SEC.co
Emergency

By weakness (CWE)

CWE-180: related vulnerabilities

CVEs classified under CWE-180. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

1 published vulnerability

Known exploited (KEV)CriticalHighMediumAll recent
  • CVE-2026-42462HIGH 7.0

    Fedify, a TypeScript library for building federated applications using ActivityPub, contains a vulnerability that allows attackers to manipulate cryptographically signed activities without invalidating the signatures. By exploiting JSON-LD (JSON Linked Data) restructuring techniques, an attacker who receives a validly signed activity from a third party can alter its meaning and content while the Linked Data Signature remains valid. This breaks the integrity guarantee that signatures are supposed to provide, enabling attackers to forge or modify federated messages in a way that appears authentic.