misskey-dev misskey vulnerabilities

CVEs per yearBy the year they were published

1. 20212
2. 20237
3. 20248
4. 20257
5. 202613

Newest CVEs

• CVE-2026-103937

  Misskey: Denial of service resulting from insufficient cleanup processing during file uploads

  misskey-dev · misskey

  High8.7
• CVE-2026-104817

  Misskey: Lack of rate limiting and size restrictions in RSS fetching API

  misskey-dev · misskey

  High8.7
• CVE-2026-104816

  Misskey: Cross-site scripting in RSS feed item links

  misskey-dev · misskey

  High8.5
• CVE-2026-46714

  Misskey: Denial of Service via Uncontrolled Recursion in Theme Compilation

  misskey-dev · misskey

  Medium5.1
• CVE-2026-47746

  Misskey: JSON-LD signature validation + compaction is vulnerable to timing attacks

  misskey-dev · misskey

  High8.9
• CVE-2026-46713

  Misskey: JSON-LD signature validation + compaction may lead to improper activity handling

  misskey-dev · misskey

  Critical9.2
• CVE-2026-46712

  Misskey: Lack of proper permission checks in Direct Messaging feature

  misskey-dev · misskey

  Low2.3
• CVE-2026-48115

  Misskey: Improper Authorization in the Announcements API

  misskey-dev · misskey

  Medium6.3
• CVE-2026-57574

  Misskey: TOTP tokens can be reused

  misskey-dev · misskey

  High7.4
• CVE-2026-57575

  Misskey: SSRF bypass in URL Preview

  misskey-dev · misskey

  Medium6.9