Skip to contentMisp vulnerabilities
Newest
- mispMISP sharing group creation mass assignment allows unauthorized takeover of existing sharing groupsCVE-2026-543608.4 High
- mispMISP automation endpoints may be exposed to CSRF when Sec-Fetch-Site protection is disabled by defaultCVE-2026-543597.1 High
- mispMISP organization administrators can target site administrator accounts for password resetCVE-2026-543587.5 High
- mispMISP improper authorization allows organization administrators to modify site administrator user settingsCVE-2026-543575.1 Medium
- misp bsimvisMISP BSimVis stored cross-site scripting in tag and cluster rendering paths via unescaped tag metadata and UI labelsCVE-2026-536936.9 Medium
- mispMISP user edit endpoint mass assignment vulnerability allows unauthorized user account modificationCVE-2026-108689.0 Critical
- mispMISP Dashboard widget field selection may expose restricted user and organisation dataCVE-2026-108645.3 Medium
- mispMISP User-controlled order parameter in correlations over-correlation endpointCVE-2026-108636.4 Medium
- mispMISP CRUDComponent delete validation bypass via operator precedence errorCVE-2026-108607.9 High
- mispMISP post-login open redirect via pre_login_requested_urlCVE-2026-108615.1 Medium
- mispOpen redirect in MISP dashboard button widget URL handlingCVE-2026-108565.1 Medium
- mispMISP Event template importer authorization bypassCVE-2026-108555.1 Medium
- mispUnauthorized exposure of private galaxies in MISP event template creationCVE-2026-108545.3 Medium
- mispOTP bypass via plugin-based LDAP authentication in MISP when LDAP mixed authentication is enabledCVE-2026-106118.2 High
- misp cti-transmuteStored Cross-Site Scripting (XSS) in CTI Transmute Notification Panel via Malicious Convert NamesCVE-2026-9806Public exploit6.3 Medium
- mispCSP Report Endpoint Log Flooding in MISP via Incorrect Size LimitCVE-2026-91375.1 Medium
- mispUnauthorized ShadowAttribute modification in MISP via client-supplied identifierCVE-2026-91368.3 High
- mispMISP OIDC authentication bypass via automatic email-based account linking under insecure IdP configurationsCVE-2026-90846.0 Medium
- mispMISP: Improper UUID validation in MISP CollectionsCVE-2026-443795.3 Medium
- mispMISP: Improper access control in auth key reset allows privilege escalation to site administratorCVE-2026-443808.6 High
- mispMISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listingsCVE-2026-443819.3 Critical
- mispMISP core - Stored XSS in MISP template (old engine) element attribute typeCVE-2026-8080Public exploit6.8 Medium
- misp misp-modulesmisp-modules website - Missing CSRF protection in the website home blueprintCVE-2026-443649.3 Critical
- misp misp-modulesUnsafe remote resource fetching in expansion misp-modulesCVE-2026-44363Fix available5.8 Medium
- mispLDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variableCVE-2026-399628.8 High
- mispIn MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow...CVE-2025-679065.4 Medium
- mispapp/Model/EventReport.php in MISP before 2.5.27 allows path traversal in view picture for a site...CVE-2025-663864.1 Medium
- mispapp/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for...CVE-2025-663848.2 High
- mispIn app/Controller/Component/RestResponseComponent.php in MISP before 2.4.193, REST endpoints have...CVE-2024-581307.2 High
- mispIn MISP before 2.4.193, menu_custom_right_link_html parameters can be set via the UI (i.e.,...CVE-2024-581295.5 Medium
- mispIn MISP before 2.4.193, menu_custom_right_link parameters can be set via the UI (i.e., without...CVE-2024-581285.5 Medium
- mispapp/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search.CVE-2024-579694.3 Medium
- mispapp/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org...CVE-2024-469184.9 Medium
- mispIn MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access...CVE-2024-455096.5 Medium
- mispIn MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly...CVE-2024-298599.8 Critical
- mispIn MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not...CVE-2024-298589.8 Critical
- mispAn issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a...CVE-2024-256749.8 Critical
- misp misp-maltegoMaltego incorrectly shares a MISP connection across users in a remote-transform use caseCVE-2020-12889Fix available9.8 Critical