Joinmastodon
Joinmastodon Mastodon: vulnerabilidades y CVE
Joinmastodon Mastodon tiene 54 vulnerabilidades publicadas, 29 de ellas en los últimos 12 meses. 5 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE54
Últimos 12 meses29
Críticas5
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-78380 | Alta (8.7) | 0.45% | — | 24 ago 2026 | RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels. The post-processing logic checks whether an individual… |
| CVE-2026-59825 | Alta (7.4) | 0.37% | — | 18 ago 2026 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldap_authenticable.rb mutates… |
| CVE-2026-72916 | Media (6.3) | 0.59% | — | 10 ago 2026 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.private_address? in app/lib/private_address_check.rb normalized… |
| CVE-2026-72915 | Alta (7.5) | 0.48% | — | 10 ago 2026 | Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in… |
| CVE-2026-72914 | Alta (7.5) | 0.83% | — | 10 ago 2026 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and… |
| CVE-2026-50129 | Alta (7.5) | 0.46% | — | 24 jun 2026 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.11, 4.4.18, and 4.3.24, a DoS can be triggered by (Uncaught Exception vulerability), due to missing exception handling in the math… |
| CVE-2026-50128 | Media (5.3) | 0.18% | — | 24 jun 2026 | Mastodon is a free, open-source social network server based on ActivityPub. From 4.3.0 until 4.5.11 and 4.4.18, Mastodon has a feature to let websites credit authors of their articles. To prevent false attribution… |
| CVE-2026-48028 | Media (6.5) | 0.18% | — | 24 jun 2026 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, Mastodon's normalization of incoming activities signed with Linked-Data Signatures does not sufficiently… |
| CVE-2026-47389 | Alta (8.6) | 0.39% | — | 24 jun 2026 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, when using Ruby versions older than 3.4, PrivateAddressCheck.private_address? returns false for… |
| CVE-2026-46349 | Media (5.3) | 0.19% | — | 24 jun 2026 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, Mastodon's normalization of incoming activities signed with Linked-Data Signatures does not sufficiently… |
| CVE-2026-46348 | Alta (8.7) | 0.41% | — | 24 jun 2026 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, the list of disallowed IP address ranges was lacking an IP address range that can be used to reach local… |
| CVE-2026-47777 | Alta (7.5) | 0.22% | — | 15 jun 2026 | Mastodon is a free, open-source social network server based on ActivityPub. In versions there is a missing condition in the check if remote accounts consented to be featured in a remote Collection could lead to… |
| CVE-2026-41259 | Alta (8.2) | 0.37% | — | 23 abr 2026 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to v4.5.9, v4.4.16, and v4.3.22, Mastodon allows restricting new user sign-up based on e-mail domain names, and performs basic validation… |
| CVE-2026-33869 | Media (4.8) | 0.27% | — | 27 mar 2026 | Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.5.x branch prior to 4.5.8 and on the 4.4.x branch prior to 4.4.15, an attacker that knows of a quote before it has reached… |
| CVE-2026-33868 | Media (6.1) | 0.55% | — | 27 mar 2026 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redirect vulnerability (CWE-601) exists in the `/web/*` route due to… |
| CVE-2026-27477 | Media (4.6) | 0.36% | — | 24 feb 2026 | Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versions 4.4.0 through 4.4.13 and 4.5.0 through 4.5.6, an unauthenticated… |
| CVE-2026-27468 | Media (4.8) | 0.43% | — | 24 feb 2026 | Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versions 4.4.0 through 4.4.13 and 4.5.0 through 4.5.6, actions performed by… |
| CVE-2026-25540 | Media (6.5) | 0.42% | — | 4 feb 2026 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.3.19, 4.4.13, 4.5.6, Mastodon is vulnerable to web cache poisoning via `Rails.cache. When AUTHORIZED_FETCH is enabled, the… |
| CVE-2026-23964 | Media (5.4) | 0.23% | — | 22 ene 2026 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, an insecure direct object reference in the web push subscription update endpoint lets any… |
| CVE-2026-23963 | Media (6.5) | 0.34% | — | 22 ene 2026 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, the server does not enforce a maximum length for the names of lists or filters, or for filter… |
| CVE-2026-23962 | Alta (7.5) | 0.55% | — | 22 ene 2026 | Mastodon is a free, open-source social network server based on ActivityPub. Mastodon versions before v4.3.18, v4.4.12, and v4.5.5 do not have a limit on the maximum number of poll options for remote posts, allowing… |
| CVE-2026-23961 | Media (5.3) | 0.45% | — | 22 ene 2026 | Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows server administrators to suspend remote users to prevent interactions. However, some logic errors allow already-known posts… |
| CVE-2026-22246 | Media (4.3) | 0.26% | — | 8 ene 2026 | Mastodon is a free, open-source social network server based on ActivityPub. Mastodon 4.3 added notifications of severed relationships, allowing end-users to inspect the relationships they lost as the result of a… |
| CVE-2026-22245 | Alta (7.1) | 0.28% | — | 8 ene 2026 | Mastodon is a free, open-source social network server based on ActivityPub. By nature, Mastodon performs a lot of outbound requests to user-provided domains. Mastodon, however, has some protection mechanism to disallow… |
| CVE-2025-67500 | Baja (3.7) | 0.22% | — | 10 dic 2025 | Mastodon is a free, open-source social network server based on ActivityPub. Versions 4.2.27 and prior, 4.3.0-beta.1 through 4.3.14, 4.4.0-beta.1 through 4.4.9, 4.5.0-beta.1 through 4.5.2 have discrepancies in error… |
| CVE-2025-62605 | Media (4.3) | 0.29% | — | 21 oct 2025 | Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon version 4.4, support for verifiable quote posts with quote controls was added, but it is possible for an attacker to bypass these… |
| CVE-2025-62176 | Media (4.3) | 0.27% | — | 13 oct 2025 | Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon before 4.4.6, 4.3.14, and 4.2.27, the streaming server accepts serving events for public timelines to clients using any valid… |
| CVE-2025-62175 | Media (4.3) | 0.23% | — | 13 oct 2025 | Mastodon is a free, open-source social network server based on ActivityPub. In versions before 4.4.6, 4.3.14, and 4.2.27, disabling or suspending a user account does not disconnect the account from the streaming API.… |
| CVE-2025-62174 | Baja (3.5) | 0.21% | — | 13 oct 2025 | Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon before 4.4.6, 4.3.14, and 4.2.27, when an administrator resets a user account's password via the command-line interface using… |
| CVE-2025-54879 | Alta (7.5) | 0.54% | — | 6 ago 2025 | Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versions 3.1.5 through 4.2.24, 4.3.0 through 4.3.11 and 4.4.0 through… |