https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T06:40:27.602948+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-46349 CVE-2026-46349 — Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuring 2026-10-07T06:40:27.618508+00:00

Affected: mastodon

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, Mastodon's normalization of incoming activities signed with Linked-Data Signatures does not sufficiently protect the activities from a certain class of spoofing, allowing attackers to re-arrange a valid signed JSON-LD activity from a third-party actor to have it processed differently. This vulnerability is fixed in 4.5.10, 4.4.17, and 4.3.23.