Misp vulnerabilities
183 CVEs and advisories name Misp as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-125871MISP sourcecache module SSRF allows fetching arbitrary internal URLs via attribute enrichment
- CVE-2026-118173MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy Tags to Bypass Feed Policy Enforcement
- CVE-2026-116469MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding
- CVE-2026-116372MISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rules
- CVE-2026-112991MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()
- CVE-2026-112192MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings
- CVE-2026-112188MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution
- CVE-2026-112184MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels
- CVE-2026-112183MISP CSS Injection via Remote Tag Colour in Event Preview
- CVE-2026-112180MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records
- CVE-2026-112179MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances
- CVE-2026-112178MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control
- CVE-2026-107278MISP Object Sync Drops Objects and Attributes When Description Is Empty
- CVE-2026-107276MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests
- CVE-2026-107180MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances
- CVE-2026-107175MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes
- CVE-2026-106513MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change
- CVE-2026-106512MISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSS
- CVE-2026-104914MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View
- CVE-2026-104912MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data
- CVE-2026-104910MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization
- CVE-2026-104908MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging
- CVE-2026-104907MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler
- CVE-2026-104906MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output
- CVE-2026-104901MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server
- CVE-2026-104900MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview Index
- CVE-2026-103858MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions
- CVE-2026-103664MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter
- CVE-2026-103662MISP Reflected XSS in Taxonomy Tag Confirmation Forms
- CVE-2026-103659MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes