https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-28433.htmlhttps://patchthecve.com/cve/CVE-2026-28433.htmlWed, 17 Jun 2026 10:28:38 +0000MEDIUM 4.3: Misskey is an open source, federated social media platform. All Misskey servers running versions 10.93.0 and later, but prior to 2026.3.1, contain a vulnerability that allows importing other users' data due to lack of ownership validation. The impact of this vulnerability is estimated to be relativehttps://patchthecve.com/cve/CVE-2026-28432.htmlhttps://patchthecve.com/cve/CVE-2026-28432.htmlWed, 17 Jun 2026 10:28:38 +0000HIGH 7.5: Misskey is an open source, federated social media platform. All Misskey servers prior to 2026.3.1 contain a vulnerability that allows bypassing HTTP signature verification. Although this is a vulnerability related to federation, it affects all servers regardless of whether federation is enabled or dhttps://patchthecve.com/cve/CVE-2026-28431.htmlhttps://patchthecve.com/cve/CVE-2026-28431.htmlWed, 17 Jun 2026 10:28:38 +0000HIGH 7.5: Misskey is an open source, federated social media platform. All Misskey servers running versions 8.45.0 and later, but prior to 2026.3.1, contain a vulnerability that allows bad actors access to data that they ordinarily wouldn't be able to access due to insufficient permission checks and proper inphttps://patchthecve.com/cve/CVE-2025-66482.htmlhttps://patchthecve.com/cve/CVE-2025-66482.htmlWed, 14 Oct 2026 13:10:00 +0000MEDIUM 6.5: Misskey is an open source, federated social media platform. Attackers who use an untrusted reverse proxy or not using a reverse proxy at all can bypass IP rate limiting by adding a forged X-Forwarded-For header. Starting with version 2025.9.1, an option (`trustProxy`) has been added in config file thttps://patchthecve.com/cve/CVE-2025-66402.htmlhttps://patchthecve.com/cve/CVE-2025-66402.htmlWed, 14 Oct 2026 13:10:00 +0000MEDIUM 6.5: Misskey is an open source, federated social media platform. Starting in version 13.0.0-beta.16 and prior to version 2025.12.0, an actor who does not have permission to view favorites or clips can can export the posts and view the contents. Version 2025.12.0 fixes the issue.https://patchthecve.com/cve/CVE-2025-25306.htmlhttps://patchthecve.com/cve/CVE-2025-25306.htmlWed, 17 Jun 2026 09:00:39 +0000CRITICAL 9.3: Misskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate the relation between the `id` and `url` fields of ActivityPub objects. An attacker can forge an object where they claim authority in the `url` field even if the specific ActivityPubhttps://patchthecve.com/cve/CVE-2025-24897.htmlhttps://patchthecve.com/cve/CVE-2025-24897.htmlWed, 17 Jun 2026 08:59:48 +0000HIGH 8.2: Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some of the APIs of bull-board may be subjecthttps://patchthecve.com/cve/CVE-2025-24896.htmlhttps://patchthecve.com/cve/CVE-2025-24896.htmlWed, 17 Jun 2026 08:59:48 +0000HIGH 8.1: Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, a login token named `token` is stored in a cookie for authentication purposes in Bull Dashboard, but this remains undeleted even after logout is performed. The primary affehttps://patchthecve.com/cve/CVE-2024-52593.htmlhttps://patchthecve.com/cve/CVE-2024-52593.htmlWed, 17 Jun 2026 08:07:30 +0000MEDIUM 5.3: Misskey is an open source, federated social media platform.In affected versions missing validation in `NoteCreateService.insertNote`, `ApPersonService.createPerson`, and `ApPersonService.updatePerson` allows an attacker to control the target of any "origin" links (such as the "view on remote instanchttps://patchthecve.com/cve/CVE-2024-52592.htmlhttps://patchthecve.com/cve/CVE-2024-52592.htmlWed, 17 Jun 2026 08:07:30 +0000MEDIUM 5.3: Misskey is an open source, federated social media platform. In affected versions missing validation in `ApInboxService.update` allows an attacker to modify the result of polls belonging to another user. No authentication is required, except for a valid signature from any actor on any remote instancehttps://patchthecve.com/cve/CVE-2024-52591.htmlhttps://patchthecve.com/cve/CVE-2024-52591.htmlWed, 17 Jun 2026 08:07:30 +0000CRITICAL 9.3: Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` and `HttpRequestService.getActivityJson` allows an attacker to create fake user profiles and forged notes. The spoofed users will appear to be from a different instancehttps://patchthecve.com/cve/CVE-2024-52590.htmlhttps://patchthecve.com/cve/CVE-2024-52590.htmlWed, 17 Jun 2026 08:07:30 +0000MEDIUM 6.5: Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` allows an attacker to create fake user profiles that appear to be from a different instance than the one where they actually exist. These profiles can be used to impershttps://patchthecve.com/cve/CVE-2024-52579.htmlhttps://patchthecve.com/cve/CVE-2024-52579.htmlWed, 17 Jun 2026 08:07:29 +0000MEDIUM 6.4: Misskey is an open source, federated social media platform. Some APIs using `HttpRequestService` do not properly check the target host. This vulnerability allows an attacker to send POST or GET requests to the internal server, which may result in a SSRF attack.It allows an attacker to send POST or Ghttps://patchthecve.com/cve/CVE-2024-32983.htmlhttps://patchthecve.com/cve/CVE-2024-32983.htmlWed, 17 Jun 2026 07:30:49 +0000HIGH 8.2: Misskey is an open source, decentralized microblogging platform. Misskey doesn't perform proper normalization on the JSON structures of incoming signed ActivityPub activity objects before processing them, allowing threat actors to spoof the contents of signed activities and impersonate the authors ohttps://patchthecve.com/cve/CVE-2024-25636.htmlhttps://patchthecve.com/cve/CVE-2024-25636.htmlWed, 17 Jun 2026 07:16:20 +0000HIGH 7.1: Misskey is an open source, decentralized social media platform with ActivityPub support. Prior to version 2024.2.0, when fetching remote Activity Streams objects, Misskey doesn't check that the response from the remote server has a `Content-Type` header value of the Activity Streams media type, whic