Browse CVEs

HIGH 7.5 CVE-2026-41259 Mastodon is a free, open-source social network server based on ActivityPub. Prior to v4.5.9, v4.4.16, and v4.3.22, Mastodon allows restricting new us… Mastodon 4.3.22 / 4.4.16+ Fix from $1,9502026-04-23 MEDIUM 6.1 CVE-2026-33868 Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redi… Mastodon 4.3.21 / 4.4.15+ Fix from $1,6002026-03-27 MEDIUM 5.9 CVE-2026-27477 Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versio… Mastodon 4.4.14 / 4.5.7+ Fix from $1,6002026-02-24 HIGH 8.2 CVE-2026-27468 Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versio… Mastodon 4.4.14 / 4.5.7+ Fix from $1,9502026-02-24 MEDIUM 6.5 CVE-2026-25540 Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.3.19, 4.4.13, 4.5.6, Mastodon is vulnerable to web ca… Mastodon 4.3.19 / 4.4.13+ Fix from $1,6002026-02-04 HIGH 7.5 CVE-2026-23962 Mastodon is a free, open-source social network server based on ActivityPub. Mastodon versions before v4.3.18, v4.4.12, and v4.5.5 do not have a limit… Mastodon 4.3.18 / 4.4.12+ Fix from $1,9502026-01-22 MEDIUM 6.5 CVE-2026-23963 Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, the server does not enforce … Mastodon 4.3.18 / 4.4.12+ Fix from $1,6002026-01-22 MEDIUM 5.4 CVE-2026-23964 Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, an insecure direct object re… Mastodon 4.3.18 / 4.4.12+ Fix from $1,6002026-01-22 MEDIUM 5.3 CVE-2026-23961 Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows server administrators to suspend remote users to prevent … Mastodon 4.3.18 / 4.4.12+ Fix from $1,6002026-01-22 HIGH 7.5 CVE-2026-22245 Mastodon is a free, open-source social network server based on ActivityPub. By nature, Mastodon performs a lot of outbound requests to user-provided … Mastodon 4.2.29 / 4.3.17+ Fix from $1,9502026-01-08 HIGH 7.5 CVE-2025-54879 Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versi… Mastodon 4.2.24 / 4.3.11+ Fix from $1,9502025-08-06 MEDIUM 5.3 CVE-2025-27399 Mastodon is a self-hosted, federated microblogging platform. In versions prior to 4.1.23, 4.2.16, and 4.3.4, when the visibility for domain blocks/re… Mastodon 4.1.23 / 4.2.16+ Fix from $1,6002025-02-27 MEDIUM 5.3 CVE-2025-27157 Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are mi… Mastodon 4.2.16 / 4.3.4+ Fix from $1,6002025-02-27 HIGH 7.5 CVE-2023-49952 Mastodon 4.1.x before 4.1.17 and 4.2.x before 4.2.9 allows a bypass of rate limiting via a crafted HTTP request header. Mastodon 4.1.17 / 4.2.9+ Fix from $1,9502024-11-18 MEDIUM 5.9 CVE-2024-34535 In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header. Mastodon after 4.2.8 Fix from $1,6002024-10-03 HIGH 8.2 CVE-2024-37903 Mastodon is a self-hosted, federated microblogging platform. Starting in version 2.6.0 and prior to versions 4.1.18 and 4.2.10, by crafting specific … Mastodon 4.1.18 / 4.2.10+ Fix from $1,9502024-07-05 HIGH 7.7 CVE-2024-25623 Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.2.7, 4.1.15, 4.0.15, and 3.5.19, when fetching remote… Mastodon 3.5.19 / 4.0.15+ Fix from $1,9502024-02-19 HIGH 7.4 CVE-2024-25618 Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows new identities from configured authentication providers (… Mastodon 3.5.18 / 4.0.14+ Fix from $1,9502024-02-14 CRITICAL 9.8 CVE-2024-23832 Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insuffici… Mastodon 3.5.17 / 4.0.13+ Fix from $2,3002024-02-01 HIGH 7.5 CVE-2023-42451 Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain cir… Mastodon 3.5.14 / 4.0.10+ Fix from $1,9502023-09-19 MEDIUM 5.4 CVE-2023-42452 Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.x branch prior to versions 4.0.10, 4.2.8, and 4.2.0-… Mastodon 4.0.10 / 4.1.8+ Fix from $1,6002023-09-19 HIGH 7.5 CVE-2023-42450 Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafti… Mastodon Patch available Fix from $1,9502023-09-19 MEDIUM 5.4 CVE-2023-36462 Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 2.6.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, … Mastodon 3.5.9 / 4.0.5+ Fix from $1,6002023-07-06 CRITICAL 9.9 CVE-2023-36460EPSS 40% Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 3.5.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, … Mastodon 3.5.9 / 4.0.5+ Fix from $2,3002023-07-06 HIGH 7.5 CVE-2023-36461 Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individ… Mastodon 3.5.9 / 4.0.5+ Fix from $1,9502023-07-06 MEDIUM 6.1 CVE-2023-36459 Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 1.3 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an… Mastodon 3.5.9 / 4.0.5+ Fix from $1,6002023-07-06 MEDIUM 6.5 CVE-2023-28853 Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Starting in vers… Mastodon 3.5.8 / 4.0.4+ Fix from $1,6002023-04-04 HIGH 7.5 CVE-2022-46405 Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attacker-control… Mastodon after 4.0.2 Fix from $1,9502022-12-04 CRITICAL 9.8 CVE-2022-2166 Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0. Mastodon after 3.5.5 Fix from $2,3002022-11-16 MEDIUM 5.3 CVE-2022-31263 app/models/user.rb in Mastodon before 3.5.0 allows a bypass of e-mail restrictions. Mastodon 3.5.0+ Fix from $1,6002022-05-24