LemmyNet lemmy vulnerabilities
12 published CVEs name LemmyNet lemmy among the affected products.
- 12Published CVEs12 of them scored
- 10Last 12 monthspublished in the last year
- 0Critical2 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-54738
Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo
LemmyNet · lemmy
Medium6.5 - CVE-2026-54743
Lemmy: Stored XSS via markdown image alt-text in lemmy-ui html5-embed
LemmyNet · lemmy
Medium6.4 - CVE-2026-54739
Lemmy: Login Endpoint User Enumeration via HTTP Response Code Differential
LemmyNet · lemmy
Medium6.9 - CVE-2026-54740
Lemmy: Lower-ranked federated moderator can remove higher-ranked moderators
LemmyNet · lemmy
Medium6.5 - CVE-2026-54741
Lemmy: Blocked users can edit private messages sent before the block
LemmyNet · lemmy
Medium5.3 - CVE-2026-54742
Lemmy: `CollectionAdd::Featured` does not check the post is in the community
LemmyNet · lemmy
Medium5.1 - CVE-2026-42180
Lemmy: SSRF in /api/v3/post via Webmention dispatch
LemmyNet · lemmy
Medium6.3 - CVE-2026-42181
Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:image
LemmyNet · lemmy
Medium6.5 - CVE-2026-33693
Lemmy's Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()
LemmyNet · lemmy
Medium6.5 - CVE-2026-29178
Lemmy: Unauthenticated SSRF via file_type query parameter injection in image endpoint
LemmyNet · lemmy
High7.7