Skip to contentMisp vulnerabilities
Newest
- mispMISP EventsController queryEnrichment allows querying unavailable or legacy modules without validationCVE-2026-956745.3 Medium
- mispMISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/addCVE-2026-956715.3 Medium
- mispMISP Installer Log and FIFO Created World-Readable, Exposing Sensitive CredentialsCVE-2026-956676.9 Medium
- mispMISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSONCVE-2026-956655.1 Medium
- mispMISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type ListCVE-2026-956615.1 Medium
- mispMISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind ThreadCVE-2026-956594.8 Medium
- mispMISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution of workflow modulesCVE-2026-956586.9 Medium
- mispMISP CSRF vulnerability allows unauthorized attribute modificationCVE-2026-944047.1 High
- mispMISP Arbitrary Local File Read and SSRF via MISP Export UploadCVE-2026-944018.3 High
- mispMISP ObjectReferencesController: Granular Distribution and Sharing Group Restrictions Bypassed When Adding Object ReferencesCVE-2026-943946.3 Medium
- mispMISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReportCVE-2026-943936.4 Medium
- mispMISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File ExtensionCVE-2026-943838.6 High
- mispMISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTimeCVE-2026-943818.7 High
- mispMISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP)CVE-2026-943796.9 Medium
- mispMISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events' ReportsCVE-2026-943748.3 High
- mispMISP DOM-based Cross-Site Scripting via innerHTML in Contextual MenuCVE-2026-943736.3 Medium
- mispStored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies IndexCVE-2026-943726.3 Medium
- mispStored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy NameCVE-2026-942776.3 Medium
- mispMISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics LegendsCVE-2026-932968.5 High
- mispMISP Background Job Argument Injection via Console Path Switches Enables Remote Code ExecutionCVE-2026-932958.7 High
- misp sachertortephpMISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is DisabledCVE-2026-929325.1 Medium
- mispMISP Unthrottled Authentication Failure Log Writes Enable Resource ExhaustionCVE-2026-920036.9 Medium
- mispMISP: Authentication failure logging suppressed during Redis unavailabilityCVE-2026-920025.1 Medium
- mispMISP Access Log Entry Overwritten by Error Controller's Second beforeFilter PassCVE-2026-918595.3 Medium
- mispMISP: State-changing actions accessible via GET request enabling CSRFCVE-2026-918575.3 Medium
- mispMISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag ComparisonCVE-2026-918515.3 Medium
- mispMISP Collection Element Add Missing Authorization on Referenced Object UUIDCVE-2026-918467.1 High
- mispMISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During EditCVE-2026-918257.1 High
- mispMISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponentCVE-2026-918196.9 Medium
- mispMISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String CredentialsCVE-2026-909619.3 Critical
- mispMISP: Stored XSS via Inline-Served SVG Organisation Logos and Report PicturesCVE-2026-909575.1 Medium
- mispMISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model LoadCVE-2026-909554.6 Medium
- mispMISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal InjectionCVE-2026-908958.4 High
- mispMISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle EndpointsCVE-2026-908935.1 Medium
- mispMISP: Unescaped HTML Injection in PDF Report Element RenderingCVE-2026-889215.1 Medium
- mispMISP Event Template Instantiation Bypasses Sharing Group and Tagging AuthorizationCVE-2026-889157.1 High
- mispMISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request FloodingCVE-2026-864528.7 High
- mispMISP Event Graph Object Reference Lookup Exposes References from Unauthorized ObjectsCVE-2026-864515.3 Medium
- mispMISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation DataCVE-2026-864412.3 Low
- mispMISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLsCVE-2026-864405.1 Medium
- mispMISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII DiscoveryCVE-2026-864197.0 High
- mispMISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized UsersCVE-2026-864182.3 Low
- mispMISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized UsersCVE-2026-864175.3 Medium
- mispMISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected EventsCVE-2026-864087.1 High
- mispMISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URLCVE-2026-863515.1 Medium
- mispMISP Missing Authorization on Template File Upload Allows Authenticated Disk ExhaustionCVE-2026-863477.1 High
- mispMISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed InformationCVE-2026-863425.3 Medium
- mispMISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event DataCVE-2026-86283Public exploit7.1 High
- mispCross-Site Request Forgery via Attacker-Controlled REST Detection in MISPCVE-2026-855476.2 Medium
- mispMISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET RequestsCVE-2026-855468.6 High
- Show moreLoading…