Skip to content
Threat Feed
Subscribe

Tag

Activitypub

3 briefs RSS
high advisory

Cross-Site Scripting Vulnerability in Ghost ActivityPub Client

An XSS vulnerability in the @tryghost/activitypub package (CVE-2026-53950) allows attackers to inject arbitrary JavaScript via malicious ActivityPub server posts.

@tryghost/activitypub xss web-vulnerability activitypub
1t 1c
high advisory

YesWiki Unauthenticated ActivityPub Signature-Verification Bypass (CVE-2026-52767)

A critical vulnerability, CVE-2026-52767, in YesWiki's `HttpSignatureService::verifySignature()` allows unauthenticated attackers to bypass ActivityPub signature verification due to a loose boolean negation (`!openssl_verify(...)`) accepting `int(-1)` from PHP's `openssl_verify()` under specific conditions, enabling arbitrary Create, Update, and Delete operations on ActivityPub-enabled forms leading to defacement and content manipulation.

composer/yeswiki/yeswiki web-vulnerability php activitypub signature-bypass cve unauthenticated-access
1r 3t
high advisory

CVE-2026-58593: NodeBB ActivityPub Forgery Vulnerability

A critical vulnerability (CVE-2026-58593) in NodeBB's ActivityPub implementation allows a remote attacker to forge posts and direct messages attributed to arbitrary local users, including administrators, by manipulating the 'attributedTo' field in inbound ActivityPub objects.

PoC NodeBB +1 activitypub federation vulnerability web-application cms forgery
1t 1c updated