LemmyNet lemmy vulnerabilities

12 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Latest LemmyNet lemmy vulnerabilities

CVE-2026-54743 — Lemmy: Stored XSS via markdown image alt-text in lemmy-ui html5-embed (CVSS 6.4)
CVE-2026-54741 — Lemmy: Blocked users can edit private messages sent before the block (CVSS 5.3)
CVE-2026-54740 — Lemmy: Lower-ranked federated moderator can remove higher-ranked moderators (CVSS 6.5)
CVE-2026-54739 — Lemmy: Login Endpoint User Enumeration via HTTP Response Code Differential (CVSS 6.9)
CVE-2026-54738 — Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo (CVSS 6.5)
CVE-2026-54742 — Lemmy: `CollectionAdd::Featured` does not check the post is in the community (CVSS 5.1)
CVE-2026-42181 — Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:image (CVSS 6.5)
CVE-2026-42180 — Lemmy: SSRF in /api/v3/post via Webmention dispatch (CVSS 6.3)
CVE-2026-33693 — Lemmy's Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid() (CVSS 6.5)
CVE-2026-29178 — Lemmy: Unauthenticated SSRF via file_type query parameter injection in image endpoint (CVSS 7.7)
CVE-2025-25194 — Server-Side Request Forgery (SSRF) in activitypub_federation (CVSS 4.0)
CVE-2024-23649 — Any authenticated user may obtain private message details from other users on the same instance (CVSS 6.5)