Misskey vulnerabilities

Products

• Misskey 27

Newest

• misskey Misskey lacks resource ownership validation CVE-2026-28433 2.3 LowMarch 9, 2026
• misskey HTTP signature verification can be bypassed CVE-2026-28432 7.1 HighMarch 9, 2026
• misskey Misskey lacks proper authorization checks and input validation CVE-2026-28431 9.2 CriticalMarch 9, 2026
• misskey Misskey has a login rate limit bypass via spoofed X-Forwarded-For header CVE-2025-66482 Fix available 6.9 MediumDecember 15, 2025
• misskey misskey.js's export data contains private post data CVE-2025-66402 Fix available 7.1 HighDecember 15, 2025
• misskey Misskey Directory Traversal Vulnerability in AiScript via `Mk:api` CVE-2025-46559 5.4 MediumMay 5, 2025
• misskey Misskey CSS Style Injection Vulnerability In `MkUrlPreview` CVE-2025-46340 7.2 HighMay 5, 2025
• misskey summaly @misskey-dev/summaly Redirect Filter Bypass CVE-2025-46553 Fix available 2.1 LowMay 5, 2025
• misskey Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes CVE-2025-25306 9.3 CriticalMarch 10, 2025
• misskey Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes CVE-2025-24897 8.2 HighFebruary 11, 2025
• misskey Misskey allows token to remain valid in cookie after signing out CVE-2025-24896 8.1 HighFebruary 11, 2025
• misskey Server-Side Request Forgery vulnerability in various APIs in Misskey CVE-2024-52579 6.4 MediumDecember 18, 2024
• misskey Missing validation allows spoofed profiles in Misskey CVE-2024-52590 8.8 HighDecember 18, 2024
• misskey Missing validation allows spoofed profiles and notes in Misskey CVE-2024-52591 8.8 HighDecember 18, 2024
• misskey Missing validation allows spoofed poll updates in Misskey CVE-2024-52592 6.9 MediumDecember 18, 2024
• misskey Missing validation allows spoofed "origin" links in Misskey CVE-2024-52593 5.1 MediumDecember 18, 2024
• misskey Misskey allows the impersonation and takeover of remote accounts with unnormalized signed activities CVE-2024-32983 8.2 HighJune 3, 2024
• misskey Lack of media type verification of Activity Streams objects allows impersonation and takeover of remote accounts CVE-2024-25636 7.1 HighFebruary 19, 2024
• misskey Misskey vulnerable to improper authorization when accessing with third-party application CVE-2023-52139 9.1 CriticalDecember 29, 2023
• misskey Misskey's missing signature validation allows arbitrary users to impersonate any remote user. CVE-2023-49079 9.3 CriticalNovember 29, 2023
• misskey Misskey allows users to bypass authentication of Bull dashboard CVE-2023-43793 7.5 HighOctober 4, 2023
• misskey Cross site scripting (XSS) vulnerability using authentication callback in Misskey CVE-2023-24810 7.1 HighFebruary 22, 2023
• misskey Cross site scripting (XSS) vulnerability using url preview in Misskey CVE-2023-24811 7.1 HighFebruary 22, 2023
• misskey SQL injection of notes/search-by-tag CVE-2023-24812 8.8 HighFebruary 22, 2023
• misskey Cross site scripting (XSS) of ActivityPub URI in misskey CVE-2023-25154 7.1 HighFebruary 22, 2023
• misskey Server-Side Request Forgery vulnerability in misskey CVE-2021-39195 7.7 HighSeptember 7, 2021
• misskey XSS vulnerability using dialog CVE-2021-39169 8.0 HighAugust 27, 2021
• misskey Misskey before 10.102.4 allows hijacking a user's token. CVE-2019-1020010 Public exploit 6.1 MediumJuly 29, 2019