Misp vulnerabilities
183 CVEs and advisories name Misp as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-86440MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs
- CVE-2026-86419MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII Discovery
- CVE-2026-86418MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users
- CVE-2026-86417MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Users
- CVE-2026-86408MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected Events
- CVE-2026-86351MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL
- CVE-2026-86347MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion
- CVE-2026-86342MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Information
- CVE-2026-86283MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data
- CVE-2026-85547Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP
- CVE-2026-85546MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests
- CVE-2026-85538MISP Attribute Deletion Authorization Bypass Allows Users Without Modify Permissions to Delete Attributes
- CVE-2026-85533MISP Sharing Group Authorization Bypass via Omitted Distribution Parameter
- CVE-2026-85239MISP Event Template Definition Validation Bypass Allows Persistent Denial of Service
- CVE-2026-85238Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking
- CVE-2026-85237Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass
- CVE-2026-85236MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request
- CVE-2026-85230MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection
- CVE-2026-85227Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters
- CVE-2026-85226MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations
- CVE-2026-85221MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacks
- CVE-2026-85216MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials
- CVE-2026-77761Cross-Document Parser State Contamination in misp-stix
- CVE-2026-77755Denial of Service in MISP-STIX Import via Malformed or Oversized STIX Documents in misp-stix library
- CVE-2026-77751Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library
- CVE-2026-77710STIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Injection in misp-stix library
- CVE-2026-73162cti-transmute CSRF Allows Unauthorized Follow and Notification State Changes
- CVE-2026-73161cti-transmute Conversion Table Allows XSS via Unescaped Cell Content During Search Highlighting
- CVE-2026-73160cti-transmute Unauthenticated SSRF via Hostnames Resolving to Internal IP Addresses
- CVE-2026-73159cti-transmute Stored XSS via Crafted Tag Icon on Admin Triage Interface