MI
Product
misskey
19
CVEs
0
On KEV
9.3
Max CVSS
3
New 30D
Severity mix
Critical 2High 8Medium 8Low 1
Watch
Add misskey to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-52591 | 9.3 | Dec 18 | Missing validation allows spoofed profiles and notes in Misskey Affected: < 2024.11.0-alpha.3 |
| CVE-2026-46713 | 9.2 | Aug 3 | Misskey: JSON-LD signature validation + compaction may lead to improper activity handling Affected: >= 12.37.0, < 2026.5.4 |
| CVE-2026-47746 | 8.9 | Aug 3 | Misskey: JSON-LD signature validation + compaction is vulnerable to timing attacks Affected: >= 12.37.0, < 2026.5.4 |
| CVE-2026-103937 | 8.7 | Oct 13 | Misskey: Denial of service resulting from insufficient cleanup processing during file uploads Affected: >= 12.0.0, <= 13.14.2; >= 2023.9.0-beta.1, < 2025.4.1; >= 2025.5.0, < 2026.7.0 |
| CVE-2026-104817 | 8.7 | Oct 13 | Misskey: Lack of rate limiting and size restrictions in RSS fetching API Affected: >= 12.0.0, <= 13.14.2; >= 2023.9.0-beta.1, < 2026.7.0 |
| CVE-2026-104816 | 8.5 | Oct 13 | Misskey: Cross-site scripting in RSS feed item links Affected: >= 12.0.0, <= 13.14.2; >= 2023.9.0-beta.1, < 2026.7.0 |
| CVE-2026-28432 | 7.5 | Mar 9 | HTTP signature verification can be bypassed Affected: < 2026.3.1 |
| CVE-2026-28431 | 7.5 | Mar 9 | Misskey lacks proper authorization checks and input validation Affected: >= 8.45.0, < 2026.3.1 |
| CVE-2026-57574 | 7.4 | Jul 10 | Misskey: TOTP tokens can be reused Affected: < 2026.6.0 |
| CVE-2024-49363 | 7.4 | Dec 18 | Uncontrolled Recursion and Asymmetric Resource Consumption (Amplification) in media/file proxy in Misskey Affected: < CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H |
| CVE-2026-57575 | 6.9 | Jul 10 | Misskey: SSRF bypass in URL Preview Affected: < 2026.6.0 |
| CVE-2024-52590 | 6.5 | Dec 18 | Missing validation allows spoofed profiles in Misskey Affected: >= 2024.8.0-rc.3, < 2024.11.0-alpha.3 |
| CVE-2026-48115 | 6.3 | Aug 3 | Misskey: Improper Authorization in the Announcements API Affected: >= 2024.5.0, < 2026.5.4 |
| CVE-2024-52579 | 5.4 | Dec 18 | Server-Side Request Forgery vulnerability in various APIs in Misskey Affected: < 2024.11.0-alpha.3 |
| CVE-2024-52592 | 5.3 | Dec 18 | Missing validation allows spoofed poll updates in Misskey Affected: >= 10.92.1, < 2024.11.0-alpha.3 |
| CVE-2024-52593 | 5.3 | Dec 18 | Missing validation allows spoofed "origin" links in Misskey Affected: >= 12.29.0, < 2024.11.0-alpha.3 |
| CVE-2026-46714 | 5.1 | Aug 3 | Misskey: Denial of Service via Uncontrolled Recursion in Theme Compilation Affected: >= 8.63.0, < 2026.5.4 |
| CVE-2026-28433 | 4.3 | Mar 9 | Misskey lacks resource ownership validation Affected: >= 10.93.0, < 2026.3.1 |
| CVE-2026-46712 | 2.3 | Aug 3 | Misskey: Lack of proper permission checks in Direct Messaging feature Affected: >= 2025.3.2, < 2026.5.4 |
Showing 19