Skip to content
Lemmynet Lemmy vulnerabilities
-
lemmynet lemmy
Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo
CVE-2026-54738
6.5 Medium
-
lemmynet lemmy
Lemmy: Stored XSS via markdown image alt-text in lemmy-ui html5-embed
CVE-2026-54743
6.4 Medium
-
lemmynet lemmy
Lemmy: Login Endpoint User Enumeration via HTTP Response Code Differential
CVE-2026-54739
6.9 Medium
-
lemmynet lemmy
Lemmy: Lower-ranked federated moderator can remove higher-ranked moderators
CVE-2026-54740
6.5 Medium
-
lemmynet lemmy
Lemmy: Blocked users can edit private messages sent before the block
CVE-2026-54741
5.3 Medium
-
lemmynet lemmy
Lemmy: `CollectionAdd::Featured` does not check the post is in the community
CVE-2026-54742
5.1 Medium
-
lemmynet lemmy
Lemmy: SSRF in /api/v3/post via Webmention dispatch
CVE-2026-42180
Fix available
6.3 Medium
-
lemmynet lemmy
Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:image
CVE-2026-42181
Fix available
6.5 Medium
-
lemmynet lemmy
Lemmy's Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()
CVE-2026-33693
Public exploitFix available
6.5 Medium
-
lemmynet lemmy
Lemmy: Unauthenticated SSRF via file_type query parameter injection in image endpoint
CVE-2026-29178
Fix available
7.7 High
-
lemmynet lemmy
Server-Side Request Forgery (SSRF) in activitypub_federation
CVE-2025-25194
4.0 Medium
-
join-lemmy lemmy
Any authenticated user may obtain private message details from other users on the same instance
CVE-2024-23649
Fix available
7.5 High