Misp vulnerabilities
183 CVEs and advisories name Misp as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-94394MISP ObjectReferencesController: Granular Distribution and Sharing Group Restrictions Bypassed When Adding Object References
- CVE-2026-94393MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport
- CVE-2026-94383MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension
- CVE-2026-94381MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTime
- CVE-2026-94379MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP)
- CVE-2026-94374MISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events' Reports
- CVE-2026-94373MISP DOM-based Cross-Site Scripting via innerHTML in Contextual Menu
- CVE-2026-94372Stored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies Index
- CVE-2026-94277Stored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy Name
- CVE-2026-93296MISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics Legends
- CVE-2026-93295MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution
- CVE-2026-92932MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabled
- CVE-2026-92003MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion
- CVE-2026-92002MISP: Authentication failure logging suppressed during Redis unavailability
- CVE-2026-91859MISP Access Log Entry Overwritten by Error Controller's Second beforeFilter Pass
- CVE-2026-91857MISP: State-changing actions accessible via GET request enabling CSRF
- CVE-2026-91851MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag Comparison
- CVE-2026-91846MISP Collection Element Add Missing Authorization on Referenced Object UUID
- CVE-2026-91825MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit
- CVE-2026-91819MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent
- CVE-2026-90961MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentials
- CVE-2026-90957MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures
- CVE-2026-90955MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load
- CVE-2026-90895MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection
- CVE-2026-90893MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints
- CVE-2026-88921MISP: Unescaped HTML Injection in PDF Report Element Rendering
- CVE-2026-88915MISP Event Template Instantiation Bypasses Sharing Group and Tagging Authorization
- CVE-2026-86452MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding
- CVE-2026-86451MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects
- CVE-2026-86441MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data