agentprime: mastodon

agentprime: mastodonEvery new CVE for mastodon.https://agentprime.io/CVE-2026-59825: Mastodon: Unwanted deactivation of SSL/TLS certificate verificationhttps://agentprime.io/advisories/CVE-2026-59825/https://agentprime.io/advisories/CVE-2026-59825/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 15:07:14 GMTCVECVE-2026-72916: Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresseshttps://agentprime.io/advisories/CVE-2026-72916/https://agentprime.io/advisories/CVE-2026-72916/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 21:19:02 GMTCVECVE-2026-72915: Mastodon: Personally-identifying information disclosure due to incorrect access control validationhttps://agentprime.io/advisories/CVE-2026-72915/https://agentprime.io/advisories/CVE-2026-72915/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 21:16:19 GMTCVECVE-2026-72914: Mastodon: Exhausting data by an unauthenticated request to the admin retention APIhttps://agentprime.io/advisories/CVE-2026-72914/https://agentprime.io/advisories/CVE-2026-72914/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 21:13:20 GMTCVECVE-2026-50129: Mastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH_TRANSFORMERhttps://agentprime.io/advisories/CVE-2026-50129/https://agentprime.io/advisories/CVE-2026-50129/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 24 Jun 2026 19:50:51 GMTCVECVE-2026-50128: Mastodon: Spoofing of attribution domainshttps://agentprime.io/advisories/CVE-2026-50128/https://agentprime.io/advisories/CVE-2026-50128/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 24 Jun 2026 19:48:52 GMTCVECVE-2026-48028: Mastodon: Removal of integrity-protected JSON entries from signed activitieshttps://agentprime.io/advisories/CVE-2026-48028/https://agentprime.io/advisories/CVE-2026-48028/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 24 Jun 2026 19:43:01 GMTCVECVE-2026-47389: Mastodon: SSRF protection bypass on older Ruby versionshttps://agentprime.io/advisories/CVE-2026-47389/https://agentprime.io/advisories/CVE-2026-47389/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 24 Jun 2026 19:41:21 GMTCVECVE-2026-46349: Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuringhttps://agentprime.io/advisories/CVE-2026-46349/https://agentprime.io/advisories/CVE-2026-46349/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 24 Jun 2026 19:40:35 GMTCVECVE-2026-46348: Mastodon: SSRF Bypass via IPv6 Unspecified Address (::)https://agentprime.io/advisories/CVE-2026-46348/https://agentprime.io/advisories/CVE-2026-46348/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 24 Jun 2026 19:39:46 GMTCVECVE-2026-47777: Mastodon has a consent-check bypass in its remote Collectionshttps://agentprime.io/advisories/CVE-2026-47777/https://agentprime.io/advisories/CVE-2026-47777/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 15 Jun 2026 16:54:44 GMTCVECVE-2026-41259: Mastodon: Insufficient verification of email addresseshttps://agentprime.io/advisories/CVE-2026-41259/https://agentprime.io/advisories/CVE-2026-41259/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 23 Apr 2026 18:55:20 GMTCVECVE-2026-33869: Mastodon has a denial of service for quote authorizationhttps://agentprime.io/advisories/CVE-2026-33869/https://agentprime.io/advisories/CVE-2026-33869/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 27 Mar 2026 19:52:21 GMTCVECVE-2026-33868: Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>'https://agentprime.io/advisories/CVE-2026-33868/https://agentprime.io/advisories/CVE-2026-33868/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 27 Mar 2026 19:50:07 GMTCVECVE-2026-27477: Mastodon has SSRF via unvalidated FASP Provider base_urlhttps://agentprime.io/advisories/CVE-2026-27477/https://agentprime.io/advisories/CVE-2026-27477/CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 24 Feb 2026 19:00:20 GMTCVECVE-2026-27468: Mastodon may allow unconfirmed FASP to make subscriptionshttps://agentprime.io/advisories/CVE-2026-27468/https://agentprime.io/advisories/CVE-2026-27468/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 24 Feb 2026 17:12:40 GMTCVECVE-2026-25540: Mastodon's signature-dependent ActivityPub collection responses cached under signature-independent keys (Web Cache Poisoning via `Rails.cache`)https://agentprime.io/advisories/CVE-2026-25540/https://agentprime.io/advisories/CVE-2026-25540/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Feb 2026 21:42:09 GMTCVECVE-2026-23964: Mastodon has insufficient access control to push notification settingshttps://agentprime.io/advisories/CVE-2026-23964/https://agentprime.io/advisories/CVE-2026-23964/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 22 Jan 2026 01:55:29 GMTCVECVE-2026-23963: Mastodon missing length limits on list names, filter names, and filter keywordshttps://agentprime.io/advisories/CVE-2026-23963/https://agentprime.io/advisories/CVE-2026-23963/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 22 Jan 2026 01:53:49 GMTCVECVE-2026-23962: Mastodon vulnerable to Denial of Service from a single post (client/server)https://agentprime.io/advisories/CVE-2026-23962/https://agentprime.io/advisories/CVE-2026-23962/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 22 Jan 2026 01:51:37 GMTCVECVE-2026-23961: Mastodon may allow a remote suspension bypasshttps://agentprime.io/advisories/CVE-2026-23961/https://agentprime.io/advisories/CVE-2026-23961/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 22 Jan 2026 01:47:36 GMTCVECVE-2026-22246: Local Mastodon users can enumerate and access severed relationships of every other local userhttps://agentprime.io/advisories/CVE-2026-22246/https://agentprime.io/advisories/CVE-2026-22246/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 08 Jan 2026 15:27:21 GMTCVECVE-2026-22245: Mastodon has SSRF Protection bypasshttps://agentprime.io/advisories/CVE-2026-22245/https://agentprime.io/advisories/CVE-2026-22245/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 08 Jan 2026 15:23:13 GMTCVECVE-2025-67500: Mastodon Error Handling Discrepancy Enables Private Status Existence Enumerationhttps://agentprime.io/advisories/CVE-2025-67500/https://agentprime.io/advisories/CVE-2025-67500/CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 09 Dec 2025 23:44:04 GMTCVECVE-2025-62605: Mastodon quotes control can be bypassedhttps://agentprime.io/advisories/CVE-2025-62605/https://agentprime.io/advisories/CVE-2025-62605/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Oct 2025 16:46:37 GMTCVECVE-2025-62176: Mastadon streaming server allows OAuth clients without the `read` scope to subscribe to public channelshttps://agentprime.io/advisories/CVE-2025-62176/https://agentprime.io/advisories/CVE-2025-62176/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 13 Oct 2025 21:04:53 GMTCVECVE-2025-62175: Mastodon streaming API fails to disconnect disabled and suspended usershttps://agentprime.io/advisories/CVE-2025-62175/https://agentprime.io/advisories/CVE-2025-62175/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 13 Oct 2025 20:59:31 GMTCVECVE-2025-62174: Mastodon allows continued access after password reset via CLIhttps://agentprime.io/advisories/CVE-2025-62174/https://agentprime.io/advisories/CVE-2025-62174/CVSS 3.5 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 13 Oct 2025 20:54:36 GMTCVECVE-2025-54879: Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emailshttps://agentprime.io/advisories/CVE-2025-54879/https://agentprime.io/advisories/CVE-2025-54879/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 05 Aug 2025 23:39:59 GMTCVECVE-2025-27399: Mastodon's domain blocks & rationales ignore user approval when visibility set as "users"https://agentprime.io/advisories/CVE-2025-27399/https://agentprime.io/advisories/CVE-2025-27399/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 27 Feb 2025 17:15:05 GMTCVECVE-2025-27157: Mastodon's rate-limits are missing on `/auth/setup`https://agentprime.io/advisories/CVE-2025-27157/https://agentprime.io/advisories/CVE-2025-27157/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 27 Feb 2025 17:12:39 GMTCVECVE-2024-37903: Mastodon has improper authorship check on audience extension for existing postshttps://agentprime.io/advisories/CVE-2024-37903/https://agentprime.io/advisories/CVE-2024-37903/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 05 Jul 2024 17:24:49 GMTCVECVE-2024-25623: Lack of media type verification of Activity Streams objects allows impersonation of remote accountshttps://agentprime.io/advisories/CVE-2024-25623/https://agentprime.io/advisories/CVE-2024-25623/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Feb 2024 15:28:15 GMTCVECVE-2024-25619: Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodonhttps://agentprime.io/advisories/CVE-2024-25619/https://agentprime.io/advisories/CVE-2024-25619/CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Feb 2024 20:50:10 GMTCVECVE-2024-25618: External OpenID Connect Account Takeover by E-Mail Change in mastodonhttps://agentprime.io/advisories/CVE-2024-25618/https://agentprime.io/advisories/CVE-2024-25618/CVSS 4.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Feb 2024 20:45:50 GMTCVECVE-2024-23832: Mastodon Remote user impersonation and takeoverhttps://agentprime.io/advisories/CVE-2024-23832/https://agentprime.io/advisories/CVE-2024-23832/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 01 Feb 2024 16:18:03 GMTCVEcriticalCVE-2023-42452: Mastodon vulnerable to Stored XSS through the translation featurehttps://agentprime.io/advisories/CVE-2023-42452/https://agentprime.io/advisories/CVE-2023-42452/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 19 Sep 2023 15:58:44 GMTCVECVE-2023-42451: Mastodon Invalid Domain Name Normalization vulnerabilityhttps://agentprime.io/advisories/CVE-2023-42451/https://agentprime.io/advisories/CVE-2023-42451/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 19 Sep 2023 15:56:46 GMTCVECVE-2023-42450: Mastodon Server-Side Request Forgery vulnerabilityhttps://agentprime.io/advisories/CVE-2023-42450/https://agentprime.io/advisories/CVE-2023-42450/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 19 Sep 2023 15:53:39 GMTCVECVE-2023-36462: Mastodon's verified profile links can be formatted in a misleading wayhttps://agentprime.io/advisories/CVE-2023-36462/https://agentprime.io/advisories/CVE-2023-36462/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Jul 2023 19:16:37 GMTCVECVE-2023-36461: Mastodon vulnerable to Denial of Service through slow HTTP responseshttps://agentprime.io/advisories/CVE-2023-36461/https://agentprime.io/advisories/CVE-2023-36461/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Jul 2023 18:57:59 GMTCVECVE-2023-36460: Mastodon vulnerable to arbitrary file creation through media attachmentshttps://agentprime.io/advisories/CVE-2023-36460/https://agentprime.io/advisories/CVE-2023-36460/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. CVSS score 10.0 (7.0 or more) and EPSS 0.40 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Jul 2023 18:39:09 GMTCVEcriticalCVE-2023-36459: Mastodon vulnerable to Cross-site Scripting through oEmbed preview cardshttps://agentprime.io/advisories/CVE-2023-36459/https://agentprime.io/advisories/CVE-2023-36459/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Jul 2023 18:29:07 GMTCVEcriticalCVE-2023-28853: Mastodon's blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP databasehttps://agentprime.io/advisories/CVE-2023-28853/https://agentprime.io/advisories/CVE-2023-28853/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 04 Apr 2023 21:14:53 GMTCVE