Nexryai vulnerabilities
We track 6 vulnerabilities in Nexryai products across 3 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on February 11, 2025.
Latest Nexryai vulnerabilities
- 9.3 Critical severity
Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey.
Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Prior to version 12.25Q1.1, due to an improper implementation of the logout process, authentication credentials remain in cookies even after a user has explicitly log
- 8.6 High severity
concorde: Cross-Site Request Forgery
Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Due to a lack of CSRF countermeasures and improper settings of cookies for MediaProxy authentication, there is a vulnerability that allows MediaProxy authentication t
- 8.6 High severity
altair: Uncontrolled Resource Consumption
Altair is a fork of Misskey v12. Affected versions lack of request validation and lack of authentication in the image proxy for compressing and resizing remote files could allow attacks that could affect availability, such as by abnormally increasing the CPU u
- 9.8 Critical severity
nexkey: Incorrect Authorization
Nexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers. Prior to 12.23Q4.5, Nexkey allows external apps using tokens issued by administrators and moderators to call admin APIs. This allows malicious third-party apps to perform o
- 7.5 High severity
nexkey is a microblogging platform. Insufficient validation of ActivityPub requests received…
nexkey is a microblogging platform. Insufficient validation of ActivityPub requests received in inbox could allow any user to impersonate another user in certain circumstances. This issue has been patched in version 12.122.2.
- 7.5 High severity
nexkey: Improper Authentication
Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypass authentication for access to the job queue dashboard. Version 12.121.9 contains a fix for this issu