REC2

:shipit: Information: REC2 is an old personal project early 2023 that I didn't continue development on. It's part of a list of projects that helped me to learn Rust. The code is probably considered obsolete and not in its best form. Maybe I'll pick up where I left off roadmap. However, REC2 is...

Mastodon Prototype Pollution Vulnerability

The GitHub repository mastodon/mastodon prior to 3.5.0 contains a Prototype Pollution vulnerability. id: CVE-2022-0432 info: name: Mastodon Prototype Pollution Vulnerability author: pikpikcu severity: medium description: The GitHub repository mastodon/mastodon prior to 3.5.0 contains a Prototype...

Mastodon - Open Redirect

Mastodon version 4.5.8, 4.4.15, 4.3.21 is vulnerable to unauthenticated Open Redirect vulnerability CWE-601 exists in the /web/ route due to improper handling of URL-encoded path segments. id: CVE-2026-33868 info: name: Mastodon - Open Redirect author: theamanrawat severity: medium description: |...

CVE-2026-Mastodon-Streaming-CRLF-Injection

CVE-2026-XXXXX: HTTP Response Header Injection CRLF in Mastodon Streaming Server Vulnerability Overview Item| Details ---|--- CVE ID| CVE-2026-XXXXX Affected Product| Mastodon Streaming Server Affected Version| $key: $headerskey.join' ' ; Impact HTTP Header Injection: Inject ar...

cve-2026-47777

CVE-2026-47777 — Mastodon Featured Collections Authorization Bypass Overview I responsibly disclosed a High Severity Authorization Bypass vulnerability affecting Mastodon's experimental Featured Collections federation pipeline. CVE ID: CVE-2026-47777 Affected Component...

CVE-2026-121431 AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connectors

AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks permission to bypass the UserUrlFilter guard via the Mastodon, Telegram, GroupMe, and RadioReg connectors. Attackers can set instanceurl, api, or webhookurl to internal addresses a...

CVE-2026-121431

AzuraCast versions before 0.24.0 are vulnerable to a Server-Side Request Forgery (SSRF) flaw. Station users with WebHooks permission can bypass the UserUrlFilter guard using the Mastodon, Telegram, GroupMe, and RadioReg connectors. By setting the instance_url, api, or webhookurl parameters to int...

CVE-2026-121431 AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connectors

AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks permission to bypass the UserUrlFilter guard via the Mastodon, Telegram, GroupMe, and RadioReg connectors. Attackers can set instanceurl, api, or webhookurl to internal addresses a...

CVE-2026-121431: AzuraCast: AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks…

AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks permission to bypass the UserUrlFilter guard via the Mastodon, Telegram, GroupMe, and RadioReg connectors. Attackers can set instanceurl, api, or webhookurl to internal addresses a...

GHSA-288H-6J8H-6X5J

creationtimestamp| type| source ---|---|--- 2026-10-29 14:03:45+00:00| patched| https://github.com/mastodon/mastodon/releases/tag/v4.7.4 2026-10-29 14:19:12+00:00| seen| https://mastodon.social/@mastohost/117524579768481474 2026-10-29 16:22:18+00:00| seen|...

CVE-2026-19499

creationtimestamp| type| source ---|---|--- 2026-09-22 03:30:19+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mw3by7e4sb2v 2026-09-22 03:30:34+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117312574673426259...

CVE-2026-62279

creationtimestamp| type| source ---|---|--- 2026-09-22 03:20:03+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mw3bfuhp5g2v 2026-09-22 03:20:07+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117312533494084443...

CVE-2026-93749

creationtimestamp| type| source ---|---|--- 2026-09-21 18:40:20+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117310489382248119 2026-10-07 01:36:27+00:00| seen| https://gist.github.com/konard/bebbc5fc62efb1399dd316f25ce3fd00...

CVE-2026-25687

creationtimestamp| type| source ---|---|--- 2026-09-21 13:50:22+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mvzu5zfxwm2m 2026-09-21 14:10:10+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117309426986253732...

CVE-2026-94015

creationtimestamp| type| source ---|---|--- 2026-09-21 11:03:07+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117308691969531824 2026-11-01 04:10:18+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mz7wukcvuy2p 2026-11-01 04:10:20+00:00| seen|...

CVE-2026-80984

creationtimestamp| type| source ---|---|--- 2026-09-20 18:10:05+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117304708418428139 2026-09-20 18:30:03+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mvxtd7png22g 2026-10-01 18:00:00+00:00| seen|...

CVE-2026-80987

creationtimestamp| type| source ---|---|--- 2026-09-20 16:40:17+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117304355465594909 2026-09-20 16:50:04+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mvxnqfhj7n27 2026-10-01 18:00:00+00:00| seen|...

CVE-2026-80968

creationtimestamp| type| source ---|---|--- 2026-09-20 15:00:04+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mvxhlowjpc2o 2026-09-20 15:00:08+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117303961377350404 2026-10-01 18:00:00+00:00| seen|...

CVE-2026-80994

creationtimestamp| type| source ---|---|--- 2026-09-20 13:30:03+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mvxckrps3w2l 2026-09-20 13:30:07+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117303607472673974 2026-10-01 18:00:00+00:00| seen|...

CVE-2026-81916

creationtimestamp| type| source ---|---|--- 2026-09-20 11:50:03+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mvx4xxx7vv2g 2026-09-20 11:50:04+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117303214274287511...