Indieweb vulnerabilities

Newest

• indieweb IndieWeb <= 4.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via 'Telephone' Parameter CVE-2025-14893 Public exploit 6.4 MediumJanuary 9, 2026
• indieweb indieauth IndieAuth <= 4.5.4 - Cross-Site Request Forgery to Account Takeover via Stolen OAuth Tokens CVE-2025-12028 Public exploit 8.8 HighOctober 24, 2025