Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how misskey compares to other vendors in security performance

View Risk Score →

Misskey MisskeyMisskey: JSON-LD signature validation + compaction is vulnerable to timing attacks

Risk 46
Severity
8.9
First published (updated )
CVE-2026-47746

Misskey MisskeyMisskey: JSON-LD signature validation + compaction may lead to improper activity handling

Risk 58
Severity
9.2
First published (updated )
CVE-2026-46713

MisskeyMisskey lacks resource ownership validation

Risk 17
Severity
4.3
EPSS
0.04%
First published (updated )
CVE-2026-28433

MisskeyHTTP signature verification can be bypassed

Risk 31
Severity
7.5
EPSS
0.03%
First published (updated )
CVE-2026-28432

moMisskey/misskeyMisskey lacks proper authorization checks and input validation

Risk 36
Severity
9.2
EPSS
0.04%
First published (updated )
CVE-2026-28431
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Misskey MisskeyMisskey has a login rate limit bypass via spoofed X-Forwarded-For header

Risk 41
Severity
6.9
First published (updated )
CVE-2025-66482

Misskey Misskeymisskey.js's export data contains private post data

Risk 40
Severity
7.1
First published (updated )
CVE-2025-66402

Misskey MisskeyMisskey Directory Traversal Vulnerability in AiScript via `Mk:api`

Risk 31
Severity
7.5
EPSS
0.03%
First published (updated )
CVE-2025-46559

Misskey MisskeyMisskey CSS Style Injection Vulnerability In `MkUrlPreview`

Risk 31
Severity
7.2
EPSS
0.06%
First published (updated )
CVE-2025-46340

npm/@misskey-dev/summaly@misskey-dev/summaly Redirect Filter Bypass

Risk 27
Severity
6.1
EPSS
0.10%
First published (updated )
CVE-2025-46553
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Misskey MisskeyMisskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes

Risk 43
Severity
9.3
EPSS
0.02%
First published (updated )
CVE-2025-25306

Misskey MisskeyMisskey CSRF vulnerability due to insecure configuration of authentication cookie attributes

Risk 38
Severity
8.2
EPSS
0.04%
First published (updated )
CVE-2025-24897

Misskey MisskeyMisskey allows token to remain valid in cookie after signing out

Risk 42
Severity
8.1
EPSS
0.09%
First published (updated )
CVE-2025-24896

Misskey MisskeyUncontrolled Recursion and Asymmetric Resource Consumption (Amplification) in media/file proxy in Misskey

Risk 31
Severity
7.4
EPSS
0.05%
First published (updated )
CVE-2024-49363

Misskey MisskeyServer-Side Request Forgery vulnerability in various APIs in Misskey

Risk 41
Severity
6.4
First published (updated )
CVE-2024-52579
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Misskey MisskeyMissing validation allows spoofed profiles in Misskey

Risk 58
Severity
8.8
First published (updated )
CVE-2024-52590

Misskey MisskeyMissing validation allows spoofed profiles and notes in Misskey

Risk 63
Severity
9.3
First published (updated )
CVE-2024-52591

Misskey MisskeyMissing validation allows spoofed poll updates in Misskey

Risk 33
Severity
6.9
First published (updated )
CVE-2024-52592

Misskey MisskeyMissing validation allows spoofed "origin" links in Misskey

Risk 28
Severity
5.3
First published (updated )
CVE-2024-52593

Misskey MisskeyMisskey allows the impersonation and takeover of remote accounts with unnormalized signed activities

Risk 38
Severity
8.2
EPSS
0.04%
First published (updated )
CVE-2024-32983
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Misskey MisskeyLack of media type verification of Activity Streams objects allows impersonation and takeover of remote accounts

Risk 56
Severity
8.8
EPSS
0.04%
First published (updated )
CVE-2024-25636

Misskey MisskeyMisskey vulnerable to improper authorization when accessing with third-party application

Risk 68
Severity
9.6
First published (updated )
CVE-2023-52139

Misskey MisskeyMisskey's missing signature validation allows arbitrary users to impersonate any remote user.

Risk 61
Severity
9.3
First published (updated )
CVE-2023-49079

Misskey MisskeyMisskey allows users to bypass authentication of Bull dashboard

Risk 43
Severity
7.5
First published (updated )
CVE-2023-43793

Misskey MisskeyCross site scripting (XSS) vulnerability using authentication callback in Misskey

Risk 50
Severity
7.1
First published (updated )
CVE-2023-24810
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Misskey MisskeyCross site scripting (XSS) vulnerability using url preview in Misskey

Risk 50
Severity
7.1
First published (updated )
CVE-2023-24811

Misskey MisskeySQL injection of notes/search-by-tag

Risk 86
Severity
9.8
First published (updated )
CVE-2023-24812

Misskey MisskeyCross site scripting (XSS) of ActivityPub URI in misskey

Risk 50
Severity
7.1
First published (updated )
CVE-2023-25154

Misskey MisskeyServer-Side Request Forgery vulnerability in misskey

Risk 44
Severity
7.7
First published (updated )
CVE-2021-39195

Misskey MisskeyXSS vulnerability using dialog

Risk 71
Severity
8
First published (updated )
CVE-2021-39169
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203