1216 matches found
CVE-2026-33869
Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.5.x branch prior to 4.5.8 and on the 4.4.x branch prior to 4.4.15, an attacker that knows of a quote before it has reached a server can prevent it from being correctly processed on that server. The...
EUVD-2026-16785
Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.5.x branch prior to 4.5.8 and on the 4.4.x branch prior to 4.4.15, an attacker that knows of a quote before it has reached a server can prevent it from being correctly processed on that server. The...
CVE-2026-33869
Mastodon vulnerability CVE-2026-33869 affects the 4.5.x branch (before 4.5.8) and the 4.4.x branch (before 4.4.15). An attacker who knows of a quote before it reaches a server can cause the server to misprocess it, resulting in a denial of service for quote authorization. The issue does not affec...
CVE-2026-33869 Mastodon has a denial of service for quote authorization
Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.5.x branch prior to 4.5.8 and on the 4.4.x branch prior to 4.4.15, an attacker that knows of a quote before it has reached a server can prevent it from being correctly processed on that server. The...
CVE-2026-33869 Mastodon has a denial of service for quote authorization
Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.5.x branch prior to 4.5.8 and on the 4.4.x branch prior to 4.4.15, an attacker that knows of a quote before it has reached a server can prevent it from being correctly processed on that server. The...
CVE-2026-33869 Mastodon has a denial of service for quote authorization
Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.5.x branch prior to 4.5.8 and on the 4.4.x branch prior to 4.4.15, an attacker that knows of a quote before it has reached a server can prevent it from being correctly processed on that server. The...
CVE-2026-33868 Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>'
Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redirect vulnerability CWE-601 exists in the /web/ route due to improper handling of URL-encoded path segments. An attacker can craft a specially encode...
CVE-2026-33868
Mastodon is affected by an unauthenticated Open Redirect (CWE-601) in the /web/* route prior to versions 4.5.8, 4.4.15, and 4.3.21. The root cause is improper handling of URL-encoded path segments, where encoded slashes (%2F) bypass Rails path normalization and are treated as host-relative redire...
CVE-2026-33868 Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>'
Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redirect vulnerability CWE-601 exists in the /web/ route due to improper handling of URL-encoded path segments. An attacker can craft a specially encode...
CVE-2026-33868
Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redirect vulnerability CWE-601 exists in the /web/ route due to improper handling of URL-encoded path segments. An attacker can craft a specially encode...
CVE-2026-33868 Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>'
Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redirect vulnerability CWE-601 exists in the /web/ route due to improper handling of URL-encoded path segments. An attacker can craft a specially encode...
EUVD-2026-16783
Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redirect vulnerability CWE-601 exists in the /web/ route due to improper handling of URL-encoded path segments. An attacker can craft a specially encode...
Mastodon 输入验证错误漏洞
Mastodon is an open-source social networking server based on ActivityPub, developed by Mastodon. Versions of Mastodon prior to 4.5.8, 4.4.15, and 4.3.21 contained a vulnerability related to input validation errors. This vulnerability stemmed from improper handling of URL-encoded path segments in...
PT-2026-28542
Name of the Vulnerable Software and Affected Versions Mastodon versions 4.5.0 through 4.5.7 Mastodon versions 4.4.0 through 4.4.14 Description Mastodon is a free, open-source social network server based on ActivityPub. An attacker who is aware of a quote before it has reached a server can prevent...
Mastodon 安全漏洞
Mastodon is an open-source social networking server based on ActivityPub, developed by Mastodon. There are security vulnerabilities in versions prior to Mastodon 4.5.8, specifically the 4.5.x branch, and versions prior to Mastodon 4.4.15, specifically the 4.4.x branch. These vulnerabilities stem...
CVE-2026-33871
creationtimestamp| type| source ---|---|--- 2026-03-25 00:33:44+00:00| seen| https://mastodon.social/users/chrisvest/statuses/116287001142669958 2026-03-27 21:23:14+00:00| published-proof-of-concept| Telegram/B1-lnNSHplGL4tzlck3EB0WXwjfJllp4cXItiyc0oKB0vU 2026-03-30 21:00:17+00:00| seen|...
PT-2026-28106
Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.5.8 Mastodon versions prior to 4.4.15 Mastodon versions prior to 4.3.21 Description Mastodon, a free and open-source social network server based on ActivityPub, contains an unauthenticated Open Redirect issue in th...
CVE-2026-28217
creationtimestamp| type| source ---|---|--- 2026-03-23 15:20:38+00:00| seen| https://mastodon.social/ap/users/115426718704364579/statuses/116279164131270309 2026-03-23 15:20:54+00:00| seen| https://bsky.app/profile/netsecio.bsky.social/post/3mhqeeeduqr2w...
CVE-2026-32055
creationtimestamp| type| source ---|---|--- 2026-03-21 15:51:03+00:00| seen| https://mastodon.social/users/RedPacketSecurity/statuses/116267958250661954 2026-03-21 21:00:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhlwginb7e26 2026-03-22 03:00:05+00:00| seen|...