Approved changes feed: RSS · Atom
cpe:2.3:a:nexryai:nexkey:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Nexryai (bc39eb25-2106-5e41-b6c3-3a956b587f1f) |
|---|---|
| Product | Nexkey (745e4f1b-0be0-5a9d-8d41-8814517e9502) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/nexryai/nexkey |
purl2cpe | 2026-06-01 10:12:27.537692 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-52077 |
vulnerable | 2026-06-08 06:17:54.206438 |
External apps using tokens issued by administrators and moderators can call admin APIs
HIGH (8.9)
Nexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers. Prior to 12.23Q4.5, Nexkey allows external apps using tokens issued by administrators and moderators to call admin APIs. This allows malicious third-party apps to perform operations such as updating server settings, as well as compromise object storage and email server credentials. This issue has been patched in 12.23Q4.5.
Published: 2023-12-27T18:45:50.408Z
Updated: 2024-08-02T22:48:12.128Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-49095 |
vulnerable | 2026-06-08 06:14:28.481267 |
nexkey allows arbitrary users to impersonate any remote user due to missing signature validation
HIGH (8.6)
nexkey is a microblogging platform. Insufficient validation of ActivityPub requests received in inbox could allow any user to impersonate another user in certain circumstances. This issue has been patched in version 12.122.2.
Published: 2023-11-30T07:10:10.994Z
Updated: 2024-11-27T15:54:12.214Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-43805 |
vulnerable | 2026-06-08 06:12:38.056645 |
Nexkey allows users to bypass authentication of Bull dashboard
HIGH (7.5)
Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypass authentication for access to the job queue dashboard. Version 12.121.9 contains a fix for this issue. As a workaround, it may be possible to avoid this by blocking access using tools such as Cloudflare's WAF.
Published: 2023-10-04T20:24:43.110Z
Updated: 2024-09-20T14:55:56.424Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.