misskey-dev misskey

• CVE-2026-103937 High 8.7 Misskey: Denial of service resulting from insufficient cleanup processing during file uploads 0.5%
• CVE-2026-104817 High 8.7 Misskey: Lack of rate limiting and size restrictions in RSS fetching API 0.5%
• CVE-2026-104816 High 8.5 Misskey: Cross-site scripting in RSS feed item links 0.6%
• CVE-2026-46714 Medium 5.1 Misskey: Denial of Service via Uncontrolled Recursion in Theme Compilation 0.4%
• CVE-2026-47746 High 8.9 Misskey: JSON-LD signature validation + compaction is vulnerable to timing attacks 0.3%
• CVE-2026-46713 Critical 9.2 Misskey: JSON-LD signature validation + compaction may lead to improper activity handling 0.3%
• CVE-2026-46712 Low 2.3 Misskey: Lack of proper permission checks in Direct Messaging feature 0.4%
• CVE-2026-48115 Medium 6.3 Misskey: Improper Authorization in the Announcements API 0.4%
• CVE-2026-57574 High 7.4 Misskey: TOTP tokens can be reused 0.6%
• CVE-2026-57575 Medium 6.9 Misskey: SSRF bypass in URL Preview 0.6%
• CVE-2026-28433 Low 2.3 Misskey lacks resource ownership validation 0.2%
• CVE-2026-28432 High 7.1 HTTP signature verification can be bypassed 0.2%
• CVE-2026-28431 Critical 9.2 Misskey lacks proper authorization checks and input validation 0.3%
• CVE-2025-66482 Medium 6.9 Misskey has a login rate limit bypass via spoofed X-Forwarded-For header 0.3%
• CVE-2025-66402 High 7.1 misskey.js's export data contains private post data 0.3%
• CVE-2025-46559 Medium 5.4 Misskey Directory Traversal Vulnerability in AiScript via `Mk:api` 0.5%
• CVE-2025-46340 High 7.2 Misskey CSS Style Injection Vulnerability In `MkUrlPreview` 0.3%
• CVE-2025-25306 Critical 9.3 Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes 0.2%
• CVE-2025-24897 High 8.2 Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes 0.1%
• CVE-2025-24896 High 8.1 Misskey allows token to remain valid in cookie after signing out 0.6%
• CVE-2024-49363 High 7.4 Uncontrolled Recursion and Asymmetric Resource Consumption (Amplification) in media/file proxy in Misskey 0.3%
• CVE-2024-52579 Medium 6.4 Server-Side Request Forgery vulnerability in various APIs in Misskey 0.2%
• CVE-2024-52590 High 8.8 Missing validation allows spoofed profiles in Misskey 0.4%
• CVE-2024-52591 High 8.8 Missing validation allows spoofed profiles and notes in Misskey 0.3%
• CVE-2024-52592 Medium 6.9 Missing validation allows spoofed poll updates in Misskey 0.3%
• CVE-2024-52593 Medium 5.1 Missing validation allows spoofed "origin" links in Misskey 0.4%
• CVE-2024-32983 High 8.2 Misskey allows the impersonation and takeover of remote accounts with unnormalized signed activities 0.4%
• CVE-2024-25636 High 7.1 Lack of media type verification of Activity Streams objects allows impersonation and takeover of remote accounts 0.7%
• CVE-2023-52139 Critical 9.1 Misskey vulnerable to improper authorization when accessing with third-party application 0.5%
• CVE-2023-49079 Critical 9.3 Misskey's missing signature validation allows arbitrary users to impersonate any remote user. 0.4%
• CVE-2023-43793 High 7.5 Misskey allows users to bypass authentication of Bull dashboard 0.8%
• CVE-2023-24810 High 7.1 Cross site scripting (XSS) vulnerability using authentication callback in Misskey 0.4%
• CVE-2023-24811 High 7.1 Cross site scripting (XSS) vulnerability using url preview in Misskey 0.4%
• CVE-2023-24812 High 8.8 SQL injection of notes/search-by-tag 0.7%
• CVE-2023-25154 High 7.1 Cross site scripting (XSS) of ActivityPub URI in misskey 0.4%
• CVE-2021-39195 High 7.7 Server-Side Request Forgery vulnerability in misskey 1.1%
• CVE-2021-39169 High 8.0 XSS vulnerability using dialog 0.7%