 | 7.5 | Jan 22 | Mastodon vulnerable to Denial of Service from a single post (client/server) Affected: < 4.3.18; >= 4.4.0, < 4.4.12; >= 4.5.0, < 4.5.5 |
| CVE-2026-22245 | 7.5 | Jan 8 | Mastodon has SSRF Protection bypass Affected: < 4.2.29; >= 4.3.0-beta.1, < 4.3.17; >= 4.4.0-beta.1, < 4.4.11; >= 4.5.0-beta.1, < 4.5.4 |
| CVE-2026-59825 | 7.4 | Aug 18 | Mastodon: Unwanted deactivation of SSL/TLS certificate verification Affected: < 4.4.19; >= 4.5.0, < 4.5.12 |
Showing 11