CVE-2026-112178 HIGH 7.1 Misp — MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization ch… 2026-10-19 CVE-2026-112179 MEDIUM 5.3 Misp — In MISP, the event synchronization process contained a logic error in the preparation of event reports for rem… 2026-10-19 CVE-2026-112180 MEDIUM 5.1 Misp — MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associa… 2026-10-19 CVE-2026-112183 MEDIUM 4.8 Misp — MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event… 2026-10-19 CVE-2026-112184 MEDIUM 4.8 Misp — MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter… 2026-10-19 CVE-2026-112188 HIGH 7.1 Misp — MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to ret… 2026-10-19 CVE-2026-112192 MEDIUM 5.3 Misp — MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-suppl… 2026-10-19 CVE-2026-112991 MEDIUM 6.3 Misp Modules — The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerabil… 2026-10-19 CVE-2026-107175 MEDIUM 5.3 Misp — MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating corr… 2026-10-07 CVE-2026-107180 HIGH 7.1 Misp — On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandato… 2026-10-07 CVE-2026-107276 MEDIUM 6.3 Misp — MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests c… 2026-10-07 CVE-2026-107278 MEDIUM 5.3 Misp — MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a d… 2026-10-07 CVE-2026-106512 HIGH 8.4 Sachertortephp — The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition head… 2026-10-06 CVE-2026-106513 MEDIUM 6.9 Misp — MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core applicati… 2026-10-06 CVE-2026-104900 MEDIUM 5.3 Misp — MISP contains a stored cross-site scripting (XSS) vulnerability in the index table rendering of the remote eve… 2026-10-02 CVE-2026-104901 MEDIUM 5.1 Misp — MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the I… 2026-10-02 CVE-2026-104906 MEDIUM 6.2 Misp — MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote … 2026-10-02 CVE-2026-104907 MEDIUM 4.8 Misp — MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page. When a linked (remo… 2026-10-02 CVE-2026-104908 HIGH 7.1 Misp — MISP contains an improper input validation vulnerability in the decaying model import functionality. The impor… 2026-10-02 CVE-2026-104910 MEDIUM 5.3 Misp — MISP contains an authorization bypass in the related events listing functionality. When a user requests the li… 2026-10-02 CVE-2026-104912 HIGH 7.1 Misp — MISP contains an authorization flaw in its correlation handling during attribute searches. When a user perform… 2026-10-02 CVE-2026-104914 MEDIUM 5.3 Misp — MISP contains an improper access control vulnerability in its attribute search and paginated attribute view en… 2026-10-02 CVE-2026-103651 HIGH 7.6 Misp — MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consu… 2026-10-01 CVE-2026-103655 CRITICAL 9.3 Misp — MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a vali… 2026-10-01 CVE-2026-103659 HIGH 7.1 Misp — MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the … 2026-10-01 CVE-2026-103662 MEDIUM 5.1 Misp — MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confi… 2026-10-01 CVE-2026-103664 MEDIUM 4.8 Misp — MISP contains a reflected cross-site scripting (XSS) vulnerability in the analyst data notes panel. The seed p… 2026-10-01 CVE-2026-103858 MEDIUM 5.3 Misp — MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a… 2026-10-01 CVE-2026-103235 HIGH 8.7 Misp — MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation per… 2026-09-30 CVE-2026-103237 HIGH 8.3 Misp — MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data throug… 2026-09-30 CVE-2026-103239 HIGH 8.6 Misp — MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. T… 2026-09-30 CVE-2026-103321 HIGH 8.3 Misp — MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature. The event gr… 2026-09-30 CVE-2026-103388 MEDIUM 6.2 Misp — MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PH… 2026-09-30 CVE-2026-103389 MEDIUM 6.2 Misp — MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path. The icon fie… 2026-09-30 CVE-2026-97863 MEDIUM 6.3 Misp Modules — The cisco_firesight_manager_ACL_rule_export module in misp-modules generates a shell script (.sh) that authent… 2026-09-25 CVE-2026-95658 MEDIUM 6.9 Misp — MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedAct… 2026-09-22 CVE-2026-95659 MEDIUM 4.8 Misp — MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject… 2026-09-22 CVE-2026-95661 MEDIUM 5.1 Misp — MISP contains a reflected cross-site scripting (XSS) vulnerability in the attribute histogram view. The $selec… 2026-09-22 CVE-2026-95665 MEDIUM 5.1 Misp — MISP contains a reflected cross-site scripting (XSS) vulnerability in the event REST search export confirmatio… 2026-09-22 CVE-2026-95667 MEDIUM 6.9 Misp — The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a log file at /var/lo… 2026-09-22 CVE-2026-95671 MEDIUM 5.3 Misp — In MISP, the CollectionsController add() method enforced the sharing-group usability authorization check and e… 2026-09-22 CVE-2026-95674 MEDIUM 5.3 Misp — In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over… 2026-09-22 CVE-2026-95679 MEDIUM 6.9 Misp — MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. The underlying … 2026-09-22 CVE-2026-95682 MEDIUM 4.8 Misp — MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MIS… 2026-09-22 CVE-2026-95683 MEDIUM 5.3 Misp — In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. … 2026-09-22 CVE-2026-95685 MEDIUM 5.3 Misp — MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, … 2026-09-22 CVE-2026-95693 MEDIUM 5.3 Misp — In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmp_name field by invoking file_… 2026-09-22 CVE-2026-95697 MEDIUM 5.3 Misp — MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter i… 2026-09-22 CVE-2026-95698 MEDIUM 5.3 Misp — The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied o… 2026-09-22 CVE-2026-95701 MEDIUM 5.1 Misp — In MISP, the __statisticsOrgs method in UsersController.php used the organization name directly as a file-syst… 2026-09-22 CVE-2026-95703 MEDIUM 5.1 Misp — In MISP, the OrganisationsController::__uploadLogo method processed a caller-supplied tmp_name value with file… 2026-09-22 CVE-2026-95754 MEDIUM 6.9 Misp — In MISP's UsersController login() method, the pre-authentication database query used for the TOTP (two-factor … 2026-09-22 CVE-2026-95805 MEDIUM 5.3 Misp — A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttribute… 2026-09-22 CVE-2026-95806 HIGH 7.7 Misp — MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point. … 2026-09-22 CVE-2026-94277 MEDIUM 6.3 Misp — MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name dire… 2026-09-21 CVE-2026-94372 MEDIUM 6.3 Misp — MISP contains a stored cross-site scripting (XSS) vulnerability in the default theme's Galaxies index page. Wh… 2026-09-21 CVE-2026-94373 MEDIUM 6.3 Misp — MISP contains a DOM-based cross-site scripting (XSS) vulnerability in the contextual menu JavaScript component… 2026-09-21 CVE-2026-94374 HIGH 8.3 Misp — MISP contains an insecure direct object reference vulnerability in the processModuleResultsData method of the … 2026-09-21 CVE-2026-94379 MEDIUM 6.9 Misp — The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several s… 2026-09-21 CVE-2026-94381 HIGH 8.7 Misp — MISP has a security issue that can let a user gain more access than their API key is supposed to allow. A rea… 2026-09-21 CVE-2026-94383 HIGH 8.6 Misp — The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating th… 2026-09-21 CVE-2026-94393 MEDIUM 6.4 Misp — When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID wit… 2026-09-21 CVE-2026-94394 MEDIUM 6.3 Misp — When a regular user adds a reference between objects or attributes, MISP checks whether the user can access th… 2026-09-21 CVE-2026-94401 HIGH 8.3 Misp — MISP has a file-handling vulnerability that could let certain authenticated users make the server read files o… 2026-09-21 CVE-2026-94404 HIGH 7.1 Misp — MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’… 2026-09-21 CVE-2026-92932 MEDIUM 5.1 Sachertortephp — In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logi… 2026-09-17 CVE-2026-93295 HIGH 8.7 Misp — MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as th… 2026-09-17 CVE-2026-93296 HIGH 8.5 Misp — MISP contains a stored cross-site scripting (XSS) vulnerability in the Overmind theme's statistics views. The … 2026-09-17 CVE-2026-91819 MEDIUM 6.9 Misp — Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF an… 2026-09-15 CVE-2026-91825 HIGH 7.1 Misp — Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path. The vul… 2026-09-15 CVE-2026-91846 HIGH 7.1 Misp — Affected versions of MISP allow a collection element to be created from a bare UUID without consistently check… 2026-09-15 CVE-2026-91851 MEDIUM 5.3 Misp — Affected versions of MISP incorrectly filter dashboard templates that are restricted to a specific permission … 2026-09-15 CVE-2026-91857 MEDIUM 5.3 Misp — Affected versions of MISP expose several state-changing controller actions without restricting them to POST. … 2026-09-15 CVE-2026-91859 MEDIUM 5.3 Misp — Affected versions of MISP can record incorrect access-log data for requests that terminate in an exception. … 2026-09-15 CVE-2026-92002 MEDIUM 5.1 Misp — Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to … 2026-09-15 CVE-2026-92003 MEDIUM 6.9 Misp — Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Tw… 2026-09-15 CVE-2026-90893 MEDIUM 5.1 Misp — MISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSettingsController. The actions set… 2026-09-14 CVE-2026-90895 HIGH 8.4 Misp — Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web a… 2026-09-14 CVE-2026-90955 MEDIUM 4.6 Misp — Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MI… 2026-09-14 CVE-2026-90957 MEDIUM 5.1 Misp — Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. The commit… 2026-09-14 CVE-2026-90961 CRITICAL 9.3 Misp — The LdapAuth and LinOTPAuth authentication plugins in MISP contain an authentication bypass vulnerability. Bot… 2026-09-14 CVE-2026-88915 HIGH 7.1 Misp — Affected versions of MISP do not consistently enforce the acting user's authorization when instantiating event… 2026-09-10 CVE-2026-88921 MEDIUM 5.1 Misp — MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsi… 2026-09-10 CVE-2026-86342 MEDIUM 5.3 Misp — Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. Th… 2026-09-07 CVE-2026-86347 HIGH 7.1 Misp — Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile() because the… 2026-09-07 CVE-2026-86351 MEDIUM 5.1 Misp — Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path b… 2026-09-07 CVE-2026-86408 HIGH 7.1 Misp — Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through Crypt… 2026-09-07 CVE-2026-86417 MEDIUM 5.3 Misp — Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTempla… 2026-09-07 CVE-2026-86418 LOW 2.3 Misp — Affected versions of MISP expose organisation metadata through the dashboard organisation picker without apply… 2026-09-07 CVE-2026-86419 HIGH 7 Misp — Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed re… 2026-09-07 CVE-2026-86440 MEDIUM 5.1 Misp — Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widg… 2026-09-07 CVE-2026-86441 LOW 2.3 Misp — Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display orga… 2026-09-07 CVE-2026-86451 MEDIUM 5.3 Misp — Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through Event… 2026-09-07 CVE-2026-86452 HIGH 8.7 Misp — Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent wor… 2026-09-07 CVE-2026-86283 HIGH 7.1 Misp — MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp) performed a secondary query … 2026-09-06