Misp vulnerabilities
183 CVEs and advisories name Misp as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-103655MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period
- CVE-2026-103651MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypass
- CVE-2026-103389MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation Graph
- CVE-2026-103388MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field
- CVE-2026-103321MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image
- CVE-2026-103239MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection
- CVE-2026-103237MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows
- CVE-2026-103235MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Events
- CVE-2026-97863misp-modules: Shell Command Injection in MISP cisco_firesight_manager_ACL_rule_export Module via Unescaped Attribute Values
- CVE-2026-95806MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths
- CVE-2026-95805MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restriction
- CVE-2026-95754MISP: Disabled-user check ineffective in pre-authentication TOTP login branch
- CVE-2026-95703MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_name
- CVE-2026-95701MISP Path Traversal via Organization Name in Org-Statistics Logo Check
- CVE-2026-95698MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name
- CVE-2026-95697MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Metadata
- CVE-2026-95693MISP Information Disclosure via Forged Upload Path
- CVE-2026-95685MISP Missing Authorization on replaceSuggestionInReport Event Report Action
- CVE-2026-95683MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL
- CVE-2026-95682MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View
- CVE-2026-95679MISP Unauthenticated Blind SSRF via XML Body Processing
- CVE-2026-95674MISP EventsController queryEnrichment allows querying unavailable or legacy modules without validation
- CVE-2026-95671MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add
- CVE-2026-95667MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials
- CVE-2026-95665MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON
- CVE-2026-95661MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type List
- CVE-2026-95659MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread
- CVE-2026-95658MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution of workflow modules
- CVE-2026-94404MISP CSRF vulnerability allows unauthorized attribute modification
- CVE-2026-94401MISP Arbitrary Local File Read and SSRF via MISP Export Upload