SEC.co
Emergency

By weakness (CWE)

CWE-1389: related vulnerabilities

CVEs classified under CWE-1389. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

1 published vulnerability

Known exploited (KEV)CriticalHighMediumAll recent
  • CVE-2026-50131HIGH 8.6

    Fedify, a TypeScript library for building ActivityPub-based federated servers, contains an incomplete validation bypass in its Server-Side Request Forgery (SSRF) defense. The library was previously patched to validate outbound requests against a list of non-public IPv4 ranges, but the validation logic fails to block several special-use and reserved address ranges. An attacker could craft requests to these inadequately-blocked ranges to access internal network resources or local services, potentially leading to information disclosure or lateral movement within infrastructure where Fedify applications are deployed.