CVE-2026-63115

ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the Undo handler allows a remote federated server to cause the service to act on a follow or repost as though the activity came from a different account. This permits removal of an existing foll...

CVE-2026-63115 ActivityPub Undo handler can unfollow or remove reposts on behalf of other accounts

ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the Undo handler allows a remote federated server to cause the service to act on a follow or repost as though the activity came from a different account. This permits removal of an existing foll...

CVE-2026-63115

The ActivityPub server (versions 1.0.0 through 1.2.6), a multi-tenant ActivityPub server for Ghost built with Fedify, contains a vulnerability in the Undo handler . This flaw allows a remote federated server to trigger actions as if they originated from a different account, enabling the unfollow ...

CVE-2026-63115: TryGhost ActivityPub: ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify

ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the Undo handler allows a remote federated server to cause the service to act on a follow or repost as though the activity came from a different account. This permits removal of an existing foll...

WordPress Jetpack plugin 14.5-16.1.2 - Reflected to Stored Cross-Site Scripting via Reader Repost Parameters

Reflected to Stored Cross-Site Scripting via Reader Repost Parameters vulnerability discovered by Jetpack in WordPress Plugin Jetpack versions 16.1-16.1.2...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-006725)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006725 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix buffer free/clear order in deferred receive path Fix a use-after-free window by...

Malicious code in sequelize-phoebe-bunyan-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b057396b0db3089843fdf6b6da63f670ad4538185bbcaf2fc6af46aba090fdd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hunimi-satihu-angag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a90dfa2687bb4775add53d64278ae7762f4bb6b806401674cb945c798cf70a85 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-156470 Malicious code in inal-poke8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f2d3f0079a6e1686a41dbbee009ca673482ae82c2dfa3ebad2ae3bcec1ff5c3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138872 Malicious code in middle-gold-zebra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ffb8cd6c5e05795f83b2bc8f53bfb009b515d91dd0f4803eafdac167a83bcdc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-133872 Malicious code in gita-serabi60-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22d2129e1b3a92297233c29afcda1fe94f49d35392eb2ebdb575c763e21ddfe3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-126739 Malicious code in gilang-botok87-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27001e92f08c866d7eb6d110922978b0279b64698d5eb1273af1b94622f9e4a4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sorry_sloth_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67ccd49a0a1dc980644eabad208681fd5fb1b899b89fe80e355d1c467f232dee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-124711 Malicious code in zul-gado-gado71-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d28a782ec4c18a3e737f7f4543de7f97b571c226448b2720bc7d2c51b1dd2be6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nana-naget97-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 392d290bc03505ebb67c2b6cfece8007fae1c0b482cace46a1a25e05897b68a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rina-semur77-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3cdd9577b2cd3737dda59f2d3b6f947b40f1782f2eba3c30b23bac1f3733281 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in surviving_butterfly_dumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c6493b2f190df5ea91e8ec68d519ede102edd23f1b672d1051cfab5ac7e34c0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kiki-semur97-tititugel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47a281031b16e3553cb480b0cab60b7744333ff7efae96768bdcc2b282f255f5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-98538 Malicious code in yanti-mangut95-tititugel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b1eaafe175a04644b1f52581bcabb41d821ffadbe647fdc25e30e5cc0a57d84 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in foolish_hedgehog_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 116c1858f1f963477e9ab4ba7781a043300ba95e722ba750edd6504cb5ab25e9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...