Loading story…
Misskey patched two high-severity flaws in its JSON-LD signature validation and compaction logic that could allow spoofed or fraudulent federated activities to be accepted as legitimate. The issues, tracked as CVE-2026-46713 and CVE-2026-47746, affect Misskey 12.37.0 and later before 2026.5.4 and undermine integrity checks used when handling ActivityPub-style messages.
According to the advisories, one flaw stems from improper signature validation (CWE-347), while the other creates a time-of-check to time-of-use condition because the JSON-LD parsing context is not shared between verification and later processing. Misskey addressed both vulnerabilities in version 2026.5.4, a security release that also references several additional GitHub Security Advisories and CVEs.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The CVE-2026-46713 record was newly received by GitHub Security Advisories on August 3, 2026. The advisory describes a Misskey flaw in JSON-LD signature validation and compaction that could allow spoofed activities to be accepted as valid.
Misskey released version 2026.5.4 on 2026-05-21. The release bundled general security fixes and referenced multiple GitHub Security Advisories, including GHSA-w8x2-gpq6-jxvf for CVE-2026-46713 and GHSA-38jx-423m-g387 for CVE-2026-47746.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Misskey** disclosed **CVE-2026-28431**, a vulnerability affecting all servers running versions **8.45.0 and later, but prior to 2026.3.1**, where insufficient authorization checks combined with inadequate input validation can allow an attacker to access data they should not be able to access. The issue occurs **regardless of whether federation is enabled**, and the vendor warns it could result in a **significant data breach**; the highest-scored advisory associated with the CVE is rated **CVSS v4 9.2**. There is **no known workaround**; administrators are advised to **upgrade to Misskey 2026.3.1** to remediate. Misskey also noted it is **intentionally limiting technical details** to reduce risk to unpatched servers, and indicated the CVE aggregates multiple related advisories (including **GHSA-r33c-qg3g-v9cr** as the highest-severity item, plus additional lower-severity authorization/permission-check advisories) that are all fixed in `2026.3.1`.
Jun 29, 2026
A public disclosure reported that **wolfSSL** versions `5.7.2` through `5.9.0-stable` contain a flaw in the **ML-DSA-44** signing path that frees a heap buffer holding private signing material without clearing it first. In native ML-DSA builds enabled with `--enable-mldsa` or `--enable-dilithium`, a same-process attacker can recover secret key material from reused heap memory and forge signatures on arbitrary messages. Researcher Abhinav Agarwal demonstrated end-to-end signature forgery on Linux and macOS, with forged signatures accepted by `wc_dilithium_verify_msg()` in compiled `libwolfssl` binaries. wolfSSL confirmed the issue and addressed it through fixes referenced in pull requests **#10100** and **#10113**, with the remediation shipping in **wolfSSL 5.9.1-stable**. The vendor did not assign a CVE and reportedly classified the finding as a bug rather than a vulnerability, even as its broader release advisory warned of multiple cryptographic verification weaknesses affecting certificate validation and signature handling. The disclosure also noted that similar missing-memory-clearing problems had previously been corrected in wolfSSL code paths for Dilithium key generation, Ed25519 signing, and Ed448 signing.
Jun 29, 2026
MeWare Software Development Inc.'s **PDKS** platform was disclosed with two high-severity vulnerabilities affecting versions from `V16.20200313` before `VMYR_3.5.2025117`. **CVE-2026-7399** is an insecure direct object reference (**IDOR**) issue mapped to `CWE-639` that allows authorization bypass through a user-controlled key, enabling attackers with low privileges to abuse access rights and expose or alter sensitive data. The flaw carries a CVSS v3.1 vector of `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N`, indicating network-reachable exploitation with low attack complexity and high impact on confidentiality and integrity. A second flaw, **CVE-2026-7402**, affects the same product range and stems from improper rate limiting, tracked as `CWE-799`. The vulnerability allows flooding attacks against PDKS and is rated with the CVSS v3.1 vector `AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H`, reflecting high impact on integrity and availability. Both issues were referenced in advisories published through **USOM**, pointing organizations using vulnerable PDKS releases to update to a fixed version at or beyond `VMYR_3.5.2025117`.
Jun 29, 2026