Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2975▼ 108 respecto a la semana anterior

Críticas / altas1449▲ 87 respecto a la semana anterior

Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)350▼ 160 respecto a la semana anterior

57 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2022-46405	Modificada	Alta (7.5)	0.98%	—	Joinmastodon Mastodon	4/12/2022	17/6/2026	Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attacker-controlled accounts on certain other servers associated with a wildcard DNS A record, such that there is uncontrolled recursion of attacker-generated messages.
CVE-2022-2166	Modificada	Crítica (9.8)	1.1%	—	Joinmastodon Mastodon	16/11/2022	17/6/2026	Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0.
CVE-2022-31263	Modificada	Media (5.3)	0.87%	—	Joinmastodon Mastodon	24/5/2022	17/6/2026	app/models/user.rb in Mastodon before 3.5.0 allows a bypass of e-mail restrictions.
CVE-2022-24307	Modificada	Crítica (9.8)	1.4%	—	Joinmastodon Mastodon	3/2/2022	17/6/2026	Mastodon before 3.3.2 and 3.4.x before 3.4.6 has incorrect access control because it does not compact incoming signed JSON-LD activities. (JSON-LD signing has been supported since version 1.6.0.)
CVE-2022-0432	Modificada	Media (6.1)	4.4%	💥 Exploit	Joinmastodon Mastodon	2/2/2022	17/6/2026	Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0.
CVE-2018-21018	Modificada	Crítica (9.8)	2.6%	—	Joinmastodon Mastodon	22/9/2019	17/6/2026	Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions.
CVE-2019-5961	Modificada	Alta (7.4)	0.64%	—	Mastodon-tootdon Tootdon FOR Mastodon	5/7/2019	17/6/2026	The Android App 'Tootdon for Mastodon' version 3.4.1 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.