Skip to contentMisp vulnerabilities
Newest
- mispMISP Attribute Deletion Authorization Bypass Allows Users Without Modify Permissions to Delete AttributesCVE-2026-855388.3 High
- mispMISP Sharing Group Authorization Bypass via Omitted Distribution ParameterCVE-2026-855337.6 High
- mispMISP Event Template Definition Validation Bypass Allows Persistent Denial of ServiceCVE-2026-852397.1 High
- mispSession Fixation in MISP CustomAuth Authentication Allows Session HijackingCVE-2026-852387.6 High
- mispMissing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication BypassCVE-2026-852378.6 High
- mispMISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET RequestCVE-2026-852368.8 High
- mispMISP Dashboard Button Widget Allows Persistent JavaScript URL InjectionCVE-2026-852305.3 Medium
- mispReflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes ParametersCVE-2026-852276.1 Medium
- mispMISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted CorrelationsCVE-2026-852265.3 Medium
- mispMISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle AttacksCVE-2026-852217.6 High
- mispMISP LDAP and LinOTP Authentication Bypass via Empty or Invalid CredentialsCVE-2026-852169.5 Critical
- misp misp-stixCross-Document Parser State Contamination in misp-stixCVE-2026-777616.3 Medium
- misp misp-stixDenial of Service in MISP-STIX Import via Malformed or Oversized STIX Documents in misp-stix libraryCVE-2026-777558.7 High
- misp misp-stixPath Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix libraryCVE-2026-777518.8 High
- misp misp-stixSTIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Injection in misp-stix libraryCVE-2026-777106.9 Medium
- misp cti-transmutecti-transmute CSRF Allows Unauthorized Follow and Notification State ChangesCVE-2026-731625.3 Medium
- misp cti-transmutecti-transmute Conversion Table Allows XSS via Unescaped Cell Content During Search HighlightingCVE-2026-731615.1 Medium
- misp cti-transmutecti-transmute Unauthenticated SSRF via Hostnames Resolving to Internal IP AddressesCVE-2026-731608.7 High
- misp cti-transmutecti-transmute Stored XSS via Crafted Tag Icon on Admin Triage InterfaceCVE-2026-731595.1 Medium
- misp cti-transmutecti-transmute Saved Graph Configuration Allows Stored Cross-Site Scripting via svgIconCVE-2026-731585.1 Medium
- misp cti-transmutecti-transmute Remote MISP Event Browser Allows Cross-Site Scripting via Malicious Event MetadataCVE-2026-731572.3 Low
- misp cti-transmutecti-transmute Sunburst and Treemap Tooltips Allow Cross-Site Scripting via Crafted Conversion DataCVE-2026-731565.3 Medium
- misp cti-transmutecti-transmute Missing Authorization Allows Reactions to Private CommentsCVE-2026-731555.3 Medium
- misp cti-transmutecti-transmute Evaluation Report Exports Expose Private Comments and Author InformationCVE-2026-731405.3 Medium
- misp cti-transmutecti-transmute Following List Exposes User Email Addresses to Authenticated UsersCVE-2026-727605.3 Medium
- misp cti-transmutecti-transmute Conversion History Authorization Bypass Leads to Sensitive Data Disclosure After Conversion DeletionCVE-2026-727596.9 Medium
- misp cti-transmuteStored Cross-Site Scripting in CTI-Transmute Conversion Graph via Malicious STIX/MISP ContentCVE-2026-727515.1 Medium
- misp cti-transmuteUnauthenticated Stored Vue Template Injection Leads to Cross-Site Scripting in CTI-TransmuteCVE-2026-715025.1 Medium
- misp cti-transmuteCross-Site Request Forgery in the Administrative User Deletion EndpointCVE-2026-690828.8 High
- misp cti-transmuteUnauthenticated Denial of Service via Unbounded Activity-Timeline Range in CTI-TransmuteCVE-2026-690798.7 High
- misp cti-transmuteServer-Side Request Forgery and Local File Disclosure in CTI-Transmute Evaluation PDF RenderingCVE-2026-690788.8 High
- mispOpen Redirect in MISP Installer-Generated Apache ConfigurationCVE-2026-671787.8 High
- misp misp-modulesServer-Side Request Forgery protection bypass in misp-modules html_to_markdown via IPv4-mapped IPv6 addressesCVE-2026-621438.3 High
- mispMISP: Improper sharing group authorization check when adding attributesCVE-2026-614745.3 Medium
- mispimportModule function in MISP ignores per-organisation import module restrictionsCVE-2026-601255.3 Medium
- mispMISP importModule missing authorization allows read-only users to modify events via misp_standard importsCVE-2026-601245.3 Medium
- mispMISP remote code execution via arbitrary rdkafka configuration pathCVE-2026-564479.3 Critical
- mispAuthenticated Remote Code Execution via Arbitrary NDJSON Error Log Path in MISPCVE-2026-564468.7 High
- mispMISP AAD authentication plugin - Improper OAuth State Handling, Missing Session Rotation, Insecure Redirect URI Validation, and Log InjectionCVE-2026-564259.3 Critical
- mispBroken access control in MISP core allows cross-organization unauthorized modification or deletion of analyst data, event reports, collections, templates, and decaying modelsCVE-2026-564247.1 High
- mispMISP Core: Broken access control allows instance-wide unauthorized deletion of event reports and sharing groups via bulk deletion endpointsCVE-2026-56423Public exploit9.4 Critical
- mispMISP Core: Mass Assignment and Object Re-ownership via Unvalidated Request FieldsCVE-2026-564229.4 Critical
- mispMISP object edit authorization bypass allows unauthorized sharing group assignmentCVE-2026-543985.3 Medium
- mispMISP event editing allows unauthorized assignment to undisclosed sharing groupsCVE-2026-543976.1 Medium
- mispMISP AuthKey edit endpoint allows authenticated user email enumerationCVE-2026-543965.3 Medium
- mispMISP UiBeta event index reflected XSS in advanced filter popupCVE-2026-543955.3 Medium
- mispMISP organisation logo path traversal allows retrieval of arbitrary PNG/SVG filesCVE-2026-543945.3 Medium
- mispMISP Overmind theme stored XSS via unvalidated homepage settingCVE-2026-543935.1 Medium
- mispMISP template builder exposes non-visible custom galaxies across organisationsCVE-2026-543625.3 Medium
- mispMISP mass assignment vulnerabilities allow unauthorized modification of ownership and delegation recordsCVE-2026-543618.8 High
- Show moreLoading…