Vulnerabilities

TI-2026-73339 CVE-2026-103937

Incomplete cleanup in Misskey file uploads enables denial of service

MEDIUM 44

Misskey is an open source, federated social media platform.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00501 Published 2026-10-13 Fixed in 2025.4.1, 2026.7.0 CWE-459

TI-2026-73349 CVE-2026-104817

Missing rate limits in Misskey's unauthenticated RSS fetch API

MEDIUM 44

Misskey is an open source, federated social media platform.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0046 Published 2026-10-13 Fixed in 2026.7.0 CWE-405

TI-2026-73348 CVE-2026-104816

Cross-site scripting in Misskey RSS feed item links

MEDIUM 44

Misskey is an open source, federated social media platform.

CVSS 4.0HIGH 8.5 Network No auth User interaction EPSS 0.0063 Published 2026-10-13 Fixed in 2026.7.0 CWE-79

TI-2026-34339 CVE-2026-46714

Misskey: Denial of Service via Uncontrolled Recursion in Theme Compilation

LOW 24

Misskey is an open source, federated social media platform.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00445 Published 2026-08-03 Fixed in 2026.5.4 CWE-674

TI-2026-35246 CVE-2026-47746

Misskey: JSON-LD signature validation + compaction is vulnerable to timing attacks

LOW 38

Misskey is an open source, federated social media platform.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00282 Published 2026-08-03 Fixed in 2026.5.4 CWE-367

TI-2026-34338 CVE-2026-46713

Misskey: JSON-LD signature validation + compaction may lead to improper activity handling

MEDIUM 45

Misskey is an open source, federated social media platform.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.0028 Published 2026-08-03 Fixed in 2026.5.4 CWE-347

TI-2026-34337 CVE-2026-46712

Misskey: Lack of proper permission checks in Direct Messaging feature

LOW 12

Misskey is an open source, federated social media platform.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00364 Published 2026-08-03 Fixed in 2026.5.4 CWE-639

TI-2026-35555 CVE-2026-48115

Misskey: Improper Authorization in the Announcements API

LOW 28

Misskey is an open source, federated social media platform.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00421 Published 2026-08-03 Fixed in 2026.5.4 CWE-285

TI-2026-41425 CVE-2026-57574

Misskey: TOTP tokens can be reused

LOW 35

Misskey is an open source, federated social media platform.

CVSS 4.0HIGH 7.4 Network No auth User interaction EPSS 0.00551 Published 2026-07-10 Fixed in 2026.6.0 CWE-294

TI-2026-41426 CVE-2026-57575

Misskey: SSRF bypass in URL Preview

LOW 37

Misskey is an open source, federated social media platform.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00604 Published 2026-07-10 Fixed in 2026.6.0 CWE-918

TI-2026-22707 CVE-2026-28433

Misskey lacks resource ownership validation

LOW 12

Misskey is an open source, federated social media platform.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00249 Published 2026-03-09 Fixed in 2026.3.1 CWE-639

TI-2026-22706 CVE-2026-28432

HTTP signature verification can be bypassed

LOW 36

Misskey is an open source, federated social media platform.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00172 Published 2026-03-09 Fixed in 2026.3.1 CWE-347

TI-2026-22705 CVE-2026-28431

Misskey lacks proper authorization checks and input validation

MEDIUM 45

Misskey is an open source, federated social media platform.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00284 Published 2026-03-09 Fixed in 2026.3.1 CWE-285

TI-2025-40906 CVE-2025-66482 · GHSA-wwrj-3hvj-prpm

Misskey has a login rate limit bypass via spoofed X-Forwarded-For header

HIGH 70

Misskey is an open source, federated social media platform.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00339 Published 2025-12-15 Fixed in 2025.12.0-alpha.2 CWE-1188

TI-2025-40839 CVE-2025-66402 · GHSA-496g-mmpw-j9x3

misskey.js's export data contains private post data

MEDIUM 64

Misskey is an open source, federated social media platform.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00314 Published 2025-12-15 Fixed in 2025.12.0 CWE-862

TI-2025-29276 CVE-2025-46559

Misskey Directory Traversal Vulnerability in AiScript via `Mk:api`

HIGH 66

Misskey is an open source, federated social media platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00458 Published 2025-05-05 Fixed in 2025.4.1 CWE-22

TI-2025-29081 CVE-2025-46340

Misskey CSS Style Injection Vulnerability In `MkUrlPreview`

HIGH 71

Misskey is an open source, federated social media platform.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00259 Published 2025-05-05 Fixed in 2025.4.1 CWE-116

TI-2025-29271 CVE-2025-46553 · GHSA-7899-w6c4-vqc4

@misskey-dev/summaly Redirect Filter Bypass

MEDIUM 50

@misskey-dev/summaly is a tool for getting a summary of a web page.

CVSS 4.0LOW 2.1 Network No auth User interaction EPSS 0.00264 Published 2025-05-05 Fixed in 5.2.1 CWE-601

TI-2025-18960 CVE-2025-25306

Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes

MEDIUM 45

Misskey is an open source, federated social media platform.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.0018 Published 2025-03-10 Fixed in 2025.2.1 CWE-1025

TI-2025-18599 CVE-2025-24897

Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes

HIGH 75

Misskey is an open source, federated social media platform.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00137 Published 2025-02-11 Fixed in 2025.2.0-alpha.0 CWE-1275

TI-2025-18598 CVE-2025-24896

Misskey allows token to remain valid in cookie after signing out

LOW 38

Misskey is an open source, federated social media platform.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00599 Published 2025-02-11 Fixed in 2025.2.0-alpha.0 CWE-613

TI-2024-32951 CVE-2024-49363

Uncontrolled Recursion and Asymmetric Resource Consumption (Amplification) in media/file proxy in Misskey

LOW 32

Misskey is an open source, federated social media platform.

CVSS 3.1HIGH 7.4 Network No auth User interaction EPSS 0.00324 Published 2024-12-18 No fix listed CWE-405

TI-2024-35240 CVE-2024-52579

Server-Side Request Forgery vulnerability in various APIs in Misskey

LOW 28

Misskey is an open source, federated social media platform.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00221 Published 2024-12-18 Fixed in 2024.11.0-alpha.3 CWE-20

TI-2024-35250 CVE-2024-52590

Missing validation allows spoofed profiles in Misskey

MEDIUM 44

Misskey is an open source, federated social media platform.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.0035 Published 2024-12-18 Fixed in 2024.11.0-alpha.3 CWE-20

TI-2024-35251 CVE-2024-52591

Missing validation allows spoofed profiles and notes in Misskey

MEDIUM 44

Misskey is an open source, federated social media platform.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00315 Published 2024-12-18 Fixed in 2024.11.0-alpha.3 CWE-20

Vulnerabilities

Filters