Search vulnerabilities

Expected end of text, found '–' (at char 20), (line:1, col:21)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,829

CVE-2026-104816

Misskey: Cross-site scripting in RSS feed item links

Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from configured feeds without verifying their URL schemes. Missing URL scheme verification allows an attacker who controls feed content to provide an unsafe-scheme link that causes script execution when a user clicks it in an RSS widget. This issue is fixed in version 2026.7.0.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Misskey
Products
Misskey
CVE-2026-104817

Misskey: Lack of rate limiting and size restrictions in RSS fetching API

Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing, exhausting instance resources, amplifying requests toward third-party servers, or probing network-reachable services even when federation is disabled. This issue is fixed in version 2026.7.0.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Misskey
Products
Misskey
CVE-2026-103937

Misskey: Denial of service resulting from insufficient cleanup processing during file uploads

Misskey is an open source, federated social media platform. From 13.0.0 until 2025.4.1 and from 2025.5.0 until 2026.7.0, cleanup processing may not execute during file uploads. Repeated uploads can exhaust storage or file descriptors and deny service regardless of whether federation is enabled. This issue is fixed in version 2026.7.0.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Misskey
Products
Misskey
CVE-2026-110215

youlai-boot through 2.21.1 Missing Authorization in Role Menu Assignment Allows Privilege Escalation

youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/{roleId}/menus. Low-privileged users such as the GUEST test account can grant all permissions to their own role, refreshing the Redis permission cache to gain administrator-equivalent access.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Youlai
Products
Youlai-boot
CVE-2026-96957

.NET Security Feature Bypass Vulnerability

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Apple Linux Microsoft
Products
Macos Linux Kernel .net and 5 more