LemmyNet

Records11All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

LemmyNet records in CISA KEV

No LemmyNet vulnerabilities are listed in CISA KEV.

Records

11 records

TI-2026-23295 CVE-2026-29178 · GHSA-jvxv-2jjp-jxc3

Lemmy: Unauthenticated SSRF via file_type query parameter injection in image endpoint

HIGH 73

Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation, a framework for ActivityPub federation in Rust.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00289 Published 2026-03-06 Fixed in 0.19.16 CWE-918

TI-2026-26073 CVE-2026-33693 · GHSA-q537-8fr5-cw35

Lemmy's Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()

HIGH 68

Lemmy is a link aggregator and forum for the fediverse.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00373 Published 2026-03-27 Fixed in 0.7.0-beta.9 CWE-918

TI-2026-39555 CVE-2026-54743

Lemmy: Stored XSS via markdown image alt-text in lemmy-ui html5-embed

MEDIUM 62

Lemmy is a link aggregator and forum for the fediverse.

CVSS 4.0MEDIUM 6.4 Network No auth User interaction EPSS 0.00547 Published 2026-08-19 Fixed in 0.19.19-beta.1 CWE-79

TI-2026-39552 CVE-2026-54740

Lemmy: Lower-ranked federated moderator can remove higher-ranked moderators

MEDIUM 62

Lemmy is a link aggregator and forum for the fediverse.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00427 Published 2026-08-19 Fixed in 0.19.19, 1.0.0-alpha.18 CWE-862

TI-2026-30504 CVE-2026-42181 · GHSA-h6hf-9846-xwrq

Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:image

MEDIUM 62

Lemmy is a link aggregator and forum for the fediverse.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00264 Published 2026-05-08 Fixed in 0.19.18 CWE-918

TI-2026-39553 CVE-2026-54741

Lemmy: Blocked users can edit private messages sent before the block

MEDIUM 57

Lemmy is a link aggregator and forum for the fediverse.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00484 Published 2026-08-19 Fixed in 0.19.19, 1.0.0-alpha.18 CWE-862

TI-2026-39554 CVE-2026-54742

Lemmy: `CollectionAdd::Featured` does not check the post is in the community

MEDIUM 56

Lemmy is a link aggregator and forum for the fediverse.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00548 Published 2026-08-19 Fixed in 0.19.19, 1.0.0-alpha.20 CWE-863

TI-2025-18863 CVE-2025-25194 · GHSA-7723-35v7-qcxw

Server-Side Request Forgery (SSRF) in activitypub_federation

MEDIUM 52

Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation, a framework for ActivityPub federation in Rust.

CVSS 3.1MEDIUM 4.0 Network No auth No interaction EPSS 0.00418 Published 2025-02-10 No fix listed CWE-918

TI-2026-39551 CVE-2026-54739

Lemmy: Login Endpoint User Enumeration via HTTP Response Code Differential

LOW 37

Lemmy is a link aggregator and forum for the fediverse.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0059 Published 2026-08-19 Fixed in 0.19.19, 1.0.0-beta.1 CWE-204

TI-2026-39550 CVE-2026-54738

Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo

LOW 36

Lemmy is a link aggregator and forum for the fediverse.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00559 Published 2026-08-19 Fixed in 0.19.19, 1.0.0-beta.1 CWE-799

TI-2026-30503 CVE-2026-42180 · GHSA-3jvj-v6w2-h948

Lemmy: SSRF in /api/v3/post via Webmention dispatch

LOW 27

Lemmy is a link aggregator and forum for the fediverse.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00184 Published 2026-05-08 Fixed in 0.19.18 CWE-918

Open these records in search →