Skip to content
Misp vulnerabilities
Newest
-
misp misp-guard
MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy Tags to Bypass Feed Policy Enforcement
CVE-2026-118173
6.1 Medium
-
misp misp-guard
MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding
CVE-2026-116469
7.1 High
-
misp misp-guard
MISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rules
CVE-2026-116372
7.7 High
-
misp misp-modules
MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()
CVE-2026-112991
6.3 Medium
-
misp
MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings
CVE-2026-112192
5.3 Medium
-
misp
MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution
CVE-2026-112188
7.1 High
-
misp
MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels
CVE-2026-112184
4.8 Medium
-
misp
MISP CSS Injection via Remote Tag Colour in Event Preview
CVE-2026-112183
4.8 Medium
-
misp
MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records
CVE-2026-112180
5.1 Medium
-
misp
MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances
CVE-2026-112179
5.3 Medium
-
misp
MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control
CVE-2026-112178
7.1 High
-
misp
MISP Object Sync Drops Objects and Attributes When Description Is Empty
CVE-2026-107278
5.3 Medium
-
misp
MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests
CVE-2026-107276
6.3 Medium
-
misp
MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances
CVE-2026-107180
7.1 High
-
misp
MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes
CVE-2026-107175
5.3 Medium
-
misp
MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change
CVE-2026-106513
6.9 Medium
-
misp sachertortephp
MISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSS
CVE-2026-106512
8.4 High
-
misp
MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View
CVE-2026-104914
5.3 Medium
-
misp
MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data
CVE-2026-104912
7.1 High
-
misp
MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization
CVE-2026-104910
5.3 Medium
-
misp
MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging
CVE-2026-104908
7.1 High
-
misp
MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler
CVE-2026-104907
4.8 Medium
-
misp
MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output
CVE-2026-104906
6.2 Medium
-
misp
MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server
CVE-2026-104901
5.1 Medium
-
misp
MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview Index
CVE-2026-104900
5.3 Medium
-
misp
MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions
CVE-2026-103858
5.3 Medium
-
misp
MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter
CVE-2026-103664
4.8 Medium
-
misp
MISP Reflected XSS in Taxonomy Tag Confirmation Forms
CVE-2026-103662
5.1 Medium
-
misp
MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes
CVE-2026-103659
7.1 High
-
misp
MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period
CVE-2026-103655
9.3 Critical
-
misp
MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypass
CVE-2026-103651
7.6 High
-
misp
MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation Graph
CVE-2026-103389
6.2 Medium
-
misp
MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field
CVE-2026-103388
6.2 Medium
-
misp
MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image
CVE-2026-103321
8.3 High
-
misp
MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection
CVE-2026-103239
8.6 High
-
misp
MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows
CVE-2026-103237
8.3 High
-
misp
MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Events
CVE-2026-103235
8.7 High
-
misp misp-modules
misp-modules: Shell Command Injection in MISP cisco_firesight_manager_ACL_rule_export Module via Unescaped Attribute Values
CVE-2026-97863
6.3 Medium
-
misp
MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths
CVE-2026-95806
7.7 High
-
misp
MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restriction
CVE-2026-95805
5.3 Medium
-
misp
MISP: Disabled-user check ineffective in pre-authentication TOTP login branch
CVE-2026-95754
6.9 Medium
-
misp
MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_name
CVE-2026-95703
5.1 Medium
-
misp
MISP Path Traversal via Organization Name in Org-Statistics Logo Check
CVE-2026-95701
5.1 Medium
-
misp
MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name
CVE-2026-95698
5.3 Medium
-
misp
MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Metadata
CVE-2026-95697
5.3 Medium
-
misp
MISP Information Disclosure via Forged Upload Path
CVE-2026-95693
5.3 Medium
-
misp
MISP Missing Authorization on replaceSuggestionInReport Event Report Action
CVE-2026-95685
5.3 Medium
-
misp
MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL
CVE-2026-95683
5.3 Medium
-
misp
MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View
CVE-2026-95682
4.8 Medium
-
misp
MISP Unauthenticated Blind SSRF via XML Body Processing
CVE-2026-95679
6.9 Medium
- Show olderLoading…