CVE-2026-46714

Misskey web client (versions 8.63.0 and later prior to 2026.5.4) is vulnerable to a DoS caused by a malformed theme triggering uncontrolled recursion during theme compilation, which can slow or crash the client. The issue is fixed in version 2026.5.4. Remediation is to upgrade to 2026.5.4 or late...

CVE-2026-46712

Misskey (versions 2025.3.2 and later, prior to 2026.5.4) contains a permission-check vulnerability in the Direct Messages feature that lets access certain data points regardless of account permissions, even when federation is disabled. Notes with the new TODO visibility (formerly direct) are unaf...