MA
Vendor
mastodon
29
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-59825 | MA mastodon mastodon | 7.4 | Aug 18 | Mastodon: Unwanted deactivation of SSL/TLS certificate verification |
| CVE-2026-72916 | MA mastodon mastodon | 6.3 | Aug 10 | Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses |
| CVE-2026-72915 | MA mastodon mastodon | 7.5 | Aug 10 | Mastodon: Personally-identifying information disclosure due to incorrect access control validation |
| CVE-2026-72914 | MA mastodon mastodon | 7.5 | Aug 10 | Mastodon: Exhausting data by an unauthenticated request to the admin retention API |
| CVE-2026-50129 | MA mastodon mastodon | 7.5 | Jun 24 | Mastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH_TRANSFORMER |
| CVE-2026-50128 | MA mastodon mastodon | 5.3 | Jun 24 | Mastodon: Spoofing of attribution domains |
| CVE-2026-48028 | MA mastodon mastodon | 6.5 | Jun 24 | Mastodon: Removal of integrity-protected JSON entries from signed activities |
| CVE-2026-47389 | MA mastodon mastodon | 8.6 | Jun 24 | Mastodon: SSRF protection bypass on older Ruby versions |
| CVE-2026-46349 | MA mastodon mastodon | 5.3 | Jun 24 | Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuring |
| CVE-2026-46348 | MA mastodon mastodon | 8.7 | Jun 24 | Mastodon: SSRF Bypass via IPv6 Unspecified Address (::) |
| CVE-2026-47777 | MA mastodon mastodon | 7.5 | Jun 15 | Mastodon has a consent-check bypass in its remote Collections |
| CVE-2026-41259 | MA mastodon mastodon | 7.5 | Apr 23 | Mastodon: Insufficient verification of email addresses |
| CVE-2026-33869 | MA mastodon mastodon | 4.8 | Mar 27 | Mastodon has a denial of service for quote authorization |
| CVE-2026-33868 | MA mastodon mastodon | 6.1 | Mar 27 | Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>' |
| CVE-2026-27477 | MA mastodon mastodon | 5.9 | Feb 24 | Mastodon has SSRF via unvalidated FASP Provider base_url |
| CVE-2026-27468 | MA mastodon mastodon | 8.2 | Feb 24 | Mastodon may allow unconfirmed FASP to make subscriptions |
| CVE-2026-25540 | MA mastodon mastodon | 6.5 | Feb 4 | Mastodon's signature-dependent ActivityPub collection responses cached under signature-independent keys (Web Cache Poisoning via `Rails.cache`) |
| CVE-2026-23964 | MA mastodon mastodon | 5.4 | Jan 22 | Mastodon has insufficient access control to push notification settings |
| CVE-2026-23963 | MA mastodon mastodon | 6.5 | Jan 22 | Mastodon missing length limits on list names, filter names, and filter keywords |
| CVE-2026-23962 | MA mastodon mastodon | 7.5 | Jan 22 | Mastodon vulnerable to Denial of Service from a single post (client/server) |
| CVE-2026-23961 | MA mastodon mastodon | 5.3 | Jan 22 | Mastodon may allow a remote suspension bypass |
| CVE-2026-22246 | MA mastodon mastodon | 4.3 | Jan 8 | Local Mastodon users can enumerate and access severed relationships of every other local user |
| CVE-2026-22245 | MA mastodon mastodon | 7.5 | Jan 8 | Mastodon has SSRF Protection bypass |
| CVE-2025-67500 | MA mastodon mastodon | 3.7 | Dec 9 | Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration |
| CVE-2025-62605 | MA mastodon mastodon | 4.3 | Oct 21 | Mastodon quotes control can be bypassed |
| CVE-2025-62176 | MA mastodon mastodon | 4.3 | Oct 13 | Mastadon streaming server allows OAuth clients without the `read` scope to subscribe to public channels |
| CVE-2025-62175 | MA mastodon mastodon | 4.3 | Oct 13 | Mastodon streaming API fails to disconnect disabled and suspended users |
| CVE-2025-62174 | MA mastodon mastodon | 3.5 | Oct 13 | Mastodon allows continued access after password reset via CLI |
| CVE-2025-54879 | MA mastodon mastodon | 7.5 | Aug 5 | Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails |