Skip to content
Noroxi

joinmastodon records

42 published records for vendor joinmastodon.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
0
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 19
  2. 22
  3. 23
  4. 24
  5. 25
  6. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

42 records
  • CVE-2023-36460
    51Plan

    Mastodon vulnerable to arbitrary file creation through media attachments

    CriticalCVSS 9.9No exploitEPSS 40%

    joinmastodon · mastodonJul 6, 2023

  • CVE-2018-21018
    40Plan

    Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions.

    CriticalCVSS 9.8No exploitEPSS 3%

    joinmastodon · mastodonSep 22, 2019

  • CVE-2024-23832
    40Plan

    Mastodon Remote user impersonation and takeover

    CriticalCVSS 9.8No exploitEPSS 2%

    joinmastodon · mastodonFeb 1, 2024

  • CVE-2022-24307
    39Monitor

    Mastodon before 3.3.2 and 3.4.x before 3.4.6 has incorrect access control because it does not compact incoming signed JSON-LD activities.

    CriticalCVSS 9.8No exploitEPSS 1%

    joinmastodon · mastodonFeb 3, 2022

  • CVE-2022-2166
    39Monitor

    Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon

    CriticalCVSS 9.8No exploitEPSS 1%

    joinmastodon · mastodonNov 15, 2022

  • CVE-2024-37903
    32Monitor

    Mastodon has improper authorship check on audience extension for existing posts

    HighCVSS 8.2No exploitEPSS 1%

    joinmastodon · mastodonJul 5, 2024

  • CVE-2026-41259
    32Monitor

    Mastodon: Insufficient verification of email addresses

    HighCVSS 8.2No exploitEPSS 0%

    joinmastodon · mastodonApr 23, 2026

  • CVE-2023-36461
    30Monitor

    Mastodon vulnerable to Denial of Service through slow HTTP responses

    HighCVSS 7.5No exploitEPSS 1%

    joinmastodon · mastodonJul 6, 2023

  • CVE-2022-46405
    30Monitor

    Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attacke

    HighCVSS 7.5No exploitEPSS 1%

    joinmastodon · mastodonDec 4, 2022

  • CVE-2023-42451
    30Monitor

    Mastodon Invalid Domain Name Normalization vulnerability

    HighCVSS 7.5No exploitEPSS 1%

    joinmastodon · mastodonSep 19, 2023

  • CVE-2026-23962
    30Monitor

    Mastodon vulnerable to Denial of Service from a single post (client/server)

    HighCVSS 7.5No exploitEPSS 1%

    joinmastodon · mastodonJan 21, 2026

  • CVE-2025-54879
    30Monitor

    Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails

    HighCVSS 7.5No exploitEPSS 1%

    joinmastodon · mastodonAug 5, 2025

  • CVE-2024-25623
    30Monitor

    Lack of media type verification of Activity Streams objects allows impersonation of remote accounts

    HighCVSS 7.7No exploitEPSS 1%

    joinmastodon · mastodonFeb 19, 2024

  • CVE-2023-49952
    30Monitor

    Mastodon 4.1.x before 4.1.17 and 4.2.x before 4.2.9 allows a bypass of rate limiting via a crafted HTTP request header.

    HighCVSS 7.5No exploitEPSS 0%

    joinmastodon · mastodonNov 18, 2024

  • CVE-2023-42450
    30Monitor

    Mastodon Server-Side Request Forgery vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    joinmastodon · mastodonSep 19, 2023

  • CVE-2024-25618
    29Monitor

    External OpenID Connect Account Takeover by E-Mail Change in mastodon

    HighCVSS 7.4No exploitEPSS 0%

    joinmastodon · mastodonFeb 14, 2024

  • CVE-2026-22245
    28Monitor

    Mastodon has SSRF Protection bypass

    HighCVSS 7.1No exploitEPSS 0%

    joinmastodon · mastodonJan 8, 2026

  • CVE-2023-28853
    26Monitor

    Mastodon's blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP database

    MediumCVSS 6.5No exploitEPSS 1%

    joinmastodon · mastodonApr 4, 2023

  • CVE-2026-25540
    26Monitor

    Mastodon's signature-dependent ActivityPub collection responses cached under signature-independent keys (Web Cache Poisoning via `Rails.cache`)

    MediumCVSS 6.5No exploitEPSS 0%

    joinmastodon · mastodonFeb 4, 2026

  • CVE-2026-23963
    26Monitor

    Mastodon missing length limits on list names, filter names, and filter keywords

    MediumCVSS 6.5No exploitEPSS 0%

    joinmastodon · mastodonJan 21, 2026

  • CVE-2022-0432
    25Monitor

    Prototype Pollution in mastodon/mastodon

    MediumCVSS 6.1Proof of conceptEPSS 4%

    joinmastodon · mastodonFeb 2, 2022

  • CVE-2023-36459
    24Monitor

    Mastodon vulnerable to Cross-site Scripting through oEmbed preview cards

    MediumCVSS 6.1No exploitEPSS 1%

    joinmastodon · mastodonJul 6, 2023

  • CVE-2026-33868
    24Monitor

    Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>'

    MediumCVSS 6.1Proof of conceptEPSS 1%

    joinmastodon · mastodonMar 27, 2026

  • CVE-2024-34535
    23Monitor

    In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header.

    MediumCVSS 5.9No exploitEPSS 0%

    joinmastodon · mastodonOct 3, 2024

  • CVE-2022-31263
    21Monitor

    app/models/user.rb in Mastodon before 3.5.0 allows a bypass of e-mail restrictions.

    MediumCVSS 5.3No exploitEPSS 1%

    joinmastodon · mastodonMay 24, 2022