GHSA-496g-mmpw-j9x3
Medium · 6.5CVSS
6.5
EPSS
—
Published
Dec 15, 2025
CISA due date
—
The record
misskey.js's export data contains private post data
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | misskey-js | 13.0.0-beta.16 | 2025.12.0 |
Related vulnerabilities
- CVE-2025-66402 misskey.js's export data contains private post data Same vulnerability
- CVE-2025-66482 Misskey has a login rate limit bypass via spoofed X-Forwarded-For header Also affects misskey-js
- GHSA-wwrj-3hvj-prpm Misskey has a login rate limit bypass via spoofed X-Forwarded-For header Also affects misskey-js
- CVE-2026-96391 Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. CWE-862
- CVE-2026-96380 Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. CWE-862
- CVE-2026-96386 Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. CWE-862
- CVE-2026-87955 Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful… CWE-862
- CVE-2026-87954 Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful… CWE-862