CVE-2026-104816

Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from configured feeds without verifying their URL schemes. Missing URL scheme verification allows an attacker who controls feed content to provide an unsafe-scheme li...

CVE-2026-104817

Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing,...

CVE-2026-103937

Misskey is an open source, federated social media platform. From 13.0.0 until 2025.4.1 and from 2025.5.0 until 2026.7.0, cleanup processing may not execute during file uploads. Repeated uploads can exhaust storage or file descriptors and deny service regardless of whether federation is enabled...

CVE-2026-103937 Misskey: Denial of service resulting from insufficient cleanup processing during file uploads

Misskey is an open source, federated social media platform. From 13.0.0 until 2025.4.1 and from 2025.5.0 until 2026.7.0, cleanup processing may not execute during file uploads. Repeated uploads can exhaust storage or file descriptors and deny service regardless of whether federation is enabled...

CVE-2026-103937 Misskey: Denial of service resulting from insufficient cleanup processing during file uploads

Misskey is an open source, federated social media platform. From 13.0.0 until 2025.4.1 and from 2025.5.0 until 2026.7.0, cleanup processing may not execute during file uploads. Repeated uploads can exhaust storage or file descriptors and deny service regardless of whether federation is enabled...

CVE-2026-103937 Misskey: Denial of service resulting from insufficient cleanup processing during file uploads

Misskey is an open source, federated social media platform. From 13.0.0 until 2025.4.1 and from 2025.5.0 until 2026.7.0, cleanup processing may not execute during file uploads. Repeated uploads can exhaust storage or file descriptors and deny service regardless of whether federation is enabled...

CVE-2026-103937

The open-source social media platform Misskey is vulnerable to a Denial of Service (DoS) condition due to insufficient cleanup processing during file uploads. The root cause involves a failure to properly execute cleanup tasks, which can lead to the exhaustion of storage or file descriptors when ...

CVE-2026-103937

Misskey is an open source, federated social media platform. From 13.0.0 until 2025.4.1 and from 2025.5.0 until 2026.7.0, cleanup processing may not execute during file uploads. Repeated uploads can exhaust storage or file descriptors and deny service regardless of whether federation is enabled...

EUVD-2026-99240

Misskey is an open source, federated social media platform. From 13.0.0 until 2025.4.1 and from 2025.5.0 until 2026.7.0, cleanup processing may not execute during file uploads. Repeated uploads can exhaust storage or file descriptors and deny service regardless of whether federation is enabled...

CVE-2026-104817 Misskey: Lack of rate limiting and size restrictions in RSS fetching API

Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing,...

CVE-2026-104817

Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing,...

CVE-2026-104817 Misskey: Lack of rate limiting and size restrictions in RSS fetching API

Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing,...

CVE-2026-104817 Misskey: Lack of rate limiting and size restrictions in RSS fetching API

Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing,...

EUVD-2026-99239

Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing,...

CVE-2026-104817

The open-source federated social media platform Misskey versions 12.112.1 through 2026.7.0 contains a vulnerability in the unauthenticated fetch-rss API . The flaw stems from a lack of rate limiting, insufficient response-size restrictions, and the use of synchronous XML parsing . This allows an ...

CVE-2026-104816 Misskey: Cross-site scripting in RSS feed item links

Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from configured feeds without verifying their URL schemes. Missing URL scheme verification allows an attacker who controls feed content to provide an unsafe-scheme li...

CVE-2026-104816

The open source federated social media platform Misskey is vulnerable to Cross-site Scripting (XSS) in its RSS components. Specifically, versions 12.0.0 through 2026.7.0 fail to verify URL schemes for feed item links. An attacker who controls feed content can provide an unsafe-scheme link , leadi...

CVE-2026-104816

Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from configured feeds without verifying their URL schemes. Missing URL scheme verification allows an attacker who controls feed content to provide an unsafe-scheme li...

CVE-2026-104816 Misskey: Cross-site scripting in RSS feed item links

Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from configured feeds without verifying their URL schemes. Missing URL scheme verification allows an attacker who controls feed content to provide an unsafe-scheme li...

CVE-2026-104816 Misskey: Cross-site scripting in RSS feed item links

Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from configured feeds without verifying their URL schemes. Missing URL scheme verification allows an attacker who controls feed content to provide an unsafe-scheme li...