fedify-dev hollo vulnerabilities

Latest fedify-dev hollo CVEs

Newest publication first

1. CVE-2026-25808 Hollo DMs get leaked and can be seen on Webfinger Browser

   Published 2026-02-09

   High·CVSS 7.5

   Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Prior to 0.6.20 and 0.7.2, there is a security vulnerability where DMs and followers-only posts were exposed through the ActivityPub outbox endpoint without authorization. This v...

2. CVE-2025-53941 Hollo renders posts received with form elements and allows submission

   Published 2025-07-17

   Medium·CVSS 6.1

   Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Versions prior to 0.6.5 allow HTML form elements to be submitted, making the software vulnerable to HTML injection. Version 0.6.5 fixes the issue.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.