CVE-2026-23961 Mastodon may allow a remote suspension bypass

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows server administrators to suspend remote users to prevent interactions. However, some logic errors allow already-known posts from such suspended users to appear in timelines if boosted. Furthermore, under...

CVE-2026-23961

Summary of CVE-2026-23961 (Mastodon): A logic flaw in how suspended remote users are handled allows old posts from those users to appear in timelines, and under some circumstances, newly created posts from suspended users can be processed and surfaced. Affected releases span multiple lines: v4.5....

CVE-2026-23961

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows server administrators to suspend remote users to prevent interactions. However, some logic errors allow already-known posts from such suspended users to appear in timelines if boosted. Furthermore, under...

CVE-2026-23961 Mastodon may allow a remote suspension bypass

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows server administrators to suspend remote users to prevent interactions. However, some logic errors allow already-known posts from such suspended users to appear in timelines if boosted. Furthermore, under...

CVE-2026-23961 Mastodon may allow a remote suspension bypass

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows server administrators to suspend remote users to prevent interactions. However, some logic errors allow already-known posts from such suspended users to appear in timelines if boosted. Furthermore, under...

CVE-2026-23737

creationtimestamp| type| source ---|---|--- 2026-01-22 00:00:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mcxuwndae222 2026-01-22 01:38:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcy2gsutwl2m 2026-05-14 18:10:29+00:00| seen|...

WordPress plugin flexo-posts-manager has cross-site scripting vulnerabilities

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

CVE-2025-52762: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in flexostudio flexo-posts-manager flexo-posts-manager allows Reflected XSS.This issue affects flexo-posts-manager: from n/a through = 1.0001...

PT-2026-4194

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RealMag777 TableOn posts-table-filterable allows Reflected XSS.This issue affects TableOn: from n/a through = 1.0.4.2...

WordPress plugin Carousel Horizontal Posts Content Slider has a cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

PT-2026-3898

Name of the Vulnerable Software and Affected Versions Mastodon versions 4.2.26 through 4.2.29 Mastodon versions 4.3.13 through 4.3.17 Mastodon versions 4.4.5 through 4.4.11 Mastodon versions 4.5.0 through 4.5.4 Description Mastodon is a social network server that allows administrators to suspend...

CVE-2026-22347: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in subhansanjaya Carousel Horizontal Posts Content Slider carousel-horizontal-posts-content-slider allows DOM-Based XSS.This issue affects Carousel Horizontal Posts Content Slider: from n/a through =...

PT-2026-4205

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in subhansanjaya Carousel Horizontal Posts Content Slider carousel-horizontal-posts-content-slider allows DOM-Based XSS.This issue affects Carousel Horizontal Posts Content Slider: from n/a through =...

Mastodon security vulnerabilities

Mastodon is an open-source social networking server based on ActivityPub. Mastodon has a security vulnerability, which stems from a logical error that allows old posts of suspended users to appear on the timeline. In certain versions, this suspension mechanism may be partially bypassed...

PT-2026-3985

Name of the Vulnerable Software and Affected Versions flexostudio flexo-posts-manager versions through 1.0001 Description The software contains a flaw due to improper handling of user-supplied data when creating web pages, which can lead to Reflected Cross-site Scripting XSS. This allows an...

CVE-2025-69316: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RealMag777 TableOn posts-table-filterable allows Reflected XSS.This issue affects TableOn: from n/a through = 1.0.4.2...

CVE-2026-21983

creationtimestamp| type| source ---|---|--- 2026-01-20 22:38:06+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mcv7v2gw4k2r 2026-01-20 23:06:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcvbipbrv72h 2026-01-21 07:50:48+00:00| seen|...

CVE-2026-21990

creationtimestamp| type| source ---|---|--- 2026-01-20 22:37:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mcv7unba2t22 2026-01-20 23:08:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcvblox7dk2t 2026-01-21 07:48:22+00:00| seen|...

CVE-2026-21989

creationtimestamp| type| source ---|---|--- 2026-01-20 22:29:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mcv7g74j2h2g 2026-01-20 22:30:20+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mcv7h5smsu27 2026-01-20 22:31:18+00:00| seen|...

CVE-2026-21987

creationtimestamp| type| source ---|---|--- 2026-01-20 22:29:33+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mcv7fqjxbn2g 2026-01-20 22:30:04+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mcv7gnxgcx2g 2026-01-20 23:10:26+00:00| seen|...