Misp-project Misp vulnerabilities

• misp MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding CVE-2026-86452 8.7 HighSeptember 7, 2026
• misp MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects CVE-2026-86451 5.3 MediumSeptember 7, 2026
• misp MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data CVE-2026-86441 2.3 LowSeptember 7, 2026
• misp MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs CVE-2026-86440 5.1 MediumSeptember 7, 2026
• misp MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII Discovery CVE-2026-86419 7.0 HighSeptember 7, 2026
• misp MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users CVE-2026-86418 2.3 LowSeptember 7, 2026
• misp MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Users CVE-2026-86417 5.3 MediumSeptember 7, 2026
• misp MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected Events CVE-2026-86408 7.1 HighSeptember 7, 2026
• misp MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL CVE-2026-86351 5.1 MediumSeptember 7, 2026
• misp MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion CVE-2026-86347 7.1 HighSeptember 7, 2026
• misp MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Information CVE-2026-86342 5.3 MediumSeptember 7, 2026
• misp MISP Event Template Definition Validation Bypass Allows Persistent Denial of Service CVE-2026-85239 7.1 HighSeptember 3, 2026
• misp Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking CVE-2026-85238 7.6 HighSeptember 3, 2026
• misp Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass CVE-2026-85237 8.6 HighSeptember 3, 2026
• misp MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request CVE-2026-85236 8.8 HighSeptember 3, 2026
• misp MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection CVE-2026-85230 5.3 MediumSeptember 3, 2026
• misp Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters CVE-2026-85227 6.1 MediumSeptember 3, 2026
• misp MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations CVE-2026-85226 5.3 MediumSeptember 3, 2026
• misp MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacks CVE-2026-85221 7.6 HighSeptember 3, 2026
• misp MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials CVE-2026-85216 9.5 CriticalSeptember 3, 2026
• misp MISP remote code execution via arbitrary rdkafka configuration path CVE-2026-56447 9.3 CriticalJune 22, 2026
• misp Authenticated Remote Code Execution via Arbitrary NDJSON Error Log Path in MISP CVE-2026-56446 8.7 HighJune 22, 2026
• misp MISP AAD authentication plugin - Improper OAuth State Handling, Missing Session Rotation, Insecure Redirect URI Validation, and Log Injection CVE-2026-56425 9.3 CriticalJune 22, 2026
• misp Broken access control in MISP core allows cross-organization unauthorized modification or deletion of analyst data, event reports, collections, templates, and decaying models CVE-2026-56424 7.1 HighJune 22, 2026
• misp MISP Core: Broken access control allows instance-wide unauthorized deletion of event reports and sharing groups via bulk deletion endpoints CVE-2026-56423 Public exploit 9.4 CriticalJune 22, 2026
• misp MISP Dashboard widget field selection may expose restricted user and organisation data CVE-2026-10864 5.3 MediumJune 4, 2026
• misp MISP User-controlled order parameter in correlations over-correlation endpoint CVE-2026-10863 6.4 MediumJune 4, 2026
• misp MISP CRUDComponent delete validation bypass via operator precedence error CVE-2026-10860 7.9 HighJune 4, 2026
• misp MISP post-login open redirect via pre_login_requested_url CVE-2026-10861 5.1 MediumJune 4, 2026
• misp Open redirect in MISP dashboard button widget URL handling CVE-2026-10856 5.1 MediumJune 4, 2026
• misp MISP Event template importer authorization bypass CVE-2026-10855 5.1 MediumJune 4, 2026
• misp Unauthorized exposure of private galaxies in MISP event template creation CVE-2026-10854 5.3 MediumJune 4, 2026
• misp OTP bypass via plugin-based LDAP authentication in MISP when LDAP mixed authentication is enabled CVE-2026-10611 8.2 HighJune 2, 2026
• misp CSP Report Endpoint Log Flooding in MISP via Incorrect Size Limit CVE-2026-9137 5.1 MediumMay 20, 2026
• misp Unauthorized ShadowAttribute modification in MISP via client-supplied identifier CVE-2026-9136 8.3 HighMay 20, 2026
• misp MISP: Improper UUID validation in MISP Collections CVE-2026-44379 5.3 MediumMay 13, 2026
• misp MISP: Improper access control in auth key reset allows privilege escalation to site administrator CVE-2026-44380 8.6 HighMay 13, 2026
• misp MISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listings CVE-2026-44381 9.3 CriticalMay 13, 2026
• misp MISP core - Stored XSS in MISP template (old engine) element attribute type CVE-2026-8080 Public exploit 6.8 MediumMay 7, 2026
• misp LDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variable CVE-2026-39962 8.8 HighApril 9, 2026
• misp In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow... CVE-2025-67906 5.4 MediumDecember 15, 2025
• misp In app/Controller/Component/RestResponseComponent.php in MISP before 2.4.193, REST endpoints have... CVE-2024-58130 7.2 HighMarch 28, 2025
• misp In MISP before 2.4.193, menu_custom_right_link_html parameters can be set via the UI (i.e.,... CVE-2024-58129 5.5 MediumMarch 28, 2025
• misp In MISP before 2.4.193, menu_custom_right_link parameters can be set via the UI (i.e., without... CVE-2024-58128 5.5 MediumMarch 28, 2025
• misp app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search. CVE-2024-57969 4.3 MediumFebruary 14, 2025
• misp app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org... CVE-2024-46918 4.9 MediumSeptember 15, 2024
• misp In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access... CVE-2024-45509 6.5 MediumSeptember 1, 2024
• misp In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly... CVE-2024-29859 9.8 CriticalMarch 21, 2024
• misp In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not... CVE-2024-29858 9.8 CriticalMarch 21, 2024
• misp-project misp An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an... CVE-2024-25675 9.8 CriticalFebruary 9, 2024
• Show olderLoading…