Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
45 results
Oct 13, 2026Misskey is an open source, federated social media platform.CVE-2026-104817 · Other software · misskey-dev · reported by GitHubHigh 8.7
Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing, exhausting instance resources, amplifying requests toward third-party servers, or probing network-reachable services even when federation is disabled. This issue is fixed in version 2026.7.0.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Misskey is an open source, federated social media platform.CVE-2026-104816 · Other software · misskey-dev · reported by GitHubHigh 8.5
Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from configured feeds without verifying their URL schemes. Missing URL scheme verification allows an attacker who controls feed content to provide an unsafe-scheme link that causes script execution when a user clicks it in an RSS widget. This issue is fixed in version 2026.7.0.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Misskey is an open source, federated social media platform.CVE-2026-103937 · Other software · misskey-dev · reported by GitHubHigh 8.7
Misskey is an open source, federated social media platform. From 13.0.0 until 2025.4.1 and from 2025.5.0 until 2026.7.0, cleanup processing may not execute during file uploads. Repeated uploads can exhaust storage or file descriptors and deny service regardless of whether federation is enabled. This issue is fixed in version 2026.7.0.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026Misskey is an open source, federated social media platform.CVE-2026-48115 · Other software · misskey-dev · reported by GitHubMedium 6.3
Misskey is an open source, federated social media platform. All Misskey servers running versions 2024.5.0 and later, but prior to 2026.5.4, contain a vulnerability in the Server Announcements API where insufficient permission checks allow attackers to access limited portions of data that they normally couldn't view. This vulnerability occurs whether or not federation is enabled. This issue has been fixed in version 2026.5.4.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026Misskey is an open source, federated social media platform.CVE-2026-47746 · Other software · misskey-dev · reported by GitHubHigh 8.9
Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, are vulnerable to timing attacks during JSON-LD signature validation and the compaction process. Because the JSON-LD parsing context is not shared between signature verification and subsequent processing, the application may trust information that should not be trusted, resulting in a time-of-check to time-of-use (TOCTOU) flaw. This allows an attacker to have fraudulent activities accepted as valid, leading to a loss of integrity. This issue has been fixed in version 2026.5.4.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026Misskey is an open source, federated social media platform.CVE-2026-46714 · Other software · misskey-dev · reported by GitHubMedium 5.1
Misskey is an open source, federated social media platform. IVersions 8.63.0 and later, but prior to 2026.5.4, contain a vulnerability that can cause the Misskey web client to slow down or crash when it applies a malformed theme. This issue has been fixed in version 2026.5.4.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026Misskey is an open source, federated social media platform.CVE-2026-46713 · Other software · misskey-dev · reported by GitHubCritical 9.2
Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, contain a vulnerability in the JSON-LD signature validation and compaction process that allows spoofed activities to be accepted as valid. This issue has been fixed in version 2026.5.4.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026Misskey is an open source, federated social media platform.CVE-2026-46712 · Other software · misskey-dev · reported by GitHubLow 2.3
Misskey is an open source, federated social media platform. Versions 2025.3.2 and later, but prior to 2026.5.4, contain a vulnerability where a lack of proper permission checks allows access to certain data points from the Direct Messages (formerly Chat) feature, regardless of account permissions. This vulnerability occurs whether or not federation is enabled. Notes created with "specified" visibility (formerly "direct" visibility) are not affected. This issue has been fixed in version 2026.5.4.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Misskey is an open source, federated social media platform.CVE-2026-57575 · Other software · misskey-dev · reported by GitHubMedium 6.9
Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a Server-Side Request Forgery (SSRF) vulnerability in URL preview functionality in UrlPreviewService. Due to missing network restrictions before establishing outbound connections, a remote attacker can cause the Misskey server to initiate HTTP requests to loopback, private, or link-local services. Because IP address validation takes place after the request has been sent and the process is subsequently rejected, no sensitive internal data is believed to be transmitted back or exposed to the attacker. This issue is fixed in version 2026.6.0.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Misskey is an open source, federated social media platform.CVE-2026-57574 · Other software · misskey-dev · reported by GitHubHigh 7.4
Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a vulnerability in Time-based One-Time Password (TOTP) authentication in UserAuthService where insufficient validation of used tokens allows the reuse of a single-use code within its valid time step. If both credentials and a TOTP code are obtained concurrently, an attacker may reuse the code to perform unauthorized actions, potentially leading to account takeover. This issue is fixed in version 2026.6.0.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Misskey is an open source, federated social media platform.CVE-2026-28433 · Other software · misskey-dev · reported by GitHubLow 2.3
Misskey is an open source, federated social media platform. All Misskey servers running versions 10.93.0 and later, but prior to 2026.3.1, contain a vulnerability that allows importing other users' data due to lack of ownership validation. The impact of this vulnerability is estimated to be relatively low, as bad actors would require the ID corresponding to the target file for import. This vulnerability is fixed in 2026.3.1.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Misskey is an open source, federated social media platform.CVE-2026-28432 · Other software · misskey-dev · reported by GitHubHigh 7.1
Misskey is an open source, federated social media platform. All Misskey servers prior to 2026.3.1 contain a vulnerability that allows bypassing HTTP signature verification. Although this is a vulnerability related to federation, it affects all servers regardless of whether federation is enabled or disabled. This vulnerability is fixed in 2026.3.1.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Misskey is an open source, federated social media platform.CVE-2026-28431 · Other software · misskey-dev · reported by GitHubCritical 9.2
Misskey is an open source, federated social media platform. All Misskey servers running versions 8.45.0 and later, but prior to 2026.3.1, contain a vulnerability that allows bad actors access to data that they ordinarily wouldn't be able to access due to insufficient permission checks and proper input validation. This vulnerability occurs regardless of whether federation is enabled or not. This vulnerability could lead to a significant data breach. This vulnerability is fixed in 2026.3.1.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025Misskey is an open source, federated social media platform.CVE-2025-66482 · Other software · misskey-dev · reported by GitHubMedium 6.9
Misskey is an open source, federated social media platform. Attackers who use an untrusted reverse proxy or not using a reverse proxy at all can bypass IP rate limiting by adding a forged X-Forwarded-For header. Starting with version 2025.9.1, an option (`trustProxy`) has been added in config file to prevent this from happening. However, it is initialized with an insecure default value before version 2025.12.0-alpha.2, making it still vulnerable if the configuration is not set correctly. This is patched in v2025.12.0-alpha.2 by flipping default value of `trustProxy` to `false`. Users of a trusted reverse proxy who are unsure if they manually overode this value should check their config for optimal behavior. Users are running Misskey with a trusted reverse proxy should not be affected by this vulnerability. From v2025.9.1 to v2025.11.1, workaround is available. Set `trustProxy: false` in config file.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025Misskey is an open source, federated social media platform.CVE-2025-66402 · Other software · misskey-dev · reported by GitHubHigh 7.1
Misskey is an open source, federated social media platform. Starting in version 13.0.0-beta.16 and prior to version 2025.12.0, an actor who does not have permission to view favorites or clips can can export the posts and view the contents. Version 2025.12.0 fixes the issue.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2025Vickey is a Misskey-based microblogging platform.CVE-2025-61775 · Other software · Whimsies-YAT · reported by GitHubMedium 6.9
Vickey is a Misskey-based microblogging platform. A vulnerability exists in Vickey prior to version 2025.10.0 where unexpired email confirmation links can be reused multiple times to send repeated confirmation emails to a verified email address. Under certain conditions, a verified email address could receive repeated confirmation messages if the verification link was accessed multiple times. This issue may result in unintended email traffic but does not expose user data. The issue was addressed in version 2025.10.0 by improving validation logic to ensure verification links behave as expected after completion.
- Product
- Vickey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025Misskey is an open source, federated social media platform.CVE-2025-46559 · Other software · misskey-dev · reported by GitHubMedium 5.4
Misskey is an open source, federated social media platform. Starting in version 12.31.0 and prior to version 2025.4.1, missing validation in `Mk:api` allows malicious AiScript code to access additional endpoints that it isn't designed to have access to. The missing validation allows malicious AiScript code to prefix a URL with `../` to step out of the `/api` directory, thereby being able to make requests to other endpoints, such as `/files`, `/url`, and `/proxy`. Version 2025.4.1 fixes the issue.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025@misskey-dev/summaly is a tool for getting a summary of a web page.CVE-2025-46553 · Other software · misskey-dev · reported by GitHubLow 2.1
@misskey-dev/summaly is a tool for getting a summary of a web page. Starting in version 3.0.1 and prior to version 5.2.1, a logic error in the main `summaly` function causes the `allowRedirects` option to never be passed to any plugins, and as a result, isn't enforced. Misskey will follow redirects, despite explicitly requesting not to. Version 5.2.1 contains a patch for the issue.
- Product
- summaly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025Misskey is an open source, federated social media platform.CVE-2025-46340 · Other software · misskey-dev · reported by GitHubHigh 7.2
Misskey is an open source, federated social media platform. Starting in version 12.0.0 and prior to version 2025.4.1, due to an oversight in the validation performed in `UrlPreviewService` and `MkUrlPreview`, it is possible for an attacker to inject arbitrary CSS into the `MkUrlPreview` component. `UrlPreviewService.wrap` falls back to returning the original URL if it's using a protocol that is likely to not be understood by Misskey, IE something other than `http` or `https`. This both can de-anonymize users and_allow further attacks in the client. Additionally, `MkUrlPreview` doesn't escape CSS when applying a `background-image` property, allowing an attacker to craft a URL that applies arbitrary styles to the preview element. Theoretically, an attacker can craft a CSS injection payload to create a fake error message that can deceive the user into giving away their credentials or similar sensitive information. Version 2025.4.1 contains a patch for the issue.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025Misskey is an open source, federated social media platform.CVE-2025-25306 · Other software · misskey-dev · reported by GitHubCritical 9.3
Misskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate the relation between the `id` and `url` fields of ActivityPub objects. An attacker can forge an object where they claim authority in the `url` field even if the specific ActivityPub object type require authority in the `id` field. Version 2025.2.1 addresses the issue.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey.CVE-2025-24973 · Other software · nexryai · reported by GitHubCritical 9.3
Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Prior to version 12.25Q1.1, due to an improper implementation of the logout process, authentication credentials remain in cookies even after a user has explicitly logged out, which may allow an attacker to steal authentication tokens. This could have devastating consequences if a user with admin privileges is (or was) using a shared device. Users who have logged in on a shared device should go to Settings > Security and regenerate their login tokens. Version 12.25Q1.1 fixes the issue. As a workaround, clear cookies and site data in the browser after logging out.
- Product
- concorde
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey.CVE-2025-24900 · Other software · nexryai · reported by GitHubHigh 8.6
Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Due to a lack of CSRF countermeasures and improper settings of cookies for MediaProxy authentication, there is a vulnerability that allows MediaProxy authentication to be bypassed. In versions prior to 12.25Q1.1, the authentication cookie does not have the SameSite attribute. This allows an attacker to bypass MediaProxy authentication and load any image without restrictions under certain circumstances. In versions prior to 12.24Q2.3, this cookie was also used to authenticate the job queue management page (bull-board), so bull-board authentication is also bypassed. This may enable attacks that have a significant impact on availability and integrity. The affected versions are too old to be covered by this advisory, but the maintainers of Concorde strongly recommend not using older versions. Version 12.25Q1.1 contains a patch. There is no effective workaround other than updating.
- Product
- concorde
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Misskey is an open source, federated social media platform.CVE-2025-24897 · Other software · misskey-dev · reported by GitHubHigh 8.2
Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some of the APIs of bull-board may be subject to CSRF attacks. There is a risk of this vulnerability being used for attacks with relatively large impact on availability and integrity, such as the ability to add arbitrary jobs. This vulnerability was fixed in 2025.2.0-alpha.0. As a workaround, block all access to the `/queue` directory with a web application firewall (WAF).
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Misskey is an open source, federated social media platform.CVE-2025-24896 · Other software · misskey-dev · reported by GitHubHigh 8.1
Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, a login token named `token` is stored in a cookie for authentication purposes in Bull Dashboard, but this remains undeleted even after logout is performed. The primary affected users will be users who have logged into Misskey using a public PC or someone else's device, but it's possible that users who have logged out of Misskey before lending their PC to someone else could also be affected. Version 2025.2.0-alpha.0 contains a fix for this issue.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2024Altair is a fork of Misskey v12.CVE-2024-56200 · Other software · nexryai · reported by GitHubHigh 8.6
Altair is a fork of Misskey v12. Affected versions lack of request validation and lack of authentication in the image proxy for compressing and resizing remote files could allow attacks that could affect availability, such as by abnormally increasing the CPU usage of the server on which this software is running or placing a heavy load on the network it is using. This issue has been fixed in v12.24Q4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- altair
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024Misskey is an open source, federated social media platform.In affected versions missing validation in `NoteCreateService.insertNote`, `ApPersonService.createPerCVE-2024-52593 · Other software · misskey-dev · reported by GitHubMedium 5.1
Misskey is an open source, federated social media platform.In affected versions missing validation in `NoteCreateService.insertNote`, `ApPersonService.createPerson`, and `ApPersonService.updatePerson` allows an attacker to control the target of any "origin" links (such as the "view on remote instance" banner). Any HTTPS URL can be set, even if it belongs to a different domain than the note / user. Vulnerable Misskey instances will use the unverified URL for several clickable links, allowing an attacker to conduct phishing or other attacks against remote users. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024Misskey is an open source, federated social media platform.CVE-2024-52592 · Other software · misskey-dev · reported by GitHubMedium 6.9
Misskey is an open source, federated social media platform. In affected versions missing validation in `ApInboxService.update` allows an attacker to modify the result of polls belonging to another user. No authentication is required, except for a valid signature from any actor on any remote instance. Vulnerable Misskey instances will accept spoofed updates for remote polls. Local polls are unaffected. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024Misskey is an open source, federated social media platform.CVE-2024-52591 · Other software · misskey-dev · reported by GitHubHigh 8.8
Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` and `HttpRequestService.getActivityJson` allows an attacker to create fake user profiles and forged notes. The spoofed users will appear to be from a different instance than the one where they actually exist, and the forged notes will appear to be posted by a different user. Vulnerable Misskey instances will accept the spoofed objects as valid, allowing an attacker to impersonate other users and instances. The attacker retains full control of the spoofed user / note and can interact like a real account. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024Misskey is an open source, federated social media platform.CVE-2024-52590 · Other software · misskey-dev · reported by GitHubHigh 8.8
Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` allows an attacker to create fake user profiles that appear to be from a different instance than the one where they actually exist. These profiles can be used to impersonate existing users from the target instance. Vulnerable Misskey instances will accept spoofed users as valid, allowing an attacker to impersonate users on another instance. Attackers have full control of the spoofed user and can post, renote, or otherwise interact like a real account. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024Misskey is an open source, federated social media platform.CVE-2024-52579 · Other software · misskey-dev · reported by GitHubMedium 6.4
Misskey is an open source, federated social media platform. Some APIs using `HttpRequestService` do not properly check the target host. This vulnerability allows an attacker to send POST or GET requests to the internal server, which may result in a SSRF attack.It allows an attacker to send POST or GET requests (with some controllable URL parameters) to private IPs, enabling further attacks on internal servers. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024Misskey is an open source, federated social media platform.CVE-2024-49363 · Other software · misskey-dev · reported by GitHubHigh 7.4
Misskey is an open source, federated social media platform. In affected versions FileServerService (media proxy) in github.com/misskey-dev/misskey 2024.10.1 or earlier did not detect proxy loops, which allows remote actors to execute a self-propagating reflected/amplified distributed denial-of-service via a maliciously crafted note. FileServerService.prototype.proxyHandler did not check incoming requests are not coming from another proxy server. An attacker can execute an amplified denial-of-service by sending a nested proxy request to the server and end the request with a malicious redirect back to another nested proxy request. Leading to unbounded recursion until the original request is timed out. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. Users unable to upgrade may configure the reverse proxy to block requests to the proxy with an empty User-Agent header or one containing Misskey/. An attacker can not effectively modify the User-Agent header without making another request to the server.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2024Misskey is an open source, decentralized microblogging platform.CVE-2024-32983 · Other software · misskey-dev · reported by GitHubHigh 8.2
Misskey is an open source, decentralized microblogging platform. Misskey doesn't perform proper normalization on the JSON structures of incoming signed ActivityPub activity objects before processing them, allowing threat actors to spoof the contents of signed activities and impersonate the authors of the original activities. This vulnerability is fixed in 2024.5.0.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2024Misskey is an open source, decentralized social media platform with ActivityPub support.CVE-2024-25636 · Other software · misskey-dev · reported by GitHubHigh 7.1
Misskey is an open source, decentralized social media platform with ActivityPub support. Prior to version 2024.2.0, when fetching remote Activity Streams objects, Misskey doesn't check that the response from the remote server has a `Content-Type` header value of the Activity Streams media type, which allows a threat actor to upload a crafted Activity Streams document to a remote server and make a Misskey instance fetch it, if the remote server accepts arbitrary user uploads. The vulnerability allows a threat actor to impersonate and take over an account on a remote server that satisfies all of the following properties: allows the threat actor to register an account; accepts arbitrary user-uploaded documents and places them on the same domain as legitimate Activity Streams actors; and serves user-uploaded document in response to requests with an `Accept` header value of the Activity Streams media type. Version 2024.2.0 contains a patch for the issue.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2023Misskey is an open source, decentralized social media platform.CVE-2023-52139 · Other software · misskey-dev · reported by GitHubCritical 9
Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified as [kind](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L811) or [secure](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L805) without the user's permission and perform operations such as reading or adding non-public content. As a result, if the user who authenticated the application is an administrator, confidential information such as object storage secret keys and SMTP server passwords will be leaked, and general users can also create invitation codes without permission and leak non-public user information. This is patched in version [2023.12.1](https://github.com/misskey-dev/misskey/commit/c96bc36fedc804dc840ea791a9355d7df0748e64).
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2023Nexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers.CVE-2023-52077 · Other software · nexryai · reported by GitHubHigh 8.9
Nexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers. Prior to 12.23Q4.5, Nexkey allows external apps using tokens issued by administrators and moderators to call admin APIs. This allows malicious third-party apps to perform operations such as updating server settings, as well as compromise object storage and email server credentials. This issue has been patched in 12.23Q4.5.
- Product
- nexkey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2023Misskey is an open source, decentralized social media platform.CVE-2023-49079 · Other software · misskey-dev · reported by GitHubCritical 9.3
Misskey is an open source, decentralized social media platform. Misskey's missing signature validation allows arbitrary users to impersonate any remote user. This issue has been patched in version 2023.11.1-beta.1.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2023Nexkey is a fork of Misskey, an open source, decentralized social media platform.CVE-2023-43805 · Other software · nexryai · reported by GitHubHigh 7.5
Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypass authentication for access to the job queue dashboard. Version 12.121.9 contains a fix for this issue. As a workaround, it may be possible to avoid this by blocking access using tools such as Cloudflare's WAF.
- Product
- nexkey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2023Misskey is an open source, decentralized social media platform.CVE-2023-43793 · Other software · misskey-dev · reported by GitHubHigh 7.5
Misskey is an open source, decentralized social media platform. Prior to version 2023.9.0, by editing the URL, a user can bypass the authentication of the Bull dashboard, which is the job queue management UI, and access it. Version 2023.9.0 contains a fix. There are no known workarounds.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2023Misskey is an open source, decentralized social media platform.CVE-2023-24812 · Other software · misskey-dev · reported by GitHubHigh 8.8
Misskey is an open source, decentralized social media platform. In versions prior to 13.3.3 SQL injection is possible due to insufficient parameter validation in the note search API by tag (notes/search-by-tag). This has been fixed in version 13.3.3. Users are advised to upgrade. Users unable to upgrade should block access to the `api/notes/search-by-tag` endpoint.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2023Misskey is an open source, decentralized social media platform.CVE-2023-24811 · Other software · misskey-dev · reported by GitHubHigh 7.1
Misskey is an open source, decentralized social media platform. In versions prior to 13.3.2 the URL preview function is subject to a cross site scripting vulnerability due to insufficient URL validation. Arbitrary JavaScript is executed when a malicious URL is loaded in the `View in Player` or `View in Window` preview. This has been fixed in version 13.3.2. Users are advised to upgrade. Users unable to upgrade should avoid usage of the `View in Player` or `View in Window` functions.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2023Misskey is an open source, decentralized social media platform.CVE-2023-24810 · Other software · misskey-dev · reported by GitHubHigh 7.1
Misskey is an open source, decentralized social media platform. Due to insufficient validation of the redirect URL during `miauth` authentication in Misskey, arbitrary JavaScript can be executed when a user allows the link. All versions below 13.3.1 (including 12.x) are affected. This has been fixed in version 13.3.1. Users are advised to upgrade. Users unable to upgrade should not allow authentication of untrusted apps.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2023Misskey is an open source, decentralized social media platform.CVE-2023-25154 · Other software · misskey-dev · reported by GitHubHigh 7.1
Misskey is an open source, decentralized social media platform. In versions prior to 13.5.0 the link to the instance to the sender that appears when viewing a user or note received through ActivityPub is not properly validated, so by inserting a URL with a javascript scheme an attacker may execute JavaScript code in the context of the recipient. This issue has been fixed in version 13.5.0. Users are advised to upgrade. Users unable to upgrade should not "view on remote" for untrusted instances.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021Misskey is an open source, decentralized microblogging platform.CVE-2021-39195 · Other software · misskey-dev · reported by GitHubHigh 7.7
Misskey is an open source, decentralized microblogging platform. In affected versions a Server-Side Request Forgery vulnerability exists in "Upload from URL" and remote attachment handling. This could result in the disclosure of non-public information within the internal network. This has been fixed in 12.90.0. However, if you are using a proxy, you will need to take additional measures. As a workaround this exploit may be avoided by appropriately restricting access to private networks from the host where the application is running.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2021Misskey is a decentralized microblogging platform.CVE-2021-39169 · Other software · misskey-dev · reported by GitHubHigh 8
Misskey is a decentralized microblogging platform. In versions of Misskey prior to 12.51.0, malicious actors can use the web client built-in dialog to display a malicious string, leading to cross-site scripting (XSS). XSS could compromise the API request token. This issue has been fixed in version 12.51.0. There are no known workarounds aside from upgrading.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2019Misskey before 10.102.4 allows hijacking a user's token.CVE-2019-1020010 · Other software · Misskey · reported by josh@bress.netMedium 6.1
Misskey before 10.102.4 allows hijacking a user's token.
- Product
- Misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.