CVE-2026-46713criticalCWE-347

CVE-2026-46713: falha crítica em misskey-dev misskey

Misskey: JSON-LD signature validation + compaction may lead to improper activity handling

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar misskey

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.2epss 0.3%
Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, contain a vulnerability in the JSON-LD signature validation and compaction process that allows spoofed activities to be accepted as valid. This issue has been fixed in version 2026.5.4.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:H/SA:N
Produtos afetados
misskey-dev · misskey
CVEs relacionadas — misskey-dev misskey

No mesmo produto, das mais perigosas para as menos.

CVE-2021-39195HIGHServer-Side Request Forgery vulnerability in misskeyEPSS 1.1%CVE-2023-43793HIGHMisskey allows users to bypass authentication of Bull dashboardEPSS 0.8%CVE-2021-39169HIGHXSS vulnerability using dialogEPSS 0.7%CVE-2023-24812HIGHSQL injection of notes/search-by-tagEPSS 0.7%CVE-2024-25636HIGHLack of media type verification of Activity Streams objects allows impersonation and takeover of remote accountsEPSS 0.7%CVE-2026-104816HIGHMisskey: Cross-site scripting in RSS feed item linksEPSS 0.6%