Vulnerabilities

TI-2026-22707 CVE-2026-28433

Misskey lacks resource ownership validation

LOW 12

Misskey is an open source, federated social media platform.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00249 Published 2026-03-09 Fixed in 2026.3.1 CWE-639

TI-2026-22706 CVE-2026-28432

HTTP signature verification can be bypassed

LOW 36

Misskey is an open source, federated social media platform.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00172 Published 2026-03-09 Fixed in 2026.3.1 CWE-347

TI-2026-22705 CVE-2026-28431

Misskey lacks proper authorization checks and input validation

MEDIUM 45

Misskey is an open source, federated social media platform.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00284 Published 2026-03-09 Fixed in 2026.3.1 CWE-285

TI-2025-40906 CVE-2025-66482 · GHSA-wwrj-3hvj-prpm

Misskey has a login rate limit bypass via spoofed X-Forwarded-For header

HIGH 70

Misskey is an open source, federated social media platform.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00339 Published 2025-12-15 Fixed in 2025.12.0-alpha.2 CWE-1188

TI-2025-40839 CVE-2025-66402 · GHSA-496g-mmpw-j9x3

misskey.js's export data contains private post data

MEDIUM 64

Misskey is an open source, federated social media platform.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00314 Published 2025-12-15 Fixed in 2025.12.0 CWE-862

TI-2025-29276 CVE-2025-46559

Misskey Directory Traversal Vulnerability in AiScript via `Mk:api`

HIGH 66

Misskey is an open source, federated social media platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00458 Published 2025-05-05 Fixed in 2025.4.1 CWE-22

TI-2025-29081 CVE-2025-46340

Misskey CSS Style Injection Vulnerability In `MkUrlPreview`

HIGH 71

Misskey is an open source, federated social media platform.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00259 Published 2025-05-05 Fixed in 2025.4.1 CWE-116

TI-2025-18960 CVE-2025-25306

Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes

MEDIUM 45

Misskey is an open source, federated social media platform.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.0018 Published 2025-03-10 Fixed in 2025.2.1 CWE-1025

TI-2025-18599 CVE-2025-24897

Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes

HIGH 75

Misskey is an open source, federated social media platform.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00137 Published 2025-02-11 Fixed in 2025.2.0-alpha.0 CWE-1275

TI-2025-18598 CVE-2025-24896

Misskey allows token to remain valid in cookie after signing out

LOW 38

Misskey is an open source, federated social media platform.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00599 Published 2025-02-11 Fixed in 2025.2.0-alpha.0 CWE-613

TI-2024-35240 CVE-2024-52579

Server-Side Request Forgery vulnerability in various APIs in Misskey

LOW 28

Misskey is an open source, federated social media platform.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00221 Published 2024-12-18 Fixed in 2024.11.0-alpha.3 CWE-20

TI-2024-35250 CVE-2024-52590

Missing validation allows spoofed profiles in Misskey

MEDIUM 44

Misskey is an open source, federated social media platform.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.0035 Published 2024-12-18 Fixed in 2024.11.0-alpha.3 CWE-20

TI-2024-35251 CVE-2024-52591

Missing validation allows spoofed profiles and notes in Misskey

MEDIUM 44

Misskey is an open source, federated social media platform.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00315 Published 2024-12-18 Fixed in 2024.11.0-alpha.3 CWE-20

TI-2024-35252 CVE-2024-52592

Missing validation allows spoofed poll updates in Misskey

LOW 30

Misskey is an open source, federated social media platform.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00306 Published 2024-12-18 Fixed in 2024.11.0-alpha.3 CWE-20

TI-2024-35253 CVE-2024-52593

Missing validation allows spoofed "origin" links in Misskey

LOW 23

Misskey is an open source, federated social media platform.In affected versions missing validation in `NoteCreateService.insertNote`, `ApPersonService.createPerson`, and `ApPersonService.updatePerson` allows an attacker…

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00374 Published 2024-12-18 Fixed in 2024.11.0-alpha.3 CWE-20

TI-2024-21849 CVE-2024-32983

Misskey allows the impersonation and takeover of remote accounts with unnormalized signed activities

LOW 36

Misskey is an open source, decentralized microblogging platform.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.004 Published 2024-06-03 Fixed in 2024.5.0 CWE-863

TI-2024-16864 CVE-2024-25636

Lack of media type verification of Activity Streams objects allows impersonation and takeover of remote accounts

MEDIUM 41

Misskey is an open source, decentralized social media platform with ActivityPub support.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00655 Published 2024-02-19 Fixed in 2024.2.0 CWE-434

TI-2023-28578 CVE-2023-52139

Misskey vulnerable to improper authorization when accessing with third-party application

MEDIUM 42

Misskey is an open source, decentralized social media platform.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00549 Published 2023-12-29 Fixed in 2023.12.1 CWE-285

TI-2023-26744 CVE-2023-49079

Misskey's missing signature validation allows arbitrary users to impersonate any remote user.

MEDIUM 40

Misskey is an open source, decentralized social media platform.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.004 Published 2023-11-29 Fixed in 2023.11.1-beta.1 CWE-347

TI-2023-23484 CVE-2023-43793

Misskey allows users to bypass authentication of Bull dashboard

MEDIUM 40

Misskey is an open source, decentralized social media platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0084 Published 2023-10-04 Fixed in 2023.9.0 CWE-287

TI-2023-10310 CVE-2023-24810

Cross site scripting (XSS) vulnerability using authentication callback in Misskey

LOW 32

Misskey is an open source, decentralized social media platform.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00445 Published 2023-02-22 Fixed in 13.3.1 CWE-79

TI-2023-10311 CVE-2023-24811

Cross site scripting (XSS) vulnerability using url preview in Misskey

LOW 31

Misskey is an open source, decentralized social media platform.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00406 Published 2023-02-22 Fixed in 13.3.2 CWE-79

TI-2023-10312 CVE-2023-24812

SQL injection of notes/search-by-tag

MEDIUM 44

Misskey is an open source, decentralized social media platform.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0071 Published 2023-02-22 Fixed in 13.3.3 CWE-89

TI-2023-10616 CVE-2023-25154

Cross site scripting (XSS) of ActivityPub URI in misskey

LOW 32

Misskey is an open source, decentralized social media platform.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00429 Published 2023-02-22 Fixed in 13.5.0 CWE-79

TI-2021-16580 CVE-2021-39195

Server-Side Request Forgery vulnerability in misskey

LOW 36

Misskey is an open source, decentralized microblogging platform.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.01062 Published 2021-09-07 Fixed in 12.90.0 CWE-918

Vulnerabilities

Filters