MA
Product
mastodon
29
CVEs
0
On KEV
8.7
Max CVSS
0
New 30D
Severity mix
Critical 0High 12Medium 15Low 2
Watch
Add mastodon to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-48028 | 6.5 | Jun 24 | Mastodon: Removal of integrity-protected JSON entries from signed activities Affected: >= 4.5.0-beta.1, < 4.5.10; >= 4.4.0-beta.1, < 4.4.17; < 4.3.23 |
| CVE-2026-25540 | 6.5 | Feb 4 | Mastodon's signature-dependent ActivityPub collection responses cached under signature-independent keys (Web Cache Poisoning via `Rails.cache`) Affected: < 4.3.19; < 4.4.13; < 4.5.6 |
| CVE-2026-23963 | 6.5 | Jan 22 | Mastodon missing length limits on list names, filter names, and filter keywords Affected: < 4.3.18; >= 4.4.0, < 4.4.12; >= 4.5.0, < 4.5.5 |
| CVE-2026-72916 | 6.3 | Aug 10 | Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses Affected: < 4.4.21; >= 4.5.0-beta.1, < 4.5.14; >= 4.6.0-beta.1, < 4.6.4 |
| CVE-2026-33868 | 6.1 | Mar 27 | Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>' Affected: >= 4.5.0, < 4.5.8; >= 4.4.0, < 4.4.15; < 4.3.21 |
| CVE-2026-27477 | 5.9 | Feb 24 | Mastodon has SSRF via unvalidated FASP Provider base_url Affected: >= 4.4.0, < 4.4.14; >= 4.5.0, < 4.5.7 |
| CVE-2026-23964 | 5.4 | Jan 22 | Mastodon has insufficient access control to push notification settings Affected: < 4.3.18; >= 4.4.0, < 4.4.12; >= 4.5.0, < 4.5.5 |
| CVE-2026-50128 | 5.3 | Jun 24 | Mastodon: Spoofing of attribution domains Affected: >= 4.5.0-beta.1, < 4.5.11; >= 4.3.0, < 4.4.18 |
| CVE-2026-46349 | 5.3 | Jun 24 | Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuring Affected: >= 4.5.0-beta.1, < 4.5.10 |
| CVE-2026-23961 | 5.3 | Jan 22 | Mastodon may allow a remote suspension bypass Affected: < 4.3.18; >= 4.4.0, < 4.4.12; >= 4.5.0, < 4.5.5 |
| CVE-2026-33869 | 4.8 | Mar 27 | Mastodon has a denial of service for quote authorization Affected: >= 4.5.0, < 4.5.8; >= 4.4.0, < 4.4.15 |
| CVE-2026-22246 | 4.3 | Jan 8 | Local Mastodon users can enumerate and access severed relationships of every other local user Affected: < 4.3.17; >= 4.4.0-beta.1, < 4.4.11; >= 4.5.0-beta.1, < 4.5.4 |
| CVE-2025-62605 | 4.3 | Oct 21 | Mastodon quotes control can be bypassed Affected: >= 4.4.0-beta.1, < 4.4.8; = 4.5.0-beta.1 |
| CVE-2025-62176 | 4.3 | Oct 13 | Mastadon streaming server allows OAuth clients without the `read` scope to subscribe to public channels Affected: >= 4.4.0-beta.1, < 4.4.6; >= 4.3.0-beta.1, < 4.3.14; < 4.2.27 |
| CVE-2025-62175 | 4.3 | Oct 13 | Mastodon streaming API fails to disconnect disabled and suspended users Affected: >= 4.4.0-beta.1, < 4.4.6; >= 4.3.0-beta.1, < 4.3.14; < 4.2.27 |
Showing 15