CVE-2023-36461

Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individual read operations. Prior to versions 3.5.9, 4.0.5, and 4.1.3, a malicious server can indefinitely extend the duration of the response through...

CVE-2023-36462

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 2.6.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker can craft a verified profile link using specific formatting to conceal arbitrary parts of the link, enabling it to appear to link to a...

CVE-2023-49952

Mastodon 4.1.x before 4.1.17 and 4.2.x before 4.2.9 allows a bypass of rate limiting via a crafted HTTP request header...

CVE-2023-42452

Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.x branch prior to versions 4.0.10, 4.2.8, and 4.2.0-rc2, under certain conditions, attackers can abuse the translation feature to bypass the server-side HTML sanitization, allowing unescaped HTML to...

CVE-2022-48364

The undomarkstatusesassensitive method in app/services/approveappealservice.rb in Mastodon 3.5.x before 3.5.3 does not use the server's representative account, resulting in moderator identity disclosure when a moderator approves the appeal of a user whose status update was marked as sensitive...

CVE-2022-46405

Mastodon through 4.0.2 allows attackers to cause a denial of service large Sidekiq pull queue by creating bot accounts that follow attacker-controlled accounts on certain other servers associated with a wildcard DNS A record, such that there is uncontrolled recursion of attacker-generated message...

CVE-2022-24307

Mastodon before 3.3.2 and 3.4.x before 3.4.6 has incorrect access control because it does not compact incoming signed JSON-LD activities. JSON-LD signing has been supported since version 1.6.0...

CVE-2025-4575

creationtimestamp| type| source ---|---|--- 2025-05-22 13:43:14+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17265 2025-05-22 14:25:05+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114551940998291137 2025-05-22 15:28:56+00:00| seen|...

CVE-2018-21018

Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions...

BIT-MASTODON-2023-49952

Mastodon 4.1.x before 4.1.17 and 4.2.x before 4.2.9 allows a bypass of rate limiting via a crafted HTTP request header...

BIT-MASTODON-2024-34535

In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header...

CVE-2025-1305

creationtimestamp| type| source ---|---|--- 2025-05-01 05:48:31+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114431001227819569 2025-05-01 05:56:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lo3msl2aeo2r 2025-05-01 07:01:28+00:00| seen|...

CVE-2025-2816

creationtimestamp| type| source ---|---|--- 2025-05-01 03:13:59+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/14215 2025-05-01 03:48:38+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114430529833344469 2025-05-01 05:55:17+00:00| seen|...

CVE-2025-46558

creationtimestamp| type| source ---|---|--- 2025-04-30 19:13:38+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/14127 2025-04-30 19:48:40+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114428642542388304 2025-04-30 20:30:48+00:00| seen|...

CVE-2025-21416

creationtimestamp| type| source ---|---|--- 2025-04-30 17:21:47+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114428064949898924 2025-04-30 17:36:04+00:00| seen| https://bsky.app/profile/cti-news.bsky.social/post/3lo2dgyrzrv2l 2025-04-30 19:48:32+00:00| seen|...

CVE-2025-30390

creationtimestamp| type| source ---|---|--- 2025-04-30 17:21:46+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114428064949898924 2025-04-30 19:48:34+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114428642039876617 2025-04-30 20:30:47+00:00| seen|...

CVE-2025-29906

creationtimestamp| type| source ---|---|--- 2025-04-29 23:48:13+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114423922060759169 2025-04-29 23:50:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnyhw3fwmw24 2025-04-30 01:00:20+00:00| published-proof-of-concept...

CVE-2025-23180

creationtimestamp| type| source ---|---|--- 2025-04-29 17:12:08+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/13873 2025-04-29 17:48:41+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114422508457622087 2025-04-29 19:02:24+00:00| published-proof-of-concept|...

CVE-2025-45953

creationtimestamp| type| source ---|---|--- 2025-04-28 23:45:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnvx5vgw7w2l 2025-04-29 00:06:24+00:00| seen| https://t.me/cvedetector/23949 2025-04-29 14:11:53+00:00| published-proof-of-concept|...

CVE-2025-34491

creationtimestamp| type| source ---|---|--- 2025-04-28 20:11:21+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/13733 2025-04-28 21:49:17+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114417790264877305 2025-04-28 22:25:29+00:00| seen|...