# cve.now: Misskey-dev

The newest entries naming Misskey-dev as an affected vendor (up to 200), of 38 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-103937](https://cve.now/CVE-2026-103937.md): Misskey: Denial of service resulting from insufficient cleanup processing during file uploads (CVSS 8.7)
- [CVE-2026-104817](https://cve.now/CVE-2026-104817.md): Misskey: Lack of rate limiting and size restrictions in RSS fetching API (CVSS 8.7)
- [CVE-2026-104816](https://cve.now/CVE-2026-104816.md): Misskey: Cross-site scripting in RSS feed item links (CVSS 8.5)
- [CVE-2026-46714](https://cve.now/CVE-2026-46714.md): Misskey: Denial of Service via Uncontrolled Recursion in Theme Compilation (CVSS 5.1)
- [CVE-2026-47746](https://cve.now/CVE-2026-47746.md): Misskey: JSON-LD signature validation + compaction is vulnerable to timing attacks (CVSS 8.9)
- [CVE-2026-46713](https://cve.now/CVE-2026-46713.md): Misskey: JSON-LD signature validation + compaction may lead to improper activity handling (CVSS 9.2)
- [CVE-2026-46712](https://cve.now/CVE-2026-46712.md): Misskey: Lack of proper permission checks in Direct Messaging feature (CVSS 2.3)
- [CVE-2026-48115](https://cve.now/CVE-2026-48115.md): Misskey: Improper Authorization in the Announcements API (CVSS 6.3)
- [CVE-2026-57574](https://cve.now/CVE-2026-57574.md): Misskey: TOTP tokens can be reused (CVSS 7.4)
- [CVE-2026-57575](https://cve.now/CVE-2026-57575.md): Misskey: SSRF bypass in URL Preview (CVSS 6.9)
- [CVE-2026-28433](https://cve.now/CVE-2026-28433.md): Misskey lacks resource ownership validation (CVSS 2.3)
- [CVE-2026-28432](https://cve.now/CVE-2026-28432.md): HTTP signature verification can be bypassed (CVSS 7.1)
- [CVE-2026-28431](https://cve.now/CVE-2026-28431.md): Misskey lacks proper authorization checks and input validation (CVSS 9.2)
- [CVE-2025-66482](https://cve.now/CVE-2025-66482.md): Misskey has a login rate limit bypass via spoofed X-Forwarded-For header (CVSS 6.9)
- [CVE-2025-66402](https://cve.now/CVE-2025-66402.md): misskey.js's export data contains private post data (CVSS 7.1)
- [CVE-2025-46559](https://cve.now/CVE-2025-46559.md): Misskey Directory Traversal Vulnerability in AiScript via \`Mk:api\` (CVSS 5.4)
- [CVE-2025-46340](https://cve.now/CVE-2025-46340.md): Misskey CSS Style Injection Vulnerability In \`MkUrlPreview\` (CVSS 7.2)
- [CVE-2025-46553](https://cve.now/CVE-2025-46553.md): @misskey-dev/summaly Redirect Filter Bypass (CVSS 2.1)
- [CVE-2025-25306](https://cve.now/CVE-2025-25306.md): Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes (CVSS 9.3)
- [CVE-2025-24897](https://cve.now/CVE-2025-24897.md): Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes (CVSS 8.2)
- [CVE-2025-24896](https://cve.now/CVE-2025-24896.md): Misskey allows token to remain valid in cookie after signing out (CVSS 8.1)
- [CVE-2024-49363](https://cve.now/CVE-2024-49363.md): Uncontrolled Recursion and Asymmetric Resource Consumption (Amplification) in media/file proxy in Misskey (CVSS 7.4)
- [CVE-2024-52579](https://cve.now/CVE-2024-52579.md): Server-Side Request Forgery vulnerability in various APIs in Misskey (CVSS 6.4)
- [CVE-2024-52590](https://cve.now/CVE-2024-52590.md): Missing validation allows spoofed profiles in Misskey (CVSS 8.8)
- [CVE-2024-52591](https://cve.now/CVE-2024-52591.md): Missing validation allows spoofed profiles and notes in Misskey (CVSS 8.8)
- [CVE-2024-52592](https://cve.now/CVE-2024-52592.md): Missing validation allows spoofed poll updates in Misskey (CVSS 6.9)
- [CVE-2024-52593](https://cve.now/CVE-2024-52593.md): Missing validation allows spoofed "origin" links in Misskey (CVSS 5.1)
- [CVE-2024-32983](https://cve.now/CVE-2024-32983.md): Misskey allows the impersonation and takeover of remote accounts with unnormalized signed activities (CVSS 8.2)
- [CVE-2024-25636](https://cve.now/CVE-2024-25636.md): Lack of media type verification of Activity Streams objects allows impersonation and takeover of remote accounts (CVSS 7.1)
- [CVE-2023-52139](https://cve.now/CVE-2023-52139.md): Misskey vulnerable to improper authorization when accessing with third-party application (CVSS 9.1)
- [CVE-2023-49079](https://cve.now/CVE-2023-49079.md): Misskey's missing signature validation allows arbitrary users to impersonate any remote user. (CVSS 9.3)
- [CVE-2023-43793](https://cve.now/CVE-2023-43793.md): Misskey allows users to bypass authentication of Bull dashboard (CVSS 7.5)
- [CVE-2023-24810](https://cve.now/CVE-2023-24810.md): Cross site scripting (XSS) vulnerability using authentication callback in Misskey (CVSS 7.1)
- [CVE-2023-24811](https://cve.now/CVE-2023-24811.md): Cross site scripting (XSS) vulnerability using url preview in Misskey (CVSS 7.1)
- [CVE-2023-24812](https://cve.now/CVE-2023-24812.md): SQL injection of notes/search-by-tag (CVSS 8.8)
- [CVE-2023-25154](https://cve.now/CVE-2023-25154.md): Cross site scripting (XSS) of ActivityPub URI in misskey (CVSS 7.1)
- [CVE-2021-39195](https://cve.now/CVE-2021-39195.md): Server-Side Request Forgery vulnerability in misskey (CVSS 7.7)
- [CVE-2021-39169](https://cve.now/CVE-2021-39169.md): XSS vulnerability using dialog (CVSS 8.0)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/misskey-dev
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.