CVE-2025-66402
NoneCVSS
—
EPSS
0.3%
Published
Dec 15, 2025
CISA due date
—
The record
misskey.js's export data contains private post data
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | misskey-js | 13.0.0-beta.16 | 2025.12.0 |
Related vulnerabilities
- GHSA-496g-mmpw-j9x3 misskey.js's export data contains private post data Same vulnerability
- CVE-2025-66482 Misskey has a login rate limit bypass via spoofed X-Forwarded-For header Also affects misskey-js
- GHSA-wwrj-3hvj-prpm Misskey has a login rate limit bypass via spoofed X-Forwarded-For header Also affects misskey-js
- CVE-2026-96391 Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. CWE-862
- CVE-2026-96380 Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. CWE-862
- CVE-2026-96386 Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. CWE-862
- CVE-2026-87955 Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful… CWE-862
- CVE-2026-87954 Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful… CWE-862