CVE-2026-41259 Mastodon: Insufficient verification of email addresses

Mastodon is a free, open-source social network server based on ActivityPub. Prior to v4.5.9, v4.4.16, and v4.3.22, Mastodon allows restricting new user sign-up based on e-mail domain names, and performs basic validation on e-mail addresses, but fails to restrict characters that are interpreted...

CVE-2026-28217

creationtimestamp| type| source ---|---|--- 2026-03-23 15:20:38+00:00| seen| https://mastodon.social/ap/users/115426718704364579/statuses/116279164131270309 2026-03-23 15:20:54+00:00| seen| https://bsky.app/profile/netsecio.bsky.social/post/3mhqeeeduqr2w...

CVE-2026-12345

creationtimestamp| type| source ---|---|--- 2026-01-26 19:15:04+00:00| seen| https://mastodon.social/ap/users/115426718704364579/statuses/115962996504160664 2026-01-26 19:15:23+00:00| seen| https://bsky.app/profile/netsecio.bsky.social/post/3mddxe3xemk2j 2026-03-13 06:38:31+00:00| seen|...

CVE-2025-33203

creationtimestamp| type| source ---|---|--- 2025-11-26 16:25:11+00:00| seen| https://infosec.exchange/users/AAKL/statuses/115616927159484156 2025-11-26 17:31:15+00:00| seen| https://mastodon.social/ap/users/115426718704364579/statuses/115617187434161563 2025-11-26 17:31:31+00:00| seen|...

EUVD-2025-5448

Malicious code in bioql PyPI...

CVE-2025-2470

creationtimestamp| type| source ---|---|--- 2025-04-25 12:09:52+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/13406 2025-04-25 13:19:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnncroikpk2a 2025-04-25 13:48:43+00:00| seen|...

CVE-2025-3603

creationtimestamp| type| source ---|---|--- 2025-04-24 09:12:09+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/13196 2025-04-24 10:15:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnkhz7tpmw24 2025-04-24 11:48:22+00:00| seen|...

CVE-2025-32662

creationtimestamp| type| source ---|---|--- 2025-04-17 16:48:47+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114354325114753007 2025-04-17 18:24:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmzq3cewni2a...

CVE-2025-3543

creationtimestamp| type| source ---|---|--- 2025-04-14 00:52:20+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/11573 2025-04-14 02:17:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmqiohuvcx2h 2025-04-14 02:48:34+00:00| seen|...

CVE-2025-3161

creationtimestamp| type| source ---|---|--- 2025-04-03 15:50:43+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114274824494198093 2025-04-03 15:50:43+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114274824494198093 2025-04-03 17:48:26+00:00| seen|...

CVE-2024-9847

creationtimestamp| type| source ---|---|--- 2025-03-20 12:48:40+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114194836319420192...

CVE-2025-20146

creationtimestamp| type| source ---|---|--- 2025-03-12 16:41:22+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/7341 2025-03-12 17:48:33+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114150716991392661 2025-03-12 20:23:04+00:00| seen| https://t.me/cvedetector/20154 2025-03-...

CVE-2024-58087

creationtimestamp| type| source ---|---|--- 2025-03-12 07:43:55+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/7288 2025-03-13 17:48:21+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114156378535995607 2025-05-04 11:19:02+00:00| published-proof-of-concept|...

CVE-2025-26534

creationtimestamp| type| source ---|---|--- 2025-03-03 15:48:52+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114099285662621992...

BIT-MASTODON-2025-27157 Mastodon's rate-limits are missing on `/auth/setup`

Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on /auth/setup. Without those rate limits, an attacker can craft requests that will send an email to an arbitrary addresses. Versions 4.2.16 a...

BIT-MASTODON-2025-27399 Mastodon's domain blocks & rationales ignore user approval when visibility set as "users"

Mastodon is a self-hosted, federated microblogging platform. In versions prior to 4.1.23, 4.2.16, and 4.3.4, when the visibility for domain blocks/reasons is set to "users" localized English string: "To logged-in users", users that are not yet approved can view the block reasons. Instance admins...

CVE-2025-1682

creationtimestamp| type| source ---|---|--- 2025-02-28 00:25:55+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/5825 2025-02-28 01:48:41+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114078994918555296 2025-02-28 03:38:46+00:00| seen| https://t.me/cvedetector/19105 2025-03-...

CVE-2025-1687

creationtimestamp| type| source ---|---|--- 2025-02-28 00:25:54+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/5824 2025-02-28 01:48:41+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114078994955411295 2025-02-28 03:38:47+00:00| seen|...

CVE-2024-12811

creationtimestamp| type| source ---|---|--- 2025-02-28 00:25:53+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/5823 2025-02-28 01:48:41+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114078994875616042 2025-02-28 03:38:53+00:00| seen| https://t.me/cvedetector/19111 2025-03-...

CVE-2025-27142

creationtimestamp| type| source ---|---|--- 2025-02-25 20:23:04+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/5375 2025-02-25 23:14:27+00:00| seen| https://t.me/cvedetector/18925 2025-02-28 15:49:14+00:00| seen|...