misskey-dev

Records39All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical6CVSS 9.0–10.0

CVSS high22CVSS 7.0–8.9

Exploited now

misskey-dev records in CISA KEV

No misskey-dev vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Misskey 27 records HIGH Summaly 1 record MEDIUM

Records

39 records

TI-2025-18599 CVE-2025-24897

Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes

HIGH 75

Misskey is an open source, federated social media platform.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00137 Published 2025-02-11 Fixed in 2025.2.0-alpha.0 CWE-1275

TI-2025-29081 CVE-2025-46340

Misskey CSS Style Injection Vulnerability In `MkUrlPreview`

HIGH 71

Misskey is an open source, federated social media platform.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00259 Published 2025-05-05 Fixed in 2025.4.1 CWE-116

TI-2025-40906 CVE-2025-66482 · GHSA-wwrj-3hvj-prpm

Misskey has a login rate limit bypass via spoofed X-Forwarded-For header

HIGH 70

Misskey is an open source, federated social media platform.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00339 Published 2025-12-15 Fixed in 2025.12.0-alpha.2 CWE-1188

TI-2025-29276 CVE-2025-46559

Misskey Directory Traversal Vulnerability in AiScript via `Mk:api`

HIGH 66

Misskey is an open source, federated social media platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00458 Published 2025-05-05 Fixed in 2025.4.1 CWE-22

TI-2025-40839 CVE-2025-66402 · GHSA-496g-mmpw-j9x3

misskey.js's export data contains private post data

MEDIUM 64

Misskey is an open source, federated social media platform.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00314 Published 2025-12-15 Fixed in 2025.12.0 CWE-862

TI-2025-29271 CVE-2025-46553 · GHSA-7899-w6c4-vqc4

@misskey-dev/summaly Redirect Filter Bypass

MEDIUM 50

@misskey-dev/summaly is a tool for getting a summary of a web page.

CVSS 4.0LOW 2.1 Network No auth User interaction EPSS 0.00264 Published 2025-05-05 Fixed in 5.2.1 CWE-601

TI-2026-34338 CVE-2026-46713

Misskey: JSON-LD signature validation + compaction may lead to improper activity handling

MEDIUM 45

Misskey is an open source, federated social media platform.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.0028 Published 2026-08-03 Fixed in 2026.5.4 CWE-347

TI-2026-22705 CVE-2026-28431

Misskey lacks proper authorization checks and input validation

MEDIUM 45

Misskey is an open source, federated social media platform.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00284 Published 2026-03-09 Fixed in 2026.3.1 CWE-285

TI-2025-18960 CVE-2025-25306

Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes

MEDIUM 45

Misskey is an open source, federated social media platform.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.0018 Published 2025-03-10 Fixed in 2025.2.1 CWE-1025

TI-2026-73349 CVE-2026-104817

Missing rate limits in Misskey's unauthenticated RSS fetch API

MEDIUM 44

Misskey is an open source, federated social media platform.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0046 Published 2026-10-13 Fixed in 2026.7.0 CWE-405

TI-2026-73348 CVE-2026-104816

Cross-site scripting in Misskey RSS feed item links

MEDIUM 44

Misskey is an open source, federated social media platform.

CVSS 4.0HIGH 8.5 Network No auth User interaction EPSS 0.0063 Published 2026-10-13 Fixed in 2026.7.0 CWE-79

TI-2026-73339 CVE-2026-103937

Incomplete cleanup in Misskey file uploads enables denial of service

MEDIUM 44

Misskey is an open source, federated social media platform.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00501 Published 2026-10-13 Fixed in 2025.4.1, 2026.7.0 CWE-459

TI-2024-35251 CVE-2024-52591

Missing validation allows spoofed profiles and notes in Misskey

MEDIUM 44

Misskey is an open source, federated social media platform.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00315 Published 2024-12-18 Fixed in 2024.11.0-alpha.3 CWE-20

TI-2024-35250 CVE-2024-52590

Missing validation allows spoofed profiles in Misskey

MEDIUM 44

Misskey is an open source, federated social media platform.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.0035 Published 2024-12-18 Fixed in 2024.11.0-alpha.3 CWE-20

TI-2023-10312 CVE-2023-24812

SQL injection of notes/search-by-tag

MEDIUM 44

Misskey is an open source, decentralized social media platform.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0071 Published 2023-02-22 Fixed in 13.3.3 CWE-89

TI-2023-28578 CVE-2023-52139

Misskey vulnerable to improper authorization when accessing with third-party application

MEDIUM 42

Misskey is an open source, decentralized social media platform.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00549 Published 2023-12-29 Fixed in 2023.12.1 CWE-285

TI-2024-16864 CVE-2024-25636

Lack of media type verification of Activity Streams objects allows impersonation and takeover of remote accounts

MEDIUM 41

Misskey is an open source, decentralized social media platform with ActivityPub support.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00655 Published 2024-02-19 Fixed in 2024.2.0 CWE-434

TI-2023-26744 CVE-2023-49079

Misskey's missing signature validation allows arbitrary users to impersonate any remote user.

MEDIUM 40

Misskey is an open source, decentralized social media platform.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.004 Published 2023-11-29 Fixed in 2023.11.1-beta.1 CWE-347

TI-2023-23484 CVE-2023-43793

Misskey allows users to bypass authentication of Bull dashboard

MEDIUM 40

Misskey is an open source, decentralized social media platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0084 Published 2023-10-04 Fixed in 2023.9.0 CWE-287

TI-2026-35246 CVE-2026-47746

Misskey: JSON-LD signature validation + compaction is vulnerable to timing attacks

LOW 38

Misskey is an open source, federated social media platform.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00282 Published 2026-08-03 Fixed in 2026.5.4 CWE-367

TI-2025-18598 CVE-2025-24896

Misskey allows token to remain valid in cookie after signing out

LOW 38

Misskey is an open source, federated social media platform.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00599 Published 2025-02-11 Fixed in 2025.2.0-alpha.0 CWE-613

TI-2026-41426 CVE-2026-57575

Misskey: SSRF bypass in URL Preview

LOW 37

Misskey is an open source, federated social media platform.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00604 Published 2026-07-10 Fixed in 2026.6.0 CWE-918

TI-2026-22706 CVE-2026-28432

HTTP signature verification can be bypassed

LOW 36

Misskey is an open source, federated social media platform.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00172 Published 2026-03-09 Fixed in 2026.3.1 CWE-347

TI-2024-21849 CVE-2024-32983

Misskey allows the impersonation and takeover of remote accounts with unnormalized signed activities

LOW 36

Misskey is an open source, decentralized microblogging platform.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.004 Published 2024-06-03 Fixed in 2024.5.0 CWE-863

TI-2021-16580 CVE-2021-39195

Server-Side Request Forgery vulnerability in misskey

LOW 36

Misskey is an open source, decentralized microblogging platform.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.01062 Published 2021-09-07 Fixed in 12.90.0 CWE-918

Open these records in search →

Critical	6
High	22
Medium	8
Low	3
No CVSS	0