https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T18:44:50.567424+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-237674 EUVD-2026-237674 2026-10-06T18:44:50.599796+00:00 EUVD-2026-237674 https://cve.radiocsirt.org/vuln/fkie_cve-2025-46559 fkie_cve-2025-46559 2026-10-06T18:44:50.599831+00:00

Misskey is an open source, federated social media platform. Starting in version 12.31.0 and prior to version 2025.4.1, missing validation in `Mk:api` allows malicious AiScript code to access additional endpoints that it isn't designed to have access to. The missing validation allows malicious AiScript code to prefix a URL with `../` to step out of the `/api` directory, thereby being able to make requests to other endpoints, such as `/files`, `/url`, and `/proxy`. Version 2025.4.1 fixes the issue.