# misskey.

Every CVE that names misskey among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Misskey: Denial of service resulting from insufficient cleanup processing during file uploads](https://agentprime.io/advisories/CVE-2026-103937.md)
  `CVE-2026-103937` · CVE record: misskey-dev misskey · CVSS 8.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-459
- [Misskey: Lack of rate limiting and size restrictions in RSS fetching API](https://agentprime.io/advisories/CVE-2026-104817.md)
  `CVE-2026-104817` · CVE record: misskey-dev misskey · CVSS 8.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: Denial of service, Server-side request forgery (SSRF), CWE-405
- [Misskey: Cross-site scripting in RSS feed item links](https://agentprime.io/advisories/CVE-2026-104816.md)
  `CVE-2026-104816` · CVE record: misskey-dev misskey · CVSS 8.5 High · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Misskey: Denial of Service via Uncontrolled Recursion in Theme Compilation](https://agentprime.io/advisories/CVE-2026-46714.md)
  `CVE-2026-46714` · CVE record: misskey-dev misskey · CVSS 5.1 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service
- [Misskey: JSON-LD signature validation + compaction is vulnerable to timing attacks](https://agentprime.io/advisories/CVE-2026-47746.md)
  `CVE-2026-47746` · CVE record: misskey-dev misskey · CVSS 8.9 High · Not analysed yet · Published 3 Aug 2026 · Tags: Race condition
- [Misskey: JSON-LD signature validation + compaction may lead to improper activity handling](https://agentprime.io/advisories/CVE-2026-46713.md)
  `CVE-2026-46713` · CVE record: misskey-dev misskey · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Aug 2026 · Tags: Weak cryptography or TLS
- [Misskey: Lack of proper permission checks in Direct Messaging feature](https://agentprime.io/advisories/CVE-2026-46712.md)
  `CVE-2026-46712` · CVE record: misskey-dev misskey · CVSS 2.3 Low · Not analysed yet · Published 3 Aug 2026 · Tags: Broken access control
- [Misskey: Improper Authorization in the Announcements API](https://agentprime.io/advisories/CVE-2026-48115.md)
  `CVE-2026-48115` · CVE record: misskey-dev misskey · CVSS 6.3 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Broken access control
- [Misskey: TOTP tokens can be reused](https://agentprime.io/advisories/CVE-2026-57574.md)
  `CVE-2026-57574` · CVE record: misskey-dev misskey · CVSS 7.4 High · Not analysed yet · Published 10 Jul 2026 · Tags: Authentication bypass
- [Misskey: SSRF bypass in URL Preview](https://agentprime.io/advisories/CVE-2026-57575.md)
  `CVE-2026-57575` · CVE record: misskey-dev misskey · CVSS 6.9 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Server-side request forgery (SSRF)
- [Misskey lacks resource ownership validation](https://agentprime.io/advisories/CVE-2026-28433.md)
  `CVE-2026-28433` · CVE record: misskey-dev misskey · CVSS 2.3 Low · Not analysed yet · Published 9 Mar 2026 · Tags: Broken access control
- [HTTP signature verification can be bypassed](https://agentprime.io/advisories/CVE-2026-28432.md)
  `CVE-2026-28432` · CVE record: misskey-dev misskey · CVSS 7.1 High · Not analysed yet · Published 9 Mar 2026 · Tags: Weak cryptography or TLS
- [Misskey lacks proper authorization checks and input validation](https://agentprime.io/advisories/CVE-2026-28431.md)
  `CVE-2026-28431` · CVE record: misskey-dev misskey · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Mar 2026 · Tags: Broken access control
- [Misskey Directory Traversal Vulnerability in AiScript via \`Mk:api\`](https://agentprime.io/advisories/CVE-2025-46559.md)
  `CVE-2025-46559` · CVE record: misskey-dev misskey · CVSS 5.4 Medium · Not analysed yet · Published 5 May 2025 · Tags: Path traversal
- [Misskey CSS Style Injection Vulnerability In \`MkUrlPreview\`](https://agentprime.io/advisories/CVE-2025-46340.md)
  `CVE-2025-46340` · CVE record: misskey-dev misskey · CVSS 7.2 High · Not analysed yet · Published 5 May 2025 · Tags: CWE-20, CWE-116
- [Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes](https://agentprime.io/advisories/CVE-2025-25306.md)
  `CVE-2025-25306` · CVE record: misskey-dev misskey · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Mar 2025 · Tags: CWE-346, CWE-441, CWE-1025
- [Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes](https://agentprime.io/advisories/CVE-2025-24897.md)
  `CVE-2025-24897` · CVE record: misskey-dev misskey · CVSS 8.2 High · Not analysed yet · Published 11 Feb 2025 · Tags: Cross-site request forgery (CSRF), CWE-614, CWE-1275
- [Misskey allows token to remain valid in cookie after signing out](https://agentprime.io/advisories/CVE-2025-24896.md)
  `CVE-2025-24896` · CVE record: misskey-dev misskey · CVSS 8.1 High · Not analysed yet · Published 11 Feb 2025 · Tags: Authentication bypass
- [Uncontrolled Recursion and Asymmetric Resource Consumption (Amplification) in media/file proxy in Misskey](https://agentprime.io/advisories/CVE-2024-49363.md)
  `CVE-2024-49363` · CVE record: misskey-dev misskey · CVSS 7.4 High · Not analysed yet · Published 18 Dec 2024 · Tags: Denial of service, CWE-405
- [Server-Side Request Forgery vulnerability in various APIs in Misskey](https://agentprime.io/advisories/CVE-2024-52579.md)
  `CVE-2024-52579` · CVE record: misskey-dev misskey · CVSS 6.4 Medium · Not analysed yet · Published 18 Dec 2024 · Tags: Server-side request forgery (SSRF), CWE-20
- [Missing validation allows spoofed profiles in Misskey](https://agentprime.io/advisories/CVE-2024-52590.md)
  `CVE-2024-52590` · CVE record: misskey-dev misskey · CVSS 8.8 High · Not analysed yet · Published 18 Dec 2024 · Tags: CWE-20
- [Missing validation allows spoofed profiles and notes in Misskey](https://agentprime.io/advisories/CVE-2024-52591.md)
  `CVE-2024-52591` · CVE record: misskey-dev misskey · CVSS 8.8 High · Not analysed yet · Published 18 Dec 2024 · Tags: CWE-20
- [Missing validation allows spoofed poll updates in Misskey](https://agentprime.io/advisories/CVE-2024-52592.md)
  `CVE-2024-52592` · CVE record: misskey-dev misskey · CVSS 6.9 Medium · Not analysed yet · Published 18 Dec 2024 · Tags: CWE-20
- [Missing validation allows spoofed "origin" links in Misskey](https://agentprime.io/advisories/CVE-2024-52593.md)
  `CVE-2024-52593` · CVE record: misskey-dev misskey · CVSS 5.1 Medium · Not analysed yet · Published 18 Dec 2024 · Tags: CWE-20
- [Misskey allows the impersonation and takeover of remote accounts with unnormalized signed activities](https://agentprime.io/advisories/CVE-2024-32983.md)
  `CVE-2024-32983` · CVE record: misskey-dev misskey · CVSS 8.2 High · Not analysed yet · Published 3 Jun 2024 · Tags: Broken access control
- [Lack of media type verification of Activity Streams objects allows impersonation and takeover of remote accounts](https://agentprime.io/advisories/CVE-2024-25636.md)
  `CVE-2024-25636` · CVE record: misskey-dev misskey · CVSS 7.1 High · Not analysed yet · Published 19 Feb 2024 · Tags: Unrestricted file upload
- [Misskey vulnerable to improper authorization when accessing with third-party application](https://agentprime.io/advisories/CVE-2023-52139.md)
  `CVE-2023-52139` · CVE record: misskey-dev misskey · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Dec 2023 · Tags: Broken access control
- [Misskey's missing signature validation allows arbitrary users to impersonate any remote user.](https://agentprime.io/advisories/CVE-2023-49079.md)
  `CVE-2023-49079` · CVE record: misskey-dev misskey · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Nov 2023 · Tags: Weak cryptography or TLS
- [Misskey allows users to bypass authentication of Bull dashboard](https://agentprime.io/advisories/CVE-2023-43793.md)
  `CVE-2023-43793` · CVE record: misskey-dev misskey · CVSS 7.5 High · Not analysed yet · Published 4 Oct 2023 · Tags: Authentication bypass
- [Cross site scripting (XSS) vulnerability using authentication callback in Misskey](https://agentprime.io/advisories/CVE-2023-24810.md)
  `CVE-2023-24810` · CVE record: misskey-dev misskey · CVSS 7.1 High · Not analysed yet · Published 22 Feb 2023 · Tags: Cross-site scripting (XSS)
- [Cross site scripting (XSS) vulnerability using url preview in Misskey](https://agentprime.io/advisories/CVE-2023-24811.md)
  `CVE-2023-24811` · CVE record: misskey-dev misskey · CVSS 7.1 High · Not analysed yet · Published 22 Feb 2023 · Tags: Cross-site scripting (XSS)
- [SQL injection of notes/search-by-tag](https://agentprime.io/advisories/CVE-2023-24812.md)
  `CVE-2023-24812` · CVE record: misskey-dev misskey · CVSS 8.8 High · Not analysed yet · Published 22 Feb 2023 · Tags: SQL injection
- [Cross site scripting (XSS) of ActivityPub URI in misskey](https://agentprime.io/advisories/CVE-2023-25154.md)
  `CVE-2023-25154` · CVE record: misskey-dev misskey · CVSS 7.1 High · Not analysed yet · Published 22 Feb 2023 · Tags: Cross-site scripting (XSS)
- [Server-Side Request Forgery vulnerability in misskey](https://agentprime.io/advisories/CVE-2021-39195.md)
  `CVE-2021-39195` · CVE record: misskey-dev misskey · CVSS 7.7 High · Not analysed yet · Published 7 Sept 2021 · Tags: Server-side request forgery (SSRF)
- [XSS vulnerability using dialog](https://agentprime.io/advisories/CVE-2021-39169.md)
  `CVE-2021-39169` · CVE record: misskey-dev misskey · CVSS 8.0 High · Not analysed yet · Published 27 Aug 2021 · Tags: Cross-site scripting (XSS)
- [Misskey before 10.102.4 allows hijacking a user's token.](https://agentprime.io/advisories/CVE-2019-1020010.md)
  `CVE-2019-1020010` · CVE record: Misskey Misskey · No CVSS score · Not analysed yet · Published 29 Jul 2019

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=misskey>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/misskey/>. Everything for agents: <https://agentprime.io/llms.txt>.