mastodon vulnerabilities

CVEs per yearBy the year they were published

1. 20222
2. 20238
3. 20245
4. 20258
5. 202623

Newest CVEs

• CVE-2026-59825

  Mastodon: Unwanted deactivation of SSL/TLS certificate verification

  mastodon · mastodon

  High7.4
• CVE-2026-72916

  Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses

  mastodon · mastodon

  Medium6.3
• CVE-2026-72915

  Mastodon: Personally-identifying information disclosure due to incorrect access control validation

  mastodon · mastodon

  High7.5
• CVE-2026-72914

  Mastodon: Exhausting data by an unauthenticated request to the admin retention API

  mastodon · mastodon

  High7.5
• CVE-2026-50129

  Mastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH_TRANSFORMER

  mastodon · mastodon

  High7.5
• CVE-2026-50128

  Mastodon: Spoofing of attribution domains

  mastodon · mastodon

  Medium5.3
• CVE-2026-48028

  Mastodon: Removal of integrity-protected JSON entries from signed activities

  mastodon · mastodon

  Medium6.5
• CVE-2026-47389

  Mastodon: SSRF protection bypass on older Ruby versions

  mastodon · mastodon

  High8.6
• CVE-2026-46349

  Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuring

  mastodon · mastodon

  Medium5.3
• CVE-2026-46348

  Mastodon: SSRF Bypass via IPv6 Unspecified Address (::)

  mastodon · mastodon

  High8.7