Vulnerability index

Browse CVEs

33 matching
Filters 1 Clear all
Severity

Filters apply as you choose them.

Mastodon HIGH 7.5
CVE-2026-41259

Mastodon is a free, open-source social network server based on ActivityPub. Prior to v4.5.9, v4.4.16, and v4.3.22, Mastodon allows restricting new us…

Fix: 4.3.22 / 4.4.16+
Fix from $1,950 2026-04-23
Mastodon MEDIUM 6.1
CVE-2026-33868

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redi…

Fix: 4.3.21 / 4.4.15+
Fix from $1,600 2026-03-27
Mastodon MEDIUM 5.9
CVE-2026-27477

Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versio…

Fix: 4.4.14 / 4.5.7+
Fix from $1,600 2026-02-24
Mastodon HIGH 8.2
CVE-2026-27468

Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versio…

Fix: 4.4.14 / 4.5.7+
Fix from $1,950 2026-02-24
Mastodon MEDIUM 6.5
CVE-2026-25540

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.3.19, 4.4.13, 4.5.6, Mastodon is vulnerable to web ca…

Fix: 4.3.19 / 4.4.13+
Fix from $1,600 2026-02-04
Mastodon HIGH 7.5
CVE-2026-23962

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon versions before v4.3.18, v4.4.12, and v4.5.5 do not have a limit…

Fix: 4.3.18 / 4.4.12+
Fix from $1,950 2026-01-22
Mastodon MEDIUM 6.5
CVE-2026-23963

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, the server does not enforce …

Fix: 4.3.18 / 4.4.12+
Fix from $1,600 2026-01-22
Mastodon MEDIUM 5.4
CVE-2026-23964

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, an insecure direct object re…

Fix: 4.3.18 / 4.4.12+
Fix from $1,600 2026-01-22
Mastodon MEDIUM 5.3
CVE-2026-23961

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows server administrators to suspend remote users to prevent …

Fix: 4.3.18 / 4.4.12+
Fix from $1,600 2026-01-22
Mastodon HIGH 7.5
CVE-2026-22245

Mastodon is a free, open-source social network server based on ActivityPub. By nature, Mastodon performs a lot of outbound requests to user-provided …

Fix: 4.2.29 / 4.3.17+
Fix from $1,950 2026-01-08
Mastodon HIGH 7.5
CVE-2025-54879

Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versi…

Fix: 4.2.24 / 4.3.11+
Fix from $1,950 2025-08-06
Mastodon MEDIUM 5.3
CVE-2025-27399

Mastodon is a self-hosted, federated microblogging platform. In versions prior to 4.1.23, 4.2.16, and 4.3.4, when the visibility for domain blocks/re…

Fix: 4.1.23 / 4.2.16+
Fix from $1,600 2025-02-27
Mastodon MEDIUM 5.3
CVE-2025-27157

Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are mi…

Fix: 4.2.16 / 4.3.4+
Fix from $1,600 2025-02-27
Mastodon HIGH 7.5
CVE-2023-49952

Mastodon 4.1.x before 4.1.17 and 4.2.x before 4.2.9 allows a bypass of rate limiting via a crafted HTTP request header.

Fix: 4.1.17 / 4.2.9+
Fix from $1,950 2024-11-18
Mastodon MEDIUM 5.9
CVE-2024-34535

In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header.

Fix: after 4.2.8
Fix from $1,600 2024-10-03
Mastodon HIGH 8.2
CVE-2024-37903

Mastodon is a self-hosted, federated microblogging platform. Starting in version 2.6.0 and prior to versions 4.1.18 and 4.2.10, by crafting specific …

Fix: 4.1.18 / 4.2.10+
Fix from $1,950 2024-07-05
Mastodon HIGH 7.7
CVE-2024-25623

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.2.7, 4.1.15, 4.0.15, and 3.5.19, when fetching remote…

Fix: 3.5.19 / 4.0.15+
Fix from $1,950 2024-02-19
Mastodon HIGH 7.4
CVE-2024-25618

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows new identities from configured authentication providers (…

Fix: 3.5.18 / 4.0.14+
Fix from $1,950 2024-02-14
Mastodon CRITICAL 9.8
CVE-2024-23832

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insuffici…

Fix: 3.5.17 / 4.0.13+
Fix from $2,300 2024-02-01
Mastodon HIGH 7.5
CVE-2023-42451

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain cir…

Fix: 3.5.14 / 4.0.10+
Fix from $1,950 2023-09-19
Mastodon MEDIUM 5.4
CVE-2023-42452

Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.x branch prior to versions 4.0.10, 4.2.8, and 4.2.0-…

Fix: 4.0.10 / 4.1.8+
Fix from $1,600 2023-09-19
Mastodon HIGH 7.5
CVE-2023-42450

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafti…

Patch available
Fix from $1,950 2023-09-19
Mastodon MEDIUM 5.4
CVE-2023-36462

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 2.6.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, …

Fix: 3.5.9 / 4.0.5+
Fix from $1,600 2023-07-06
Mastodon CRITICAL 9.9
CVE-2023-36460EPSS 40%

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 3.5.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, …

Fix: 3.5.9 / 4.0.5+
Fix from $2,300 2023-07-06
Mastodon HIGH 7.5
CVE-2023-36461

Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individ…

Fix: 3.5.9 / 4.0.5+
Fix from $1,950 2023-07-06
Mastodon MEDIUM 6.1
CVE-2023-36459

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 1.3 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an…

Fix: 3.5.9 / 4.0.5+
Fix from $1,600 2023-07-06
Mastodon MEDIUM 6.5
CVE-2023-28853

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Starting in vers…

Fix: 3.5.8 / 4.0.4+
Fix from $1,600 2023-04-04
Mastodon HIGH 7.5
CVE-2022-46405

Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attacker-control…

Fix: after 4.0.2
Fix from $1,950 2022-12-04
Mastodon CRITICAL 9.8
CVE-2022-2166

Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0.

Fix: after 3.5.5
Fix from $2,300 2022-11-16
Mastodon MEDIUM 5.3
CVE-2022-31263

app/models/user.rb in Mastodon before 3.5.0 allows a bypass of e-mail restrictions.

Fix: 3.5.0+
Fix from $1,600 2022-05-24