Misskey-dev Misskey vulnerabilities

• misskey-dev misskey Misskey: Denial of service resulting from insufficient cleanup processing during file uploads CVE-2026-103937 8.7 HighOctober 13, 2026
• misskey-dev misskey Misskey: Lack of rate limiting and size restrictions in RSS fetching API CVE-2026-104817 8.7 HighOctober 13, 2026
• misskey-dev misskey Misskey: Cross-site scripting in RSS feed item links CVE-2026-104816 8.5 HighOctober 13, 2026
• misskey-dev misskey Misskey: Denial of Service via Uncontrolled Recursion in Theme Compilation CVE-2026-46714 5.1 MediumAugust 3, 2026
• misskey-dev misskey Misskey: JSON-LD signature validation + compaction is vulnerable to timing attacks CVE-2026-47746 8.9 HighAugust 3, 2026
• misskey-dev misskey Misskey: JSON-LD signature validation + compaction may lead to improper activity handling CVE-2026-46713 9.2 CriticalAugust 3, 2026
• misskey-dev misskey Misskey: Lack of proper permission checks in Direct Messaging feature CVE-2026-46712 2.3 LowAugust 3, 2026
• misskey-dev misskey Misskey: Improper Authorization in the Announcements API CVE-2026-48115 6.3 MediumAugust 3, 2026
• misskey-dev misskey Misskey: TOTP tokens can be reused CVE-2026-57574 7.4 HighJuly 10, 2026
• misskey-dev misskey Misskey: SSRF bypass in URL Preview CVE-2026-57575 6.9 MediumJuly 10, 2026
• misskey Misskey lacks resource ownership validation CVE-2026-28433 2.3 LowMarch 9, 2026
• misskey HTTP signature verification can be bypassed CVE-2026-28432 7.1 HighMarch 9, 2026
• misskey Misskey lacks proper authorization checks and input validation CVE-2026-28431 9.2 CriticalMarch 9, 2026
• misskey Misskey has a login rate limit bypass via spoofed X-Forwarded-For header CVE-2025-66482 Fix available 6.9 MediumDecember 15, 2025
• misskey misskey.js's export data contains private post data CVE-2025-66402 Fix available 7.1 HighDecember 15, 2025
• misskey Misskey Directory Traversal Vulnerability in AiScript via `Mk:api` CVE-2025-46559 5.4 MediumMay 5, 2025
• misskey Misskey CSS Style Injection Vulnerability In `MkUrlPreview` CVE-2025-46340 7.2 HighMay 5, 2025
• misskey Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes CVE-2025-25306 9.3 CriticalMarch 10, 2025
• misskey Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes CVE-2025-24897 8.2 HighFebruary 11, 2025
• misskey Misskey allows token to remain valid in cookie after signing out CVE-2025-24896 8.1 HighFebruary 11, 2025
• misskey-dev misskey Uncontrolled Recursion and Asymmetric Resource Consumption (Amplification) in media/file proxy in Misskey CVE-2024-49363 7.4 HighDecember 18, 2024
• misskey Server-Side Request Forgery vulnerability in various APIs in Misskey CVE-2024-52579 6.4 MediumDecember 18, 2024
• misskey Missing validation allows spoofed profiles in Misskey CVE-2024-52590 8.8 HighDecember 18, 2024
• misskey Missing validation allows spoofed profiles and notes in Misskey CVE-2024-52591 8.8 HighDecember 18, 2024
• misskey Missing validation allows spoofed poll updates in Misskey CVE-2024-52592 6.9 MediumDecember 18, 2024
• misskey Missing validation allows spoofed "origin" links in Misskey CVE-2024-52593 5.1 MediumDecember 18, 2024
• misskey Misskey allows the impersonation and takeover of remote accounts with unnormalized signed activities CVE-2024-32983 8.2 HighJune 3, 2024
• misskey Lack of media type verification of Activity Streams objects allows impersonation and takeover of remote accounts CVE-2024-25636 7.1 HighFebruary 19, 2024
• misskey Misskey vulnerable to improper authorization when accessing with third-party application CVE-2023-52139 9.1 CriticalDecember 29, 2023
• misskey Misskey's missing signature validation allows arbitrary users to impersonate any remote user. CVE-2023-49079 9.3 CriticalNovember 29, 2023
• misskey Misskey allows users to bypass authentication of Bull dashboard CVE-2023-43793 7.5 HighOctober 4, 2023
• misskey Cross site scripting (XSS) vulnerability using authentication callback in Misskey CVE-2023-24810 7.1 HighFebruary 22, 2023
• misskey Cross site scripting (XSS) vulnerability using url preview in Misskey CVE-2023-24811 7.1 HighFebruary 22, 2023
• misskey SQL injection of notes/search-by-tag CVE-2023-24812 8.8 HighFebruary 22, 2023
• misskey Cross site scripting (XSS) of ActivityPub URI in misskey CVE-2023-25154 7.1 HighFebruary 22, 2023
• misskey Server-Side Request Forgery vulnerability in misskey CVE-2021-39195 7.7 HighSeptember 7, 2021
• misskey XSS vulnerability using dialog CVE-2021-39169 8.0 HighAugust 27, 2021
• misskey Misskey before 10.102.4 allows hijacking a user's token. CVE-2019-1020010 Public exploit 6.1 MediumJuly 29, 2019