Misskey-dev vulnerabilities
38 CVEs and advisories name Misskey-dev as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-103937Misskey: Denial of service resulting from insufficient cleanup processing during file uploads
- CVE-2026-104817Misskey: Lack of rate limiting and size restrictions in RSS fetching API
- CVE-2026-104816Misskey: Cross-site scripting in RSS feed item links
- CVE-2026-46714Misskey: Denial of Service via Uncontrolled Recursion in Theme Compilation
- CVE-2026-47746Misskey: JSON-LD signature validation + compaction is vulnerable to timing attacks
- CVE-2026-46713Misskey: JSON-LD signature validation + compaction may lead to improper activity handling
- CVE-2026-46712Misskey: Lack of proper permission checks in Direct Messaging feature
- CVE-2026-48115Misskey: Improper Authorization in the Announcements API
- CVE-2026-57574Misskey: TOTP tokens can be reused
- CVE-2026-57575Misskey: SSRF bypass in URL Preview
- CVE-2026-28433Misskey lacks resource ownership validation
- CVE-2026-28432HTTP signature verification can be bypassed
- CVE-2026-28431Misskey lacks proper authorization checks and input validation
- CVE-2025-66482Misskey has a login rate limit bypass via spoofed X-Forwarded-For header
- CVE-2025-66402misskey.js's export data contains private post data
- CVE-2025-46559Misskey Directory Traversal Vulnerability in AiScript via `Mk:api`
- CVE-2025-46340Misskey CSS Style Injection Vulnerability In `MkUrlPreview`
- CVE-2025-46553@misskey-dev/summaly Redirect Filter Bypass
- CVE-2025-25306Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes
- CVE-2025-24897Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes
- CVE-2025-24896Misskey allows token to remain valid in cookie after signing out
- CVE-2024-49363Uncontrolled Recursion and Asymmetric Resource Consumption (Amplification) in media/file proxy in Misskey
- CVE-2024-52579Server-Side Request Forgery vulnerability in various APIs in Misskey
- CVE-2024-52590Missing validation allows spoofed profiles in Misskey
- CVE-2024-52591Missing validation allows spoofed profiles and notes in Misskey
- CVE-2024-52592Missing validation allows spoofed poll updates in Misskey
- CVE-2024-52593Missing validation allows spoofed "origin" links in Misskey
- CVE-2024-32983Misskey allows the impersonation and takeover of remote accounts with unnormalized signed activities
- CVE-2024-25636Lack of media type verification of Activity Streams objects allows impersonation and takeover of remote accounts
- CVE-2023-52139Misskey vulnerable to improper authorization when accessing with third-party application