CVE-2026-86178

Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author...

CVE-2026-86178 Pixelfed through 0.12.9 Unauthorized Story Access via API

Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author...

EUVD-2026-71977

Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author...

CVE-2026-86178 Pixelfed through 0.12.9 Unauthorized Story Access via API

Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author...

CVE-2026-86178

Pixelfed through 0.12.9 fails to validate follower status in the StoryComposeController react and comment endpoints. This allows any authenticated user to enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author information from follower-only stories...

CVE-2026-71246

Pixelfed's SearchController behind the auth middleware accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP...

CVE-2026-71246

Pixelfed’s Pixelfed SearchController (behind auth) is vulnerable to an authenticated SSRF via remote URL search. The vulnerable path takes a URL from remote-search parameters and fetches it server-side using ActivityPubFetchService. The validateUrl() logic only blocks literal hosts 127.0.0.1, loc...

CVE-2026-71246 Pixelfed - Authenticated SSRF via Remote URL Search

Pixelfed's SearchController behind the auth middleware accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP...

CVE-2026-71246

Pixelfed's SearchController behind the auth middleware accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP...

EUVD-2023-0777

Malicious code in bioql PyPI...

EUVD-2024-0638

Malicious code in bioql PyPI...

EUVD-2023-0799

Malicious code in bioql PyPI...

EUVD-2025-8084

Malicious code in bioql PyPI...

CVE-2023-0914

Improper Authorization in GitHub repository pixelfed/pixelfed prior to 0.11.4...

CVE-2023-0901

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pixelfed/pixelfed prior to 0.11.4...

Unauthorized Access

pixelfed/pixelfed is vulnerable to Unauthorized Access. The vulnerability is due to insufficient verification of follow requests, allowing unauthorized users to access private posts across Fediverse servers...

CVE-2025-30741

Pixelfed before 0.12.5 allows anyone to follow private accounts and see private posts on other Fediverse servers. This affects users elsewhere in the Fediverse, if they otherwise have any followers from a Pixelfed instance...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the account visibility settings. An attacker can view and interact with private posts and accounts by leveraging the improper enforcement of access controls. Remediation Upgrade pixelfed/pixelfed to version...

GHSA-7287-GRHX-542X Pixelfed may allow unauthorized actor to view private posts and private users

Pixelfed before 0.12.5 allows anyone to follow private accounts and see private posts on other Fediverse servers. This affects users elsewhere in the Fediverse, if they otherwise have any followers from a Pixelfed instance...

Pixelfed may allow unauthorized actor to view private posts and private users

Pixelfed before 0.12.5 allows anyone to follow private accounts and see private posts on other Fediverse servers. This affects users elsewhere in the Fediverse, if they otherwise have any followers from a Pixelfed instance...