Vulnerabilities

TI-2026-39550 CVE-2026-54738

Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo

LOW 36

Lemmy is a link aggregator and forum for the fediverse.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00559 Published 2026-08-19 Fixed in 0.19.19, 1.0.0-beta.1 CWE-799

TI-2026-39555 CVE-2026-54743

Lemmy: Stored XSS via markdown image alt-text in lemmy-ui html5-embed

MEDIUM 62

Lemmy is a link aggregator and forum for the fediverse.

CVSS 4.0MEDIUM 6.4 Network No auth User interaction EPSS 0.00547 Published 2026-08-19 Fixed in 0.19.19-beta.1 CWE-79

TI-2026-39551 CVE-2026-54739

Lemmy: Login Endpoint User Enumeration via HTTP Response Code Differential

LOW 37

Lemmy is a link aggregator and forum for the fediverse.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0059 Published 2026-08-19 Fixed in 0.19.19, 1.0.0-beta.1 CWE-204

TI-2026-39552 CVE-2026-54740

Lemmy: Lower-ranked federated moderator can remove higher-ranked moderators

MEDIUM 62

Lemmy is a link aggregator and forum for the fediverse.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00427 Published 2026-08-19 Fixed in 0.19.19, 1.0.0-alpha.18 CWE-862

TI-2026-39553 CVE-2026-54741

Lemmy: Blocked users can edit private messages sent before the block

MEDIUM 57

Lemmy is a link aggregator and forum for the fediverse.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00484 Published 2026-08-19 Fixed in 0.19.19, 1.0.0-alpha.18 CWE-862

TI-2026-39554 CVE-2026-54742

Lemmy: `CollectionAdd::Featured` does not check the post is in the community

MEDIUM 56

Lemmy is a link aggregator and forum for the fediverse.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00548 Published 2026-08-19 Fixed in 0.19.19, 1.0.0-alpha.20 CWE-863

TI-2026-30503 CVE-2026-42180 · GHSA-3jvj-v6w2-h948

Lemmy: SSRF in /api/v3/post via Webmention dispatch

LOW 27

Lemmy is a link aggregator and forum for the fediverse.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00184 Published 2026-05-08 Fixed in 0.19.18 CWE-918

TI-2026-30504 CVE-2026-42181 · GHSA-h6hf-9846-xwrq

Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:image

MEDIUM 62

Lemmy is a link aggregator and forum for the fediverse.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00264 Published 2026-05-08 Fixed in 0.19.18 CWE-918

TI-2026-26073 CVE-2026-33693 · GHSA-q537-8fr5-cw35

Lemmy's Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()

HIGH 68

Lemmy is a link aggregator and forum for the fediverse.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00373 Published 2026-03-27 Fixed in 0.7.0-beta.9 CWE-918

TI-2026-23295 CVE-2026-29178 · GHSA-jvxv-2jjp-jxc3

Lemmy: Unauthenticated SSRF via file_type query parameter injection in image endpoint

HIGH 73

Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation, a framework for ActivityPub federation in Rust.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00289 Published 2026-03-06 Fixed in 0.19.16 CWE-918

TI-2025-18863 CVE-2025-25194 · GHSA-7723-35v7-qcxw

Server-Side Request Forgery (SSRF) in activitypub_federation

MEDIUM 52

Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation, a framework for ActivityPub federation in Rust.

CVSS 3.1MEDIUM 4.0 Network No auth No interaction EPSS 0.00418 Published 2025-02-10 No fix listed CWE-918

Vulnerabilities

Filters