CVE-2025-67500 Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration

Mastodon is a free, open-source social network server based on ActivityPub. Versions 4.2.27 and prior, 4.3.0-beta.1 through 4.3.14, 4.4.0-beta.1 through 4.4.9, 4.5.0-beta.1 through 4.5.2 have discrepancies in error handling which allow checking whether a given status exists by sending a request...

CVE-2025-67500

CVE-2025-67500 affects Mastodon prior to fixed versions: 4.2.28, 4.3.15, 4.4.10 and 4.5.3. The issue stems from error-handling discrepancies that let an attacker determine whether a private status exists by sending a request with a non-English Accept-Language header; it does not reveal the status...

CVE-2025-67500 Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration

Mastodon is a free, open-source social network server based on ActivityPub. Versions 4.2.27 and prior, 4.3.0-beta.1 through 4.3.14, 4.4.0-beta.1 through 4.4.9, 4.5.0-beta.1 through 4.5.2 have discrepancies in error handling which allow checking whether a given status exists by sending a request...

GHSA-7WFC-4796-GMG5

creationtimestamp| type| source ---|---|--- 2025-12-09 22:20:45+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115691935815250281...

EUVD-2025-202322

Cross Site Request Forgery CSRF vulnerability in AllskyTeam AllSky v2024.12.0606 allows remote attackers to cause a denial of service via function handleinterfacePOSTandstatus...

GHSA-J76J-5P5G-9WFR

creationtimestamp| type| source ---|---|--- 2025-12-09 21:10:54+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115691661138997900...

CVE-2025-65231

Barix Instreamer v04.06 and earlier is vulnerable to Cross Site Scripting XSS in the Web UI I/O & Serial configuration page, specifically the CTS close command user-input field which is stored and later rendered on the Status page...

GHSA-HXJ9-33PP-J2CC

creationtimestamp| type| source ---|---|--- 2025-12-09 19:58:49+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115691377688409077...

CVE-2025-65573

Cross Site Request Forgery CSRF vulnerability in AllskyTeam AllSky v2024.12.0606 allows remote attackers to cause a denial of service via function handleinterfacePOSTandstatus...

CVE-2025-9368

creationtimestamp| type| source ---|---|--- 2025-12-09 19:12:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7lasjo6yw2k...

EUVD-2023-60176

In the Linux kernel, the following vulnerability has been resolved: loop: loopsetstatusfrominfo check before assignment In loopsetstatusfrominfo, lo-looffset and lo-losizelimit should be checked before reassignment, because if an overflow error occurs, the original correct value will be changed t...

CVE-2025-34398

creationtimestamp| type| source ---|---|--- 2025-12-09 18:23:42+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115691003669191782 2025-12-10 08:09:41+00:00| seen| https://gist.github.com/Darkcrai86/ec836b62233128c89d4f715a31fb17ea...

CVE-2025-34397

creationtimestamp| type| source ---|---|--- 2025-12-09 18:23:42+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115691003669191782...

CVE-2025-34408

creationtimestamp| type| source ---|---|--- 2025-12-09 18:23:42+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115691003669191782...

CVE-2025-34399

creationtimestamp| type| source ---|---|--- 2025-12-09 18:23:42+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115691003669191782...

CVE-2025-62557

creationtimestamp| type| source ---|---|--- 2025-12-09 17:29:16+00:00| seen| https://www.thezdi.com/blog/2025/12/9/the-december-2025-security-update-review 2025-12-09 17:40:33+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2025-0384 2025-12-09 18:03:55+00:00| seen|...

CVE-2025-12946

creationtimestamp| type| source ---|---|--- 2025-12-09 17:15:30+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115690735515051582...

CVE-2023-53847

In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Fix uninit-value in alaudacheckmedia Syzbot got KMSAN to complain about access to an uninitialized value in the alauda subdriver of usb-storage: BUG: KMSAN: uninit-value in alaudatransport+0x462/0x57f0...

DEBIAN-CVE-2023-53820

In the Linux kernel, the following vulnerability has been resolved: loop: loopsetstatusfrominfo check before assignment In loopsetstatusfrominfo, lo-looffset and lo-losizelimit should be checked before reassignment, because if an overflow error occurs, the original correct value will be changed t...

CVE-2023-53820

In the Linux kernel, the following vulnerability has been resolved: loop: loopsetstatusfrominfo check before assignment In loopsetstatusfrominfo, lo-looffset and lo-losizelimit should be checked before reassignment, because if an overflow error occurs, the original correct value will be changed t...