@bitsocial/ai-moderation-challenge (>=0.1.0, <=0.1.1), @bitsocial/bitsocial-cli (>=0.19.44, <=0.19.72) +6 more potentially affected by CVE-2026-46679 via @libp2p/gossipsub (>=15.0.0-049bfa0fa, <=15.0.22-5692f3f16)

@libp2p/gossipsub NPM version =15.0.0-049bfa0fa, =0.1.0, =0.19.44, =0.1.0, =0.1.0, =0.1.0, =6.0.0-049bfa0fa, =9.0.0-049bfa0fa, =0.0.17, =0.0.47 Source cves: CVE-2026-46679 Source advisory: OSV:GHSA-4F8R-922H-2VGV...

CVE-2025-52883

Meshtastic-Android is an Android application for the mesh radio software Meshtastic. Prior to version 2.5.21, an attacker is able to send an unencrypted direct message to a victim impersonating any other node of the mesh. This message will be displayed in the same chat that the victim normally...

CVE-2025-52883 Meshtastic-Android vulnerable to forged DMs with no PKC showing up as encrypted

Meshtastic-Android is an Android application for the mesh radio software Meshtastic. Prior to version 2.5.21, an attacker is able to send an unencrypted direct message to a victim impersonating any other node of the mesh. This message will be displayed in the same chat that the victim normally...

CVE-2025-52883 Meshtastic-Android vulnerable to forged DMs with no PKC showing up as encrypted

Meshtastic-Android is an Android application for the mesh radio software Meshtastic. Prior to version 2.5.21, an attacker is able to send an unencrypted direct message to a victim impersonating any other node of the mesh. This message will be displayed in the same chat that the victim normally...

PT-2025-26783 · Unknown · Meshtastic-Android

Name of the Vulnerable Software and Affected Versions: Meshtastic-Android versions prior to 2.5.21 Description: The issue allows an attacker to send an unencrypted direct message to a victim, impersonating any other node of the mesh. This message will be displayed in the same chat that the victim...

CVE-2025-21608: Exposure of Resource to Wrong Sphere

Meshtastic is an open source mesh networking solution. In affected firmware versions crafted packets over MQTT are able to appear as a DM in client to a node even though they were not decoded with PKC. This issue has been addressed in version 2.5.19 and all users are advised to upgrade. There are...