EUVD-2026-16783

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redirect vulnerability CWE-601 exists in the /web/ route due to improper handling of URL-encoded path segments. An attacker can craft a specially encode...

Mastodon 输入验证错误漏洞

Mastodon is an open-source social networking server based on ActivityPub, developed by Mastodon. Versions of Mastodon prior to 4.5.8, 4.4.15, and 4.3.21 contained a vulnerability related to input validation errors. This vulnerability stemmed from improper handling of URL-encoded path segments in...

PT-2026-28542

Name of the Vulnerable Software and Affected Versions Mastodon versions 4.5.0 through 4.5.7 Mastodon versions 4.4.0 through 4.4.14 Description Mastodon is a free, open-source social network server based on ActivityPub. An attacker who is aware of a quote before it has reached a server can prevent...

Mastodon 安全漏洞

Mastodon is an open-source social networking server based on ActivityPub, developed by Mastodon. There are security vulnerabilities in versions prior to Mastodon 4.5.8, specifically the 4.5.x branch, and versions prior to Mastodon 4.4.15, specifically the 4.4.x branch. These vulnerabilities stem...

CVE-2026-33871

creationtimestamp| type| source ---|---|--- 2026-03-25 00:33:44+00:00| seen| https://mastodon.social/users/chrisvest/statuses/116287001142669958 2026-03-27 21:23:14+00:00| published-proof-of-concept| Telegram/B1-lnNSHplGL4tzlck3EB0WXwjfJllp4cXItiyc0oKB0vU 2026-03-30 21:00:17+00:00| seen|...

PT-2026-28106

Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.5.8 Mastodon versions prior to 4.4.15 Mastodon versions prior to 4.3.21 Description Mastodon, a free and open-source social network server based on ActivityPub, contains an unauthenticated Open Redirect issue in th...

CVE-2026-28217

creationtimestamp| type| source ---|---|--- 2026-03-23 15:20:38+00:00| seen| https://mastodon.social/ap/users/115426718704364579/statuses/116279164131270309 2026-03-23 15:20:54+00:00| seen| https://bsky.app/profile/netsecio.bsky.social/post/3mhqeeeduqr2w...

CVE-2026-32055

creationtimestamp| type| source ---|---|--- 2026-03-21 15:51:03+00:00| seen| https://mastodon.social/users/RedPacketSecurity/statuses/116267958250661954 2026-03-21 21:00:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhlwginb7e26 2026-03-22 03:00:05+00:00| seen|...

CVE-2026-3476

creationtimestamp| type| source ---|---|--- 2026-03-16 17:22:42+00:00| seen| https://mastodon.social/ap/users/115755483699003887/statuses/116240003901832432...

CVE-2026-28792

creationtimestamp| type| source ---|---|--- 2026-03-12 17:31:20+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mguwjgg63p2c 2026-03-12 17:32:37+00:00| seen| https://mastodon.social/ap/users/115755483699003887/statuses/116217391584830163 2026-03-12 20:32:09+00:00|...

CVE-2026-32060

creationtimestamp| type| source ---|---|--- 2026-03-11 15:08:15+00:00| seen| https://mastodon.social/ap/users/115755483699003887/statuses/116211167059630084...

CVE-2026-3805

creationtimestamp| type| source ---|---|--- 2026-03-11 06:56:47+00:00| seen| https://mastodon.social/users/bagder/statuses/116209234981784209 2026-03-11 16:40:52+00:00| seen| https://mastodon.social/ap/users/115755483699003887/statuses/116211531439936074 2026-03-12 08:02:07+00:00| seen|...

CVE-2026-3784

creationtimestamp| type| source ---|---|--- 2026-03-11 06:56:37+00:00| seen| https://mastodon.social/users/bagder/statuses/116209234272816653 2026-03-12 08:02:07+00:00| seen| https://bsky.app/profile/slackers.it/post/3mgtwpmo6wf2y 2026-03-12 08:02:08+00:00| seen|...

CVE-2026-3783

creationtimestamp| type| source ---|---|--- 2026-03-11 06:56:26+00:00| seen| https://mastodon.social/users/bagder/statuses/116209233592166059 2026-03-12 08:02:07+00:00| seen| https://bsky.app/profile/slackers.it/post/3mgtwpmo6wf2y 2026-03-12 08:02:08+00:00| seen|...

CVE-2026-1965

creationtimestamp| type| source ---|---|--- 2026-03-11 06:56:16+00:00| seen| https://mastodon.social/users/bagder/statuses/116209232848968463 2026-03-12 08:02:07+00:00| seen| https://bsky.app/profile/slackers.it/post/3mgtwpmo6wf2y 2026-03-12 08:02:08+00:00| seen|...

BIT-MASTODON-2026-27477 Mastodon has SSRF via unvalidated FASP Provider base_url

Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versions 4.4.0 through 4.4.13 and 4.5.0 through 4.5.6, an unauthenticated attacker can register a FASP with an attacker-chosen baseurl that includes or...

BIT-MASTODON-2026-27468 Mastodon may allow unconfirmed FASP to make subscriptions

Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versions 4.4.0 through 4.4.13 and 4.5.0 through 4.5.6, actions performed by a FASP to subscribe to account/content lifecycle events or to backfill content...

CVE-2026-27477

Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versions 4.4.0 through 4.4.13 and 4.5.0 through 4.5.6, an unauthenticated attacker can register a FASP with an attacker-chosen baseurl that includes or...

CVE-2026-27477

Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versions 4.4.0 through 4.4.13 and 4.5.0 through 4.5.6, an unauthenticated attacker can register a FASP with an attacker-chosen baseurl that includes or...

CVE-2026-27477 Mastodon has SSRF via unvalidated FASP Provider base_url

Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versions 4.4.0 through 4.4.13 and 4.5.0 through 4.5.6, an unauthenticated attacker can register a FASP with an attacker-chosen baseurl that includes or...