CVE-2026-46713

criticalpriority · track · 0EPSS 0.003 · 19 %ileEU

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.28% (19th) EPSS

CVSS 9.2 · critical

Is it mine?

1 products

Check your exposure

Who says so?

2 sources

cnnvd · enisa_euvd

EPSS · scored 2026-10-23

Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, contain a vulnerability in the JSON-LD signature validation and compaction process that allows spoofed activities to be accepted as valid. This issue has been fixed in version 2026.5.4.

cvss

Technical severity, 0–10. One row per scoring source.

9.2

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.8–9.2

v4.09.2criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:H/SA:Nsecondary · ENISA EU

v4.09.2criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · security-advisories@github.com

v4.07.8highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)