Vulnerabilities in misskey-dev

35 results
Vexday analysis

Misskey-dev apresenta 30 vulnerabilidades catalogadas, das quais 4 são críticas, sem registros de exploração ativa conhecida até o momento. A fraqueza dominante é validação inadequada de entrada (CWE-20), padrão que sugere falhas sistemáticas em sanitização de dados; o ritmo recente de 2 divulgações nos últimos 90 dias indica que a superfície de risco permanece em evolução.

CVE-2024-52592MEDIUMMissing validation allows spoofed poll updates in MisskeyEPSS 0.3%CVE-2025-66402HIGHmisskey.js's export data contains private post dataEPSS 0.3%CVE-2026-46714MEDIUMMisskey: Denial of Service via Uncontrolled Recursion in Theme CompilationEPSS 0.3%CVE-2026-48115MEDIUMMisskey: Improper Authorization in the Announcements APIEPSS 0.2%CVE-2025-46553LOW@misskey-dev/summaly Redirect Filter BypassEPSS 0.2%CVE-2026-28431CRITICALMisskey lacks proper authorization checks and input validationEPSS 0.2%CVE-2025-46340HIGHMisskey CSS Style Injection Vulnerability In `MkUrlPreview`EPSS 0.2%CVE-2026-28433LOWMisskey lacks resource ownership validationEPSS 0.2%CVE-2024-52579MEDIUMServer-Side Request Forgery vulnerability in various APIs in MisskeyEPSS 0.2%CVE-2026-46712LOWMisskey: Lack of proper permission checks in Direct Messaging featureEPSS 0.2%CVE-2026-47746HIGHMisskey: JSON-LD signature validation + compaction is vulnerable to timing attacksEPSS 0.2%CVE-2026-46713CRITICALMisskey: JSON-LD signature validation + compaction may lead to improper activity handlingEPSS 0.2%CVE-2025-25306CRITICALMisskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated NotesEPSS 0.2%CVE-2026-28432HIGHHTTP signature verification can be bypassedEPSS 0.1%CVE-2025-24897HIGHMisskey CSRF vulnerability due to insecure configuration of authentication cookie attributesEPSS 0.1%