LemmyNet vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 20251
3. 202610

Newest CVEs

• CVE-2026-54738

  Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo

  LemmyNet · lemmy

  Medium6.5
• CVE-2026-54743

  Lemmy: Stored XSS via markdown image alt-text in lemmy-ui html5-embed

  LemmyNet · lemmy

  Medium6.4
• CVE-2026-54739

  Lemmy: Login Endpoint User Enumeration via HTTP Response Code Differential

  LemmyNet · lemmy

  Medium6.9
• CVE-2026-54740

  Lemmy: Lower-ranked federated moderator can remove higher-ranked moderators

  LemmyNet · lemmy

  Medium6.5
• CVE-2026-54741

  Lemmy: Blocked users can edit private messages sent before the block

  LemmyNet · lemmy

  Medium5.3
• CVE-2026-54742

  Lemmy: `CollectionAdd::Featured` does not check the post is in the community

  LemmyNet · lemmy

  Medium5.1
• CVE-2026-42180

  Lemmy: SSRF in /api/v3/post via Webmention dispatch

  LemmyNet · lemmy

  Medium6.3
• CVE-2026-42181

  Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:image

  LemmyNet · lemmy

  Medium6.5
• CVE-2026-33693

  Lemmy's Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()

  LemmyNet · lemmy

  Medium6.5
• CVE-2026-29178

  Lemmy: Unauthenticated SSRF via file_type query parameter injection in image endpoint

  LemmyNet · lemmy

  High7.7