# cve.now: Misp

The newest entries naming Misp as an affected vendor (up to 200), of 183 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-125871](https://cve.now/CVE-2026-125871.md): MISP sourcecache module SSRF allows fetching arbitrary internal URLs via attribute enrichment (CVSS 6.3)
- [CVE-2026-118173](https://cve.now/CVE-2026-118173.md): MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy Tags to Bypass Feed Policy Enforcement (CVSS 6.1)
- [CVE-2026-116469](https://cve.now/CVE-2026-116469.md): MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding (CVSS 7.1)
- [CVE-2026-116372](https://cve.now/CVE-2026-116372.md): MISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rules (CVSS 7.7)
- [CVE-2026-112991](https://cve.now/CVE-2026-112991.md): MISP html\_to\_markdown Module SSRF via Incomplete IP Range Blocking in is\_safe\_url() (CVSS 6.3)
- [CVE-2026-112192](https://cve.now/CVE-2026-112192.md): MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings (CVSS 5.3)
- [CVE-2026-112188](https://cve.now/CVE-2026-112188.md): MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution (CVSS 7.1)
- [CVE-2026-112184](https://cve.now/CVE-2026-112184.md): MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels (CVSS 4.8)
- [CVE-2026-112183](https://cve.now/CVE-2026-112183.md): MISP CSS Injection via Remote Tag Colour in Event Preview (CVSS 4.8)
- [CVE-2026-112180](https://cve.now/CVE-2026-112180.md): MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records (CVSS 5.1)
- [CVE-2026-112179](https://cve.now/CVE-2026-112179.md): MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances (CVSS 5.3)
- [CVE-2026-112178](https://cve.now/CVE-2026-112178.md): MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control (CVSS 7.1)
- [CVE-2026-107278](https://cve.now/CVE-2026-107278.md): MISP Object Sync Drops Objects and Attributes When Description Is Empty (CVSS 5.3)
- [CVE-2026-107276](https://cve.now/CVE-2026-107276.md): MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests (CVSS 6.3)
- [CVE-2026-107180](https://cve.now/CVE-2026-107180.md): MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp\_required Instances (CVSS 7.1)
- [CVE-2026-107175](https://cve.now/CVE-2026-107175.md): MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes (CVSS 5.3)
- [CVE-2026-106513](https://cve.now/CVE-2026-106513.md): MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change (CVSS 6.9)
- [CVE-2026-106512](https://cve.now/CVE-2026-106512.md): MISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSS (CVSS 8.4)
- [CVE-2026-104914](https://cve.now/CVE-2026-104914.md): MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View (CVSS 5.3)
- [CVE-2026-104912](https://cve.now/CVE-2026-104912.md): MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data (CVSS 7.1)
- [CVE-2026-104910](https://cve.now/CVE-2026-104910.md): MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization (CVSS 5.3)
- [CVE-2026-104908](https://cve.now/CVE-2026-104908.md): MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging (CVSS 7.1)
- [CVE-2026-104907](https://cve.now/CVE-2026-104907.md): MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler (CVSS 4.8)
- [CVE-2026-104906](https://cve.now/CVE-2026-104906.md): MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output (CVSS 6.2)
- [CVE-2026-104901](https://cve.now/CVE-2026-104901.md): MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server (CVSS 5.1)
- [CVE-2026-104900](https://cve.now/CVE-2026-104900.md): MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview Index (CVSS 5.3)
- [CVE-2026-103858](https://cve.now/CVE-2026-103858.md): MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions (CVSS 5.3)
- [CVE-2026-103664](https://cve.now/CVE-2026-103664.md): MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter (CVSS 4.8)
- [CVE-2026-103662](https://cve.now/CVE-2026-103662.md): MISP Reflected XSS in Taxonomy Tag Confirmation Forms (CVSS 5.1)
- [CVE-2026-103659](https://cve.now/CVE-2026-103659.md): MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes (CVSS 7.1)
- [CVE-2026-103655](https://cve.now/CVE-2026-103655.md): MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period (CVSS 9.3)
- [CVE-2026-103651](https://cve.now/CVE-2026-103651.md): MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypass (CVSS 7.6)
- [CVE-2026-103389](https://cve.now/CVE-2026-103389.md): MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation Graph (CVSS 6.2)
- [CVE-2026-103388](https://cve.now/CVE-2026-103388.md): MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field (CVSS 6.2)
- [CVE-2026-103321](https://cve.now/CVE-2026-103321.md): MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image (CVSS 8.3)
- [CVE-2026-103239](https://cve.now/CVE-2026-103239.md): MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection (CVSS 8.6)
- [CVE-2026-103237](https://cve.now/CVE-2026-103237.md): MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows (CVSS 8.3)
- [CVE-2026-103235](https://cve.now/CVE-2026-103235.md): MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Events (CVSS 8.7)
- [CVE-2026-97863](https://cve.now/CVE-2026-97863.md): misp-modules: Shell Command Injection in MISP cisco\_firesight\_manager\_ACL\_rule\_export Module via Unescaped Attribute Values (CVSS 6.3)
- [CVE-2026-95806](https://cve.now/CVE-2026-95806.md): MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths (CVSS 7.7)
- [CVE-2026-95805](https://cve.now/CVE-2026-95805.md): MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restriction (CVSS 5.3)
- [CVE-2026-95754](https://cve.now/CVE-2026-95754.md): MISP: Disabled-user check ineffective in pre-authentication TOTP login branch (CVSS 6.9)
- [CVE-2026-95703](https://cve.now/CVE-2026-95703.md): MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp\_name (CVSS 5.1)
- [CVE-2026-95701](https://cve.now/CVE-2026-95701.md): MISP Path Traversal via Organization Name in Org-Statistics Logo Check (CVSS 5.1)
- [CVE-2026-95698](https://cve.now/CVE-2026-95698.md): MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name (CVSS 5.3)
- [CVE-2026-95697](https://cve.now/CVE-2026-95697.md): MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Metadata (CVSS 5.3)
- [CVE-2026-95693](https://cve.now/CVE-2026-95693.md): MISP Information Disclosure via Forged Upload Path (CVSS 5.3)
- [CVE-2026-95685](https://cve.now/CVE-2026-95685.md): MISP Missing Authorization on replaceSuggestionInReport Event Report Action (CVSS 5.3)
- [CVE-2026-95683](https://cve.now/CVE-2026-95683.md): MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL (CVSS 5.3)
- [CVE-2026-95682](https://cve.now/CVE-2026-95682.md): MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View (CVSS 4.8)
- [CVE-2026-95679](https://cve.now/CVE-2026-95679.md): MISP Unauthenticated Blind SSRF via XML Body Processing (CVSS 6.9)
- [CVE-2026-95674](https://cve.now/CVE-2026-95674.md): MISP EventsController queryEnrichment allows querying unavailable or legacy modules without validation (CVSS 5.3)
- [CVE-2026-95671](https://cve.now/CVE-2026-95671.md): MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add (CVSS 5.3)
- [CVE-2026-95667](https://cve.now/CVE-2026-95667.md): MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials (CVSS 6.9)
- [CVE-2026-95665](https://cve.now/CVE-2026-95665.md): MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON (CVSS 5.1)
- [CVE-2026-95661](https://cve.now/CVE-2026-95661.md): MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type List (CVSS 5.1)
- [CVE-2026-95659](https://cve.now/CVE-2026-95659.md): MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread (CVSS 4.8)
- [CVE-2026-95658](https://cve.now/CVE-2026-95658.md): MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution of workflow modules (CVSS 6.9)
- [CVE-2026-94404](https://cve.now/CVE-2026-94404.md): MISP CSRF vulnerability allows unauthorized attribute modification (CVSS 7.1)
- [CVE-2026-94401](https://cve.now/CVE-2026-94401.md): MISP Arbitrary Local File Read and SSRF via MISP Export Upload (CVSS 8.3)
- [CVE-2026-94394](https://cve.now/CVE-2026-94394.md): MISP ObjectReferencesController: Granular Distribution and Sharing Group Restrictions Bypassed When Adding Object References (CVSS 6.3)
- [CVE-2026-94393](https://cve.now/CVE-2026-94393.md): MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport (CVSS 6.4)
- [CVE-2026-94383](https://cve.now/CVE-2026-94383.md): MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension (CVSS 8.6)
- [CVE-2026-94381](https://cve.now/CVE-2026-94381.md): MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTime (CVSS 8.7)
- [CVE-2026-94379](https://cve.now/CVE-2026-94379.md): MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP) (CVSS 6.9)
- [CVE-2026-94374](https://cve.now/CVE-2026-94374.md): MISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events' Reports (CVSS 8.3)
- [CVE-2026-94373](https://cve.now/CVE-2026-94373.md): MISP DOM-based Cross-Site Scripting via innerHTML in Contextual Menu (CVSS 6.3)
- [CVE-2026-94372](https://cve.now/CVE-2026-94372.md): Stored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies Index (CVSS 6.3)
- [CVE-2026-94277](https://cve.now/CVE-2026-94277.md): Stored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy Name (CVSS 6.3)
- [CVE-2026-93296](https://cve.now/CVE-2026-93296.md): MISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics Legends (CVSS 8.5)
- [CVE-2026-93295](https://cve.now/CVE-2026-93295.md): MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution (CVSS 8.7)
- [CVE-2026-92932](https://cve.now/CVE-2026-92932.md): MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabled (CVSS 5.1)
- [CVE-2026-92003](https://cve.now/CVE-2026-92003.md): MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion (CVSS 6.9)
- [CVE-2026-92002](https://cve.now/CVE-2026-92002.md): MISP: Authentication failure logging suppressed during Redis unavailability (CVSS 5.1)
- [CVE-2026-91859](https://cve.now/CVE-2026-91859.md): MISP Access Log Entry Overwritten by Error Controller's Second beforeFilter Pass (CVSS 5.3)
- [CVE-2026-91857](https://cve.now/CVE-2026-91857.md): MISP: State-changing actions accessible via GET request enabling CSRF (CVSS 5.3)
- [CVE-2026-91851](https://cve.now/CVE-2026-91851.md): MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag Comparison (CVSS 5.3)
- [CVE-2026-91846](https://cve.now/CVE-2026-91846.md): MISP Collection Element Add Missing Authorization on Referenced Object UUID (CVSS 7.1)
- [CVE-2026-91825](https://cve.now/CVE-2026-91825.md): MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit (CVSS 7.1)
- [CVE-2026-91819](https://cve.now/CVE-2026-91819.md): MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent (CVSS 6.9)
- [CVE-2026-90961](https://cve.now/CVE-2026-90961.md): MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentials (CVSS 9.3)
- [CVE-2026-90957](https://cve.now/CVE-2026-90957.md): MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures (CVSS 5.1)
- [CVE-2026-90955](https://cve.now/CVE-2026-90955.md): MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load (CVSS 4.6)
- [CVE-2026-90895](https://cve.now/CVE-2026-90895.md): MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection (CVSS 8.4)
- [CVE-2026-90893](https://cve.now/CVE-2026-90893.md): MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints (CVSS 5.1)
- [CVE-2026-88921](https://cve.now/CVE-2026-88921.md): MISP: Unescaped HTML Injection in PDF Report Element Rendering (CVSS 5.1)
- [CVE-2026-88915](https://cve.now/CVE-2026-88915.md): MISP Event Template Instantiation Bypasses Sharing Group and Tagging Authorization (CVSS 7.1)
- [CVE-2026-86452](https://cve.now/CVE-2026-86452.md): MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding (CVSS 8.7)
- [CVE-2026-86451](https://cve.now/CVE-2026-86451.md): MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects (CVSS 5.3)
- [CVE-2026-86441](https://cve.now/CVE-2026-86441.md): MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data (CVSS 2.3)
- [CVE-2026-86440](https://cve.now/CVE-2026-86440.md): MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs (CVSS 5.1)
- [CVE-2026-86419](https://cve.now/CVE-2026-86419.md): MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII Discovery (CVSS 7.0)
- [CVE-2026-86418](https://cve.now/CVE-2026-86418.md): MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users (CVSS 2.3)
- [CVE-2026-86417](https://cve.now/CVE-2026-86417.md): MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Users (CVSS 5.3)
- [CVE-2026-86408](https://cve.now/CVE-2026-86408.md): MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected Events (CVSS 7.1)
- [CVE-2026-86351](https://cve.now/CVE-2026-86351.md): MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL (CVSS 5.1)
- [CVE-2026-86347](https://cve.now/CVE-2026-86347.md): MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion (CVSS 7.1)
- [CVE-2026-86342](https://cve.now/CVE-2026-86342.md): MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Information (CVSS 5.3)
- [CVE-2026-86283](https://cve.now/CVE-2026-86283.md): MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data (CVSS 7.1)
- [CVE-2026-85547](https://cve.now/CVE-2026-85547.md): Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP (CVSS 6.2)
- [CVE-2026-85546](https://cve.now/CVE-2026-85546.md): MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests (CVSS 8.6)
- [CVE-2026-85538](https://cve.now/CVE-2026-85538.md): MISP Attribute Deletion Authorization Bypass Allows Users Without Modify Permissions to Delete Attributes (CVSS 8.3)
- [CVE-2026-85533](https://cve.now/CVE-2026-85533.md): MISP Sharing Group Authorization Bypass via Omitted Distribution Parameter (CVSS 7.6)
- [CVE-2026-85239](https://cve.now/CVE-2026-85239.md): MISP Event Template Definition Validation Bypass Allows Persistent Denial of Service (CVSS 7.1)
- [CVE-2026-85238](https://cve.now/CVE-2026-85238.md): Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking (CVSS 7.6)
- [CVE-2026-85237](https://cve.now/CVE-2026-85237.md): Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass (CVSS 8.6)
- [CVE-2026-85236](https://cve.now/CVE-2026-85236.md): MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request (CVSS 8.8)
- [CVE-2026-85230](https://cve.now/CVE-2026-85230.md): MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection (CVSS 5.3)
- [CVE-2026-85227](https://cve.now/CVE-2026-85227.md): Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters (CVSS 6.1)
- [CVE-2026-85226](https://cve.now/CVE-2026-85226.md): MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations (CVSS 5.3)
- [CVE-2026-85221](https://cve.now/CVE-2026-85221.md): MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacks (CVSS 7.6)
- [CVE-2026-85216](https://cve.now/CVE-2026-85216.md): MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials (CVSS 9.5)
- [CVE-2026-77761](https://cve.now/CVE-2026-77761.md): Cross-Document Parser State Contamination in misp-stix (CVSS 6.3)
- [CVE-2026-77755](https://cve.now/CVE-2026-77755.md): Denial of Service in MISP-STIX Import via Malformed or Oversized STIX Documents in misp-stix library (CVSS 8.7)
- [CVE-2026-77751](https://cve.now/CVE-2026-77751.md): Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library (CVSS 8.8)
- [CVE-2026-77710](https://cve.now/CVE-2026-77710.md): STIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Injection in misp-stix library (CVSS 6.9)
- [CVE-2026-73162](https://cve.now/CVE-2026-73162.md): cti-transmute CSRF Allows Unauthorized Follow and Notification State Changes (CVSS 5.3)
- [CVE-2026-73161](https://cve.now/CVE-2026-73161.md): cti-transmute Conversion Table Allows XSS via Unescaped Cell Content During Search Highlighting (CVSS 5.1)
- [CVE-2026-73160](https://cve.now/CVE-2026-73160.md): cti-transmute Unauthenticated SSRF via Hostnames Resolving to Internal IP Addresses (CVSS 8.7)
- [CVE-2026-73159](https://cve.now/CVE-2026-73159.md): cti-transmute Stored XSS via Crafted Tag Icon on Admin Triage Interface (CVSS 5.1)
- [CVE-2026-73158](https://cve.now/CVE-2026-73158.md): cti-transmute Saved Graph Configuration Allows Stored Cross-Site Scripting via svgIcon (CVSS 5.1)
- [CVE-2026-73157](https://cve.now/CVE-2026-73157.md): cti-transmute Remote MISP Event Browser Allows Cross-Site Scripting via Malicious Event Metadata (CVSS 2.3)
- [CVE-2026-73156](https://cve.now/CVE-2026-73156.md): cti-transmute Sunburst and Treemap Tooltips Allow Cross-Site Scripting via Crafted Conversion Data (CVSS 5.3)
- [CVE-2026-73155](https://cve.now/CVE-2026-73155.md): cti-transmute Missing Authorization Allows Reactions to Private Comments (CVSS 5.3)
- [CVE-2026-73140](https://cve.now/CVE-2026-73140.md): cti-transmute Evaluation Report Exports Expose Private Comments and Author Information (CVSS 5.3)
- [CVE-2026-72760](https://cve.now/CVE-2026-72760.md): cti-transmute Following List Exposes User Email Addresses to Authenticated Users (CVSS 5.3)
- [CVE-2026-72759](https://cve.now/CVE-2026-72759.md): cti-transmute Conversion History Authorization Bypass Leads to Sensitive Data Disclosure After Conversion Deletion (CVSS 6.9)
- [CVE-2026-72751](https://cve.now/CVE-2026-72751.md): Stored Cross-Site Scripting in CTI-Transmute Conversion Graph via Malicious STIX/MISP Content (CVSS 5.1)
- [CVE-2026-71502](https://cve.now/CVE-2026-71502.md): Unauthenticated Stored Vue Template Injection Leads to Cross-Site Scripting in CTI-Transmute (CVSS 5.1)
- [CVE-2026-69082](https://cve.now/CVE-2026-69082.md): Cross-Site Request Forgery in the Administrative User Deletion Endpoint (CVSS 8.8)
- [CVE-2026-69079](https://cve.now/CVE-2026-69079.md): Unauthenticated Denial of Service via Unbounded Activity-Timeline Range in CTI-Transmute (CVSS 8.7)
- [CVE-2026-69078](https://cve.now/CVE-2026-69078.md): Server-Side Request Forgery and Local File Disclosure in CTI-Transmute Evaluation PDF Rendering (CVSS 8.8)
- [CVE-2026-67178](https://cve.now/CVE-2026-67178.md): Open Redirect in MISP Installer-Generated Apache Configuration (CVSS 7.8)
- [CVE-2026-62143](https://cve.now/CVE-2026-62143.md): Server-Side Request Forgery protection bypass in misp-modules html\_to\_markdown via IPv4-mapped IPv6 addresses (CVSS 8.3)
- [CVE-2026-61474](https://cve.now/CVE-2026-61474.md): MISP: Improper sharing group authorization check when adding attributes (CVSS 5.3)
- [CVE-2026-60125](https://cve.now/CVE-2026-60125.md): importModule function in MISP ignores per-organisation import module restrictions (CVSS 5.3)
- [CVE-2026-60124](https://cve.now/CVE-2026-60124.md): MISP importModule missing authorization allows read-only users to modify events via misp\_standard imports (CVSS 5.3)
- [CVE-2026-56447](https://cve.now/CVE-2026-56447.md): MISP remote code execution via arbitrary rdkafka configuration path (CVSS 9.3)
- [CVE-2026-56446](https://cve.now/CVE-2026-56446.md): Authenticated Remote Code Execution via Arbitrary NDJSON Error Log Path in MISP (CVSS 8.7)
- [CVE-2026-56425](https://cve.now/CVE-2026-56425.md): MISP AAD authentication plugin - Improper OAuth State Handling, Missing Session Rotation, Insecure Redirect URI Validation, and Log Injection (CVSS 9.3)
- [CVE-2026-56424](https://cve.now/CVE-2026-56424.md): Broken access control in MISP core allows cross-organization unauthorized modification or deletion of analyst data, event reports, collections, templates, and decaying models (CVSS 7.1)
- [CVE-2026-56423](https://cve.now/CVE-2026-56423.md): MISP Core: Broken access control allows instance-wide unauthorized deletion of event reports and sharing groups via bulk deletion endpoints (CVSS 9.4)
- [CVE-2026-56422](https://cve.now/CVE-2026-56422.md): MISP Core: Mass Assignment and Object Re-ownership via Unvalidated Request Fields (CVSS 9.4)
- [CVE-2026-54398](https://cve.now/CVE-2026-54398.md): MISP object edit authorization bypass allows unauthorized sharing group assignment (CVSS 5.3)
- [CVE-2026-54397](https://cve.now/CVE-2026-54397.md): MISP event editing allows unauthorized assignment to undisclosed sharing groups (CVSS 6.1)
- [CVE-2026-54396](https://cve.now/CVE-2026-54396.md): MISP AuthKey edit endpoint allows authenticated user email enumeration (CVSS 5.3)
- [CVE-2026-54395](https://cve.now/CVE-2026-54395.md): MISP UiBeta event index reflected XSS in advanced filter popup (CVSS 5.3)
- [CVE-2026-54394](https://cve.now/CVE-2026-54394.md): MISP organisation logo path traversal allows retrieval of arbitrary PNG/SVG files (CVSS 5.3)
- [CVE-2026-54393](https://cve.now/CVE-2026-54393.md): MISP Overmind theme stored XSS via unvalidated homepage setting (CVSS 5.1)
- [CVE-2026-54362](https://cve.now/CVE-2026-54362.md): MISP template builder exposes non-visible custom galaxies across organisations (CVSS 5.3)
- [CVE-2026-54361](https://cve.now/CVE-2026-54361.md): MISP mass assignment vulnerabilities allow unauthorized modification of ownership and delegation records (CVSS 8.8)
- [CVE-2026-54360](https://cve.now/CVE-2026-54360.md): MISP sharing group creation mass assignment allows unauthorized takeover of existing sharing groups (CVSS 8.4)
- [CVE-2026-54359](https://cve.now/CVE-2026-54359.md): MISP automation endpoints may be exposed to CSRF when Sec-Fetch-Site protection is disabled by default (CVSS 7.1)
- [CVE-2026-54358](https://cve.now/CVE-2026-54358.md): MISP organization administrators can target site administrator accounts for password reset (CVSS 7.5)
- [CVE-2026-54357](https://cve.now/CVE-2026-54357.md): MISP improper authorization allows organization administrators to modify site administrator user settings (CVSS 5.1)
- [CVE-2026-53693](https://cve.now/CVE-2026-53693.md): MISP BSimVis stored cross-site scripting in tag and cluster rendering paths via unescaped tag metadata and UI labels (CVSS 6.9)
- [CVE-2026-10868](https://cve.now/CVE-2026-10868.md): MISP user edit endpoint mass assignment vulnerability allows unauthorized user account modification (CVSS 9.0)
- [CVE-2026-10864](https://cve.now/CVE-2026-10864.md): MISP Dashboard widget field selection may expose restricted user and organisation data (CVSS 5.3)
- [CVE-2026-10863](https://cve.now/CVE-2026-10863.md): MISP User-controlled order parameter in correlations over-correlation endpoint (CVSS 6.4)
- [CVE-2026-10860](https://cve.now/CVE-2026-10860.md): MISP CRUDComponent delete validation bypass via operator precedence error (CVSS 7.9)
- [CVE-2026-10861](https://cve.now/CVE-2026-10861.md): MISP post-login open redirect via pre\_login\_requested\_url (CVSS 5.1)
- [CVE-2026-10856](https://cve.now/CVE-2026-10856.md): Open redirect in MISP dashboard button widget URL handling (CVSS 5.1)
- [CVE-2026-10855](https://cve.now/CVE-2026-10855.md): MISP Event template importer authorization bypass (CVSS 5.1)
- [CVE-2026-10854](https://cve.now/CVE-2026-10854.md): Unauthorized exposure of private galaxies in MISP event template creation (CVSS 5.3)
- [CVE-2026-10611](https://cve.now/CVE-2026-10611.md): OTP bypass via plugin-based LDAP authentication in MISP when LDAP mixed authentication is enabled (CVSS 8.2)
- [CVE-2026-9806](https://cve.now/CVE-2026-9806.md): Stored Cross-Site Scripting (XSS) in CTI Transmute Notification Panel via Malicious Convert Names (CVSS 6.3)
- [CVE-2026-9137](https://cve.now/CVE-2026-9137.md): CSP Report Endpoint Log Flooding in MISP via Incorrect Size Limit (CVSS 5.1)
- [CVE-2026-9136](https://cve.now/CVE-2026-9136.md): Unauthorized ShadowAttribute modification in MISP via client-supplied identifier (CVSS 8.3)
- [CVE-2026-9084](https://cve.now/CVE-2026-9084.md): MISP OIDC authentication bypass via automatic email-based account linking under insecure IdP configurations (CVSS 6.0)
- [CVE-2026-44379](https://cve.now/CVE-2026-44379.md): MISP: Improper UUID validation in MISP Collections (CVSS 5.3)
- [CVE-2026-44380](https://cve.now/CVE-2026-44380.md): MISP: Improper access control in auth key reset allows privilege escalation to site administrator (CVSS 8.6)
- [CVE-2026-44381](https://cve.now/CVE-2026-44381.md): MISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listings (CVSS 9.3)
- [CVE-2026-44363](https://cve.now/CVE-2026-44363.md): Unsafe remote resource fetching in expansion misp-modules (CVSS 5.8)
- [CVE-2026-44364](https://cve.now/CVE-2026-44364.md): misp-modules website - Missing CSRF protection in the website home blueprint (CVSS 9.3)
- [CVE-2026-8080](https://cve.now/CVE-2026-8080.md): MISP core - Stored XSS in MISP template (old engine) element attribute type (CVSS 6.8)
- [CVE-2026-39962](https://cve.now/CVE-2026-39962.md): LDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variable (CVSS 8.8)
- [CVE-2025-67906](https://cve.now/CVE-2025-67906.md): In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path. (CVSS 5.4)
- [CVE-2025-66386](https://cve.now/CVE-2025-66386.md): app/Model/EventReport.php in MISP before 2.5.27 allows path traversal in view picture for a site-admin. (CVSS 4.1)
- [CVE-2025-66384](https://cve.now/CVE-2025-66384.md): app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity, related to tmp\_name. (CVSS 8.2)
- [CVE-2024-58130](https://cve.now/CVE-2024-58130.md): In app/Controller/Component/RestResponseComponent.php in MISP before 2.4.193, REST endpoints have a lack of sanitization for non-JSON respon (CVSS 7.2)
- [CVE-2024-58129](https://cve.now/CVE-2024-58129.md): In MISP before 2.4.193, menu\_custom\_right\_link\_html parameters can be set via the UI (i.e., without using the CLI) and thus attackers with a (CVSS 5.5)
- [CVE-2024-58128](https://cve.now/CVE-2024-58128.md): In MISP before 2.4.193, menu\_custom\_right\_link parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin (CVSS 5.5)
- [CVE-2024-57969](https://cve.now/CVE-2024-57969.md): app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search. (CVSS 4.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/misp
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.