Priority HIGH 82
Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01133 · Published 2022-11-16 · Fixed in 4.0.0 CWE-307
Priority HIGH 72
Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00613 · Published 2025-08-05 · Fixed in 4.2.24, 4.3.11 +1 CWE-770
Priority HIGH 72
Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attacker-controlled accounts on certain other servers associated with a wildcard DNS A…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00982 · Published 2022-12-04 · No fix listed CWE-674
Priority HIGH 70
Mastodon is a free, open-source social network server based on ActivityPub.
CVSS 3.1CRITICAL 10.0· Network · Low privileges · No interaction · EPSS 0.4011 · Published 2023-07-06 · Fixed in 3.5.9, 4.0.5 +1 CWE-22
Priority HIGH 67
Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication.
CVSS 3.1HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.01279 · Published 2023-04-04 · Fixed in 3.5.8, 4.0.4 +1 CWE-90
Priority HIGH 66
Mastodon is a free, open-source social network server based on ActivityPub.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00473 · Published 2024-02-14 · Fixed in 4.2.6, 4.1.14 +2 CWE-287
Priority MEDIUM 53
Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02452 · Published 2024-02-01 · Fixed in 3.5.17, 4.0.13 +2 CWE-290
Priority MEDIUM 53
The undo_mark_statuses_as_sensitive method in app/services/approve_appeal_service.rb in Mastodon 3.5.x before 3.5.3 does not use the server's representative account, resulting in moderator identity disclosure when a mode…
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00685 · Published 2023-03-06 · No fix listed CWE-287
Priority MEDIUM 47
Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02561 · Published 2019-09-22 · No fix listed CWE-613
Priority MEDIUM 45
Mastodon before 3.3.2 and 3.4.x before 3.4.6 has incorrect access control because it does not compact incoming signed JSON-LD activities.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01454 · Published 2022-02-03 · No fix listed CWE-863
Priority MEDIUM 44
Mastodon is a free, open-source social network server based on ActivityPub.
CVSS 3.1CRITICAL 9.3· Network · No auth · User interaction · EPSS 0.01217 · Published 2023-07-06 · Fixed in 3.5.9, 4.0.5 +1 CWE-79
Priority MEDIUM 42
Mastodon is a self-hosted, federated microblogging platform.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.0053 · Published 2024-07-05 · Fixed in 4.1.18, 4.2.10 CWE-862
Priority MEDIUM 41
Mastodon is a free, open-source social network server based on ActivityPub.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00213 · Published 2026-04-23 · Fixed in 4.3.22, 4.4.16 +1 CWE-841
Priority MEDIUM 41
Mastodon is a free, open-source social network server based on ActivityPub.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01308 · Published 2023-07-06 · Fixed in 3.5.9, 4.0.5 +1 CWE-770
Priority MEDIUM 40
Mastodon is a free, open-source social network server based on ActivityPub.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00545 · Published 2026-01-22 · Fixed in 4.3.18, 4.4.12 +1 CWE-770
Priority LOW 39
Mastodon 4.1.x before 4.1.17 and 4.2.x before 4.2.9 allows a bypass of rate limiting via a crafted HTTP request header.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0047 · Published 2024-11-18 · No fix listed CWE-79
Priority LOW 37
Mastodon is a free, open-source social network server based on ActivityPub.
CVSS 3.1HIGH 8.5· Network · Low privileges · No interaction · EPSS 0.00511 · Published 2024-02-19 · Fixed in 3.5.19, 4.0.15 +2 CWE-434
Priority LOW 35
Mastodon is a free, open-source social network server based on ActivityPub.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00437 · Published 2026-02-04 · Fixed in 4.3.19, 4.4.13 +1 CWE-524
Priority LOW 35
Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.04429 · Published 2022-02-02 · Fixed in 3.5.0 CWE-1321
Priority LOW 34
Mastodon is a free, open-source social network server based on ActivityPub.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00234 · Published 2026-01-22 · Fixed in 4.3.18, 4.4.12 +1 CWE-863
Priority LOW 34
Mastodon is a free, open-source social network server based on ActivityPub.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00667 · Published 2023-09-19 · Fixed in 3.5.14, 4.0.10 +2 CWE-706
Priority LOW 33
Mastodon is a free, open-source social network server based on ActivityPub.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0046 · Published 2023-09-19 · Fixed in 4.2.0-rc2 CWE-113
Priority LOW 31
Mastodon is a free, open-source social network server based on ActivityPub.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00289 · Published 2026-01-08 · Fixed in 4.2.29, 4.3.17 +2 CWE-918
Priority LOW 30
Mastodon is a free, open-source social network server based on ActivityPub.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.0044 · Published 2026-01-22 · Fixed in 4.3.18, 4.4.12 +1 CWE-863
Priority LOW 30
Mastodon is a self-hosted, federated microblogging platform.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00357 · Published 2025-02-27 · Fixed in 4.1.23, 4.2.16 +1 CWE-200
Load more
THREATIST.IORead the docs