ActivityPub vulnerabilities

CVEs whose affected-version data names the ActivityPub package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-63115Medium· 5.3

1w ago

ActivityPub Undo handler can unfollow or remove reposts on behalf of other accounts

ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the `Undo` handler allows a remote federated server to cause the service to act on a `follow` or `repost` as though the activity came …

▾ SunlitTryGhost · ActivityPubEPSS 0.14%via CVEORG