Login Request a demo
MI
Product
misskey
by misskey-dev · last CVE Oct 13, 2026
19
CVEs
0
On KEV
9.3
Max CVSS
3
New 30D
Vulnerabilities19In the news0Timeline
Severity mix
Critical 2High 8Medium 8Low 1
Severity
All severities19Critical2High8Medium8Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add misskey to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-47746
8.9
0%
Aug 3
Misskey: JSON-LD signature validation + compaction is vulnerable to timing attacks
Affected: >= 12.37.0, < 2026.5.4
CVE-2026-103937
8.7
1%
Oct 13
Misskey: Denial of service resulting from insufficient cleanup processing during file uploads
Affected: >= 12.0.0, <= 13.14.2; >= 2023.9.0-beta.1, < 2025.4.1; >= 2025.5.0, < 2026.7.0
CVE-2026-104817
8.7
0%
Oct 13
Misskey: Lack of rate limiting and size restrictions in RSS fetching API
Affected: >= 12.0.0, <= 13.14.2; >= 2023.9.0-beta.1, < 2026.7.0
CVE-2026-104816
8.5
1%
Oct 13
Misskey: Cross-site scripting in RSS feed item links
Affected: >= 12.0.0, <= 13.14.2; >= 2023.9.0-beta.1, < 2026.7.0
CVE-2026-28432
7.5
0%
Mar 9
HTTP signature verification can be bypassed
Affected: < 2026.3.1
CVE-2026-28431
7.5
0%
Mar 9
Misskey lacks proper authorization checks and input validation
Affected: >= 8.45.0, < 2026.3.1
CVE-2026-57574
7.4
1%
Jul 10
Misskey: TOTP tokens can be reused
Affected: < 2026.6.0
CVE-2024-49363
7.4
0%
Dec 18
Uncontrolled Recursion and Asymmetric Resource Consumption (Amplification) in media/file proxy in Misskey
Affected: < CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H
Showing 8