CVE-2026-23961

Summary of CVE-2026-23961 (Mastodon): A logic flaw in how suspended remote users are handled allows old posts from those users to appear in timelines, and under some circumstances, newly created posts from suspended users can be processed and surfaced. Affected releases span multiple lines: v4.5....

EUVD-2026-4207

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows server administrators to suspend remote users to prevent interactions. However, some logic errors allow already-known posts from such suspended users to appear in timelines if boosted. Furthermore, under...

CVE-2026-23961 Mastodon may allow a remote suspension bypass

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows server administrators to suspend remote users to prevent interactions. However, some logic errors allow already-known posts from such suspended users to appear in timelines if boosted. Furthermore, under...

CVE-2026-23961 Mastodon may allow a remote suspension bypass

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows server administrators to suspend remote users to prevent interactions. However, some logic errors allow already-known posts from such suspended users to appear in timelines if boosted. Furthermore, under...

CVE-2026-23961: Incorrect Authorization

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows server administrators to suspend remote users to prevent interactions. However, some logic errors allow already-known posts from such suspended users to appear in timelines if boosted. Furthermore, under...

MiracleLinux 8 : thunderbird-128.3.1-1.el8_10.ML.1 (AXSA:2024-8910:25)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2024-8910:25 advisory. firefox: Use-after-free in Animation timeline 128.3.1 ESR Chemspill CVE-2024-9680 Tenable has extracted the preceding description block directly from the...

MiracleLinux 9 : firefox-128.3.1-2.el9_4.ML.1 (AXSA:2024-8908:34)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-8908:34 advisory. firefox: Use-after-free in Animation timeline 128.3.1 ESR Chemspill CVE-2024-9680 Tenable has extracted the preceding description block directly from the...

MiracleLinux 8 : firefox-128.3.1-2.el8_10.ML.1 (AXSA:2024-8909:35)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2024-8909:35 advisory. firefox: Use-after-free in Animation timeline 128.3.1 ESR Chemspill CVE-2024-9680 Tenable has extracted the preceding description block directly from the...

kernel: drm/xe: Make dma-fences compliant with the safe access rules

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Make dma-fences compliant with the safe access rules Xe can free some of the data pointed to by the dma-fences it exports. Most notably the timeline name can get freed if userspace closes the associated submit queue. At t...

CVE-2026-1139

creationtimestamp| type| source ---|---|--- 2026-01-19 06:03:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mcqxtl5vjg2i 2026-01-19 07:09:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcr3ixplwd27...

CVE-2026-1122

creationtimestamp| type| source ---|---|--- 2026-01-18 17:41:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcpoeojkxp27 2026-09-07 04:00:04+00:00| published-proof-of-concept| Telegram/PZ4h1bEYzQUZNpz5jejfcfkAUPMGmF2SrshkVKYlc3YG-0E 2026-09-08 00:01:01+00:00|...

CVE-2026-21913

creationtimestamp| type| source ---|---|--- 2026-01-15 21:38:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcik775ncy2r 2026-01-15 21:54:34+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mcil4m2oe427 2026-01-15 22:04:35+00:00| seen|...

CVE-2025-68963

creationtimestamp| type| source ---|---|--- 2026-01-14 06:17:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcegba7rfx22...

CVE-2026-22197

creationtimestamp| type| source ---|---|--- 2026-01-09 18:06:54+00:00| seen| Telegram/QBOT-ryT9AKKcs7tiHBGvSbmUQX4gh4t9NvXKSyVLhBs9Ow 2026-01-09 18:07:20+00:00| seen| Telegram/Hw4Ptod4yStxpdgZUBcwLetgue-V1sfi-Dn2jRcWldNc0 2026-01-09 19:14:15+00:00| seen|...

CVE-2023-49926

app/Lib/Tools/EventTimelineTool.php in MISP before 2.4.179 allows XSS in the event timeline widget...

CVE-2023-49755

Missing Authorization vulnerability in B.M. Rafiul Alam Elementor Timeline Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Timeline Widget: from n/a through 2.2...

CVE-2023-45110

Missing Authorization vulnerability in boldthemes Bold Timeline Lite bold-timeline-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bold Timeline Lite: from n/a through = 1.1.9...

CVE-2025-23856

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Odyno Simple Vertical Timeline simple-vertical-timeline allows DOM-Based XSS.This issue affects Simple Vertical Timeline: from n/a through = 0.1...

CVE-2025-13753

creationtimestamp| type| source ---|---|--- 2026-01-09 08:38:42+00:00| seen| https://gist.github.com/Darkcrai86/3dbe28b549df9cbd863de3ab142e06bb 2026-01-09 09:06:32+00:00| seen| https://gist.github.com/Darkcrai86/dc7e7a5b3b7f8fb6c224f0f8aa6baaa8 2026-01-09 09:19:46+00:00| seen|...

CVE-2025-14146

The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 10.14.10 via the WPBCFLEXTIMELINENAV AJAX action. This is due to the nonce verification being conditionally disabled by default bookingisnonceatfrontend option is 'Off' ...