{"vulnerability": "cve-2026-5013", "sightings": [{"uuid": "2c8fa618-ec5f-49e0-9dba-22437b90b424", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5013", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mi5ujbhlua2s", "content": "", "creation_timestamp": "2026-03-29T00:14:35.822436Z"}, {"uuid": "8d19eb19-0afb-4c3a-b472-7430464e425d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50131", "type": "seen", "source": "https://bsky.app/profile/fedify.hollo.social.ap.brid.gy/post/3mnrwxyyvdir2", "content": "### Fedify security updates: 1.9.12, 1.10.11, 2.0.20, 2.1.16, and 2.2.5\n\nIf you use Fedify, update to a patched release now. CVE-2026-50131 affects Fedify's public URL validation for remote document and media loading. An attacker could use special-use IP address ranges to bypass Fedify's SSRF [\u2026]", "creation_timestamp": "2026-06-08T14:57:55.145967Z"}, {"uuid": "bb5ca124-96f4-4925-a9e2-81d3902daeb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50131", "type": "seen", "source": "https://bsky.app/profile/hollo.hollo.social.ap.brid.gy/post/3mnrxlz2slhe2", "content": "### Hollo security updates: 0.7.18, 0.8.7, and 0.9.4\n\nIf you run Hollo, update to a patched release now. CVE-2026-50131 affects Fedify's SSRF protection, and Hollo depends on Fedify for ActivityPub federation.\n\nFedify guards against SSRF (Server-Side Request Forgery) when fetching remote [\u2026]", "creation_timestamp": "2026-06-08T15:09:05.707464Z"}, {"uuid": "803efc98-53ae-4bc4-9ddd-628da427271b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50131", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mnt5okxrpl2a", "content": "Top 3 CVE for last 7 days:\nCVE-2025-48595: 137 interactions\nCVE-2015-5119: 20 interactions\nCVE-2020-0601: 20 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-50751: 6 interactions\nCVE-2025-8088: 5 interactions\nCVE-2026-50131: 5 interactions\n", "creation_timestamp": "2026-06-09T02:30:30.807490Z"}, {"uuid": "5bf4af89-cada-4e69-b3e1-0008c64e9ab9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50131", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnxsdlo6672x", "content": "CVE-2026-50131 - Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges\nCVE ID : CVE-2026-50131\n \n Published : June 10, 2026, 8:27 p.m. | 50\u00a0minutes ago\n \n Description : Fedify is a TypeScript library for building f...", "creation_timestamp": "2026-06-10T22:51:04.533382Z"}, {"uuid": "dd1ac896-fccb-47ea-ac2b-f31f7ebcff93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50131", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mnxsve6fp726", "content": "\ud83d\udfe0 CVE-2026-50131 - High (8.6)\n\nFedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-50131/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-10T23:00:46.126401Z"}, {"uuid": "0e1ada2c-b2ba-40c0-a0d3-7d09179061b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-50137", "type": "published-proof-of-concept", "source": "https://github.com/Budibase/budibase/security/advisories/GHSA-35c4-rvc8-frhm", "content": "", "creation_timestamp": "2026-05-28T09:58:22.000000Z"}, {"uuid": "4b997e7e-97ec-4159-8ac3-acfd488b4869", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-50136", "type": "published-proof-of-concept", "source": "https://github.com/Budibase/budibase/security/advisories/GHSA-jj36-r9w3-3pfh", "content": "", "creation_timestamp": "2026-05-28T09:02:01.000000Z"}, {"uuid": "94ef0e66-df38-41e2-855c-d0a8a48a096b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-50132", "type": "published-proof-of-concept", "source": "https://github.com/Budibase/budibase/security/advisories/GHSA-v7j5-vc4m-723w", "content": "", "creation_timestamp": "2026-05-28T08:45:18.000000Z"}, {"uuid": "5a4ee430-061f-4358-95fe-9b54c4084767", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50136", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp7wsw7ek52c", "content": "CVE-2026-50136 - Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials\nCVE ID : CVE-2026-50136\n \n Published : June 26, 2026, 8:36 p.m. | 1\u00a0hour, 8\u00a0minutes ago\n \n Description : Budibase is an open-source low-code pl...", "creation_timestamp": "2026-06-26T21:57:27.970291Z"}, {"uuid": "79aff5b2-d247-4d5f-b9fa-8f9b77401d61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50132", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp7xbuj7lr2i", "content": "CVE-2026-50132 - Budibase: Chat Identity Link Hijacking via Missing Consent & CSRF \u2014 Account Impersonation in Budibase\nCVE ID : CVE-2026-50132\n \n Published : June 26, 2026, 8:34 p.m. | 1\u00a0hour, 10\u00a0minutes ago\n \n Description : Budibase is an open-source low-code platform. Prior ...", "creation_timestamp": "2026-06-26T22:05:49.047476Z"}, {"uuid": "04c2b9dd-af44-4702-9daa-6b189567d162", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50137", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp7z7vspb72c", "content": "CVE-2026-50137 - Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials\nCVE ID : CVE-2026-50137\n \n Published : June 26, 2026, 8:41 p.m. | 1\u00a0hour, 4\u00a0minutes ago\n \n Descr...", "creation_timestamp": "2026-06-26T22:40:31.225389Z"}, {"uuid": "cbcc9a9b-4b3c-4904-b6a6-1f5bc902c867", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50136", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mpbgn6otjo2j", "content": "CVE-2026-50136 - Supply Chain Attack in Budibase. Unauthenticated endpoint exposes S3 presigned URLs. CVSS 7.4. No known patch. Mitigate immediately. #CVE #Budibase #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-50136/", "creation_timestamp": "2026-06-27T12:13:15.011957Z"}, {"uuid": "6a56f1a9-ef87-4b03-85a4-c4cab422f136", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50137", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgq6ibc5n2w", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-50137 \u0432 Budibase: \u0443\u0433\u0440\u043e\u0437\u0430 \u0434\u043b\u044f low-code \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/02D2FAC1-8F3B-483D-BE37-FE24D6774AD0", "creation_timestamp": "2026-06-29T14:47:17.745093Z"}, {"uuid": "6740d0ef-6772-4adc-a0fd-4c38d6a75fd2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-50139", "type": "published-proof-of-concept", "source": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-j48m-h7xq-2xpj", "content": "", "creation_timestamp": "2026-07-01T22:35:03.002855Z"}, {"uuid": "af1dc67f-fad7-4d0e-848b-0dacdf35dd30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-50138", "type": "published-proof-of-concept", "source": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-3whc-qvhv-xqjp", "content": "", "creation_timestamp": "2026-07-01T22:35:05.171691Z"}, {"uuid": "c15fa9d9-69eb-4e7b-acb0-6b1e3e6461e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50133", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpyunv5kaz2v", "content": "CVE-2026-50133 - Hugo: XSS via text/html content files\nCVE ID : CVE-2026-50133\n \n Published : July 6, 2026, 7:31 p.m. | 16\u00a0minutes ago\n \n Description : Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the ...", "creation_timestamp": "2026-07-06T19:55:29.867197Z"}, {"uuid": "01382349-fcfc-4cd2-8b7b-f89c66a4fa8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50134", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpyw6hcang24", "content": "CVE-2026-50134 - Hugo: security.http.urls allow-list bypass via HTTP redirects\nCVE ID : CVE-2026-50134\n \n Published : July 6, 2026, 7:42 p.m. | 5\u00a0minutes ago\n \n Description : Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http...", "creation_timestamp": "2026-07-06T20:22:34.527942Z"}, {"uuid": "a2da1b9c-1ccf-41dd-aa2f-e2db9afbac1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50131", "type": "seen", "source": "https://t.me/GithubRedTeam/92590", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #SSRF #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-50131\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a chaitanyagarware\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-09 00:49:56\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-50131 / GHSA-xw9q-2mv6-9fr8: Fedify incomplete SSRF mitigation advisory landing page\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:06.716575Z"}, {"uuid": "3a25fe72-d760-44b5-a43d-1cb2afb9af5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50131", "type": "seen", "source": "https://t.me/GithubRedTeam/92590", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #SSRF #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-50131\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a chaitanyagarware\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-09 00:49:56\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-50131 / GHSA-xw9q-2mv6-9fr8: Fedify incomplete SSRF mitigation advisory landing page\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T01:00:11.006272Z"}, {"uuid": "ec8085dc-12e4-4f52-b649-9decf74ef82c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50131", "type": "seen", "source": "https://gist.github.com/alon710/8c969173ef01652db3c3dd0115519a9e", "content": "# CVE-2026-50131: CVE-2026-50131: Server-Side Request Forgery Validation Bypass in Fedify\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-07-14\n> **Full Report:** https://cvereports.com/reports/CVE-2026-50131\n\n## Summary\nFedify, a TypeScript framework for ActivityPub servers, implemented incomplete public URL validation inside the @fedify/fedify and @fedify/vocab-runtime libraries. The validator only blocked basic RFC 1918 networks, standard loopbacks, and link-local addresses, failing to restrict Carrier-Grade NAT (CGNAT), benchmarking, reserved, or IPv6 transition addresses. Consequently, unauthenticated remote attackers can bypass SSRF filters to access sensitive internal microservices and endpoints.\n\n## TL;DR\nIncomplete IP validation in Fedify enables unauthenticated remote attackers to bypass SSRF protections and access internal services by using CGNAT, benchmarking, and IPv6 transition IP addresses.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 8.6\n- **EPSS Score**: 0.00269 (0.269%)\n- **Impact**: High Confidentiality, Low Integrity, Low Availability\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Fedify\n- @fedify/fedify\n- @fedify/vocab-runtime\n- **@fedify/fedify**: >= 0.11.2, < 1.9.12 (Fixed in: `1.9.12`)\n- **@fedify/fedify**: >= 1.10.0, < 1.10.11 (Fixed in: `1.10.11`)\n- **@fedify/fedify**: >= 2.0.0, < 2.0.19 (Fixed in: `2.0.19`)\n- **@fedify/fedify**: >= 2.1.0, < 2.1.15 (Fixed in: `2.1.15`)\n- **@fedify/fedify**: >= 2.2.0, < 2.2.4 (Fixed in: `2.2.4`)\n- **@fedify/vocab-runtime**: < 2.0.19 (Fixed in: `2.0.19`)\n- **@fedify/vocab-runtime**: >= 2.1.0, < 2.1.15 (Fixed in: `2.1.15`)\n- **@fedify/vocab-runtime**: >= 2.2.0, < 2.2.4 (Fixed in: `2.2.4`)\n\n## Mitigation\n\n- Upgrade Fedify and Vocab-Runtime packages immediately\n- Enforce network-level egress blocking for private subnets\n- Pin HTTP requests strictly to validated IP addresses to prevent DNS rebinding\n\n**Remediation Steps:**\n1. Audit the current codebase dependencies using package-lock.json or pnpm-lock.yaml for vulnerable versions of @fedify/fedify (< 1.9.12, < 1.10.11, < 2.0.19, < 2.1.15, < 2.2.4).\n2. Update the dependency configuration to specify secure, patched versions.\n3. Deploy the updated software to production servers.\n4. Configure network edge routers and container configurations to drop outbound traffic originating from application servers directed to private or CGNAT addresses.\n\n## References\n\n- [GitHub Security Advisory GHSA-xw9q-2mv6-9fr8](https://github.com/fedify-dev/fedify/security/advisories/GHSA-xw9q-2mv6-9fr8)\n- [GitHub Repository - CVE-2026-50131 Analysis and PoC Index](https://github.com/chaitanyagarware/CVE-2026-50131)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-50131) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-14T18:41:49.908541Z"}, {"uuid": "159d5e3c-0070-4270-b221-99cf5b212c0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-50131", "type": "published-proof-of-concept", "source": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-xw9q-2mv6-9fr8", "content": "", "creation_timestamp": "2026-07-14T20:35:06.885669Z"}, {"uuid": "70e593bd-3209-400a-9f99-42c4d81313e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50130", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqncqrzxsk2a", "content": "\ud83d\udfe0 CVE-2026-50130 - High (8.8)\n\nPi-hole is a DNS sinkhole that protects devices from unwanted content without installing any clie...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-50130/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-14T23:00:49.765279Z"}, {"uuid": "09319407-5ebc-42d0-98b3-6049afc4e9b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50131", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/92590", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #SSRF #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-50131\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a chaitanyagarware\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-09 00:49:56\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-50131 / GHSA-xw9q-2mv6-9fr8: Fedify incomplete SSRF mitigation advisory landing page\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:33.549080Z"}, {"uuid": "4dc6325f-934f-4edc-8755-e6d59b6f6be6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50130", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqngxrbyxq2l", "content": "CVE-2026-50130 - Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate`\nCVE ID : CVE-2026-50130\n \n Published : July 14, 2026, 10:17 p.m. | 1\u00a0hour, 14\u00a0minutes ago\n \n Description : Pi-hole is a DNS sinkhole that protects devices from unwanted ...", "creation_timestamp": "2026-07-15T00:16:18.410178Z"}]}