CVEs we hold for Misp

Records whose assigning authority named Misp as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-9806Stored Cross-Site Scripting (XSS) in CTI Transmute Notification Panel via Malicious Convert Namesmisp cti-transmute

CVE-2026-93296MISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics Legendsmisp

CVE-2026-93295MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Executionmisp

CVE-2026-92932MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabledmisp sachertortephp

CVE-2026-92003MISP Unthrottled Authentication Failure Log Writes Enable Resource ExhaustionMISP

CVE-2026-92002MISP: Authentication failure logging suppressed during Redis unavailabilityMISP

CVE-2026-91859MISP Access Log Entry Overwritten by Error Controller's Second beforeFilter PassMISP

CVE-2026-91857MISP: State-changing actions accessible via GET request enabling CSRFMISP

CVE-2026-91851MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag ComparisonMISP

CVE-2026-91846MISP Collection Element Add Missing Authorization on Referenced Object UUIDMISP

CVE-2026-91825MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During EditMISP

CVE-2026-91819MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponentMISP

CVE-2026-9137CSP Report Endpoint Log Flooding in MISP via Incorrect Size Limitmisp

CVE-2026-9136Unauthorized ShadowAttribute modification in MISP via client-supplied identifiermisp

CVE-2026-90961MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String CredentialsMISP

CVE-2026-90957MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report PicturesMISP

CVE-2026-90955MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model LoadMISP

CVE-2026-90895MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal InjectionMISP

CVE-2026-90893MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle EndpointsMISP

CVE-2026-9084MISP OIDC authentication bypass via automatic email-based account linking under insecure IdP configurationsmisp

CVE-2026-88921MISP: Unescaped HTML Injection in PDF Report Element RenderingMISP

CVE-2026-88915MISP Event Template Instantiation Bypasses Sharing Group and Tagging AuthorizationMISP

CVE-2026-86452MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request FloodingMISP

CVE-2026-86451MISP Event Graph Object Reference Lookup Exposes References from Unauthorized ObjectsMISP

CVE-2026-86441MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation DataMISP

CVE-2026-86440MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLsMISP

CVE-2026-86419MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII DiscoveryMISP

CVE-2026-86418MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized UsersMISP

CVE-2026-86417MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized UsersMISP

CVE-2026-86408MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected EventsMISP

CVE-2026-86351MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URLMISP

CVE-2026-86347MISP Missing Authorization on Template File Upload Allows Authenticated Disk ExhaustionMISP

CVE-2026-86342MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed InformationMISP

CVE-2026-86283MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event DataMISP

CVE-2026-85547Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISPmisp

CVE-2026-85546MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requestsmisp

CVE-2026-85538MISP Attribute Deletion Authorization Bypass Allows Users Without Modify Permissions to Delete Attributesmisp

CVE-2026-85533MISP Sharing Group Authorization Bypass via Omitted Distribution Parametermisp

CVE-2026-85239MISP Event Template Definition Validation Bypass Allows Persistent Denial of Servicemisp

CVE-2026-85238Session Fixation in MISP CustomAuth Authentication Allows Session Hijackingmisp

CVE-2026-85237Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypassmisp

CVE-2026-85236MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Requestmisp

CVE-2026-85230MISP Dashboard Button Widget Allows Persistent JavaScript URL Injectionmisp

CVE-2026-85227Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parametersmisp

CVE-2026-85226MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlationsmisp

CVE-2026-85221MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacksmisp

CVE-2026-85216MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentialsmisp

CVE-2026-8080MISP core - Stored XSS in MISP template (old engine) element attribute typemisp

CVE-2026-77761Cross-Document Parser State Contamination in misp-stixmisp-stix

CVE-2026-77755Denial of Service in MISP-STIX Import via Malformed or Oversized STIX Documents in misp-stix librarymisp-stix

CVE-2026-77751Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix librarymisp-stix

CVE-2026-77710STIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Injection in misp-stix librarymisp-stix

CVE-2026-73162cti-transmute CSRF Allows Unauthorized Follow and Notification State ChangesMISP cti-transmute

CVE-2026-73161cti-transmute Conversion Table Allows XSS via Unescaped Cell Content During Search HighlightingMISP cti-transmute

CVE-2026-73160cti-transmute Unauthenticated SSRF via Hostnames Resolving to Internal IP AddressesMISP cti-transmute

CVE-2026-73159cti-transmute Stored XSS via Crafted Tag Icon on Admin Triage InterfaceMISP cti-transmute

CVE-2026-73158cti-transmute Saved Graph Configuration Allows Stored Cross-Site Scripting via svgIconMISP cti-transmute

CVE-2026-73157cti-transmute Remote MISP Event Browser Allows Cross-Site Scripting via Malicious Event MetadataMISP cti-transmute

CVE-2026-73156cti-transmute Sunburst and Treemap Tooltips Allow Cross-Site Scripting via Crafted Conversion DataMISP cti-transmute

CVE-2026-73155cti-transmute Missing Authorization Allows Reactions to Private CommentsMISP cti-transmute

CVE-2026-73140cti-transmute Evaluation Report Exports Expose Private Comments and Author InformationMISP cti-transmute

CVE-2026-72760cti-transmute Following List Exposes User Email Addresses to Authenticated UsersMISP cti-transmute

CVE-2026-72759cti-transmute Conversion History Authorization Bypass Leads to Sensitive Data Disclosure After Conversion Deletionmisp cti-transmute

CVE-2026-72751Stored Cross-Site Scripting in CTI-Transmute Conversion Graph via Malicious STIX/MISP Contentmisp cti-transmute

CVE-2026-71502Unauthenticated Stored Vue Template Injection Leads to Cross-Site Scripting in CTI-Transmutemisp cti-transmute

CVE-2026-69082Cross-Site Request Forgery in the Administrative User Deletion Endpointmisp cti-transmute

CVE-2026-69079Unauthenticated Denial of Service via Unbounded Activity-Timeline Range in CTI-Transmutemisp cti-transmute

CVE-2026-69078Server-Side Request Forgery and Local File Disclosure in CTI-Transmute Evaluation PDF Renderingmisp cti-transmute

CVE-2026-67178Open Redirect in MISP Installer-Generated Apache Configurationmisp

CVE-2026-62143Server-Side Request Forgery protection bypass in misp-modules html_to_markdown via IPv4-mapped IPv6 addressesmisp-modules

CVE-2026-61474MISP: Improper sharing group authorization check when adding attributesmisp

CVE-2026-60125importModule function in MISP ignores per-organisation import module restrictionsmisp

CVE-2026-60124MISP importModule missing authorization allows read-only users to modify events via misp_standard importsmisp

CVE-2026-56447MISP remote code execution via arbitrary rdkafka configuration pathmisp

CVE-2026-56446Authenticated Remote Code Execution via Arbitrary NDJSON Error Log Path in MISPmisp

CVE-2026-56425MISP AAD authentication plugin - Improper OAuth State Handling, Missing Session Rotation, Insecure Redirect URI…misp

CVE-2026-56424Broken access control in MISP core allows cross-organization unauthorized modification or deletion of analyst data…misp

CVE-2026-56423MISP Core: Broken access control allows instance-wide unauthorized deletion of event reports and sharing groups via…misp

CVE-2026-56422MISP Core: Mass Assignment and Object Re-ownership via Unvalidated Request Fieldsmisp

CVE-2026-54398MISP object edit authorization bypass allows unauthorized sharing group assignmentmisp

CVE-2026-54397MISP event editing allows unauthorized assignment to undisclosed sharing groupsmisp

CVE-2026-54396MISP AuthKey edit endpoint allows authenticated user email enumerationmisp

CVE-2026-54395MISP UiBeta event index reflected XSS in advanced filter popupmisp

CVE-2026-54394MISP organisation logo path traversal allows retrieval of arbitrary PNG/SVG filesmisp

CVE-2026-54393MISP Overmind theme stored XSS via unvalidated homepage settingmisp

CVE-2026-54362MISP template builder exposes non-visible custom galaxies across organisationsmisp

CVE-2026-54361MISP mass assignment vulnerabilities allow unauthorized modification of ownership and delegation recordsmisp

CVE-2026-54360MISP sharing group creation mass assignment allows unauthorized takeover of existing sharing groupsmisp

CVE-2026-54359MISP automation endpoints may be exposed to CSRF when Sec-Fetch-Site protection is disabled by defaultmisp

CVE-2026-54358MISP organization administrators can target site administrator accounts for password resetmisp

CVE-2026-54357MISP improper authorization allows organization administrators to modify site administrator user settingsmisp

CVE-2026-53693MISP BSimVis stored cross-site scripting in tag and cluster rendering paths via unescaped tag metadata and UI labelsmisp bsimvis

CVE-2026-44381MISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listingsMISP

CVE-2026-44380MISP: Improper access control in auth key reset allows privilege escalation to site administratorMISP

CVE-2026-44379MISP: Improper UUID validation in MISP CollectionsMISP

CVE-2026-44364misp-modules website - Missing CSRF protection in the website home blueprintmisp-modules

CVE-2026-44363Unsafe remote resource fetching in expansion misp-modulesmisp-modules

CVE-2026-39962LDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variableMISP

CVE-2026-10868MISP user edit endpoint mass assignment vulnerability allows unauthorized user account modificationmisp

CVE-2026-10864MISP Dashboard widget field selection may expose restricted user and organisation datamisp

CVE-2026-10863MISP User-controlled order parameter in correlations over-correlation endpointmisp

CVE-2026-10861MISP post-login open redirect via pre_login_requested_urlmisp

CVE-2026-10860MISP CRUDComponent delete validation bypass via operator precedence errormisp

CVE-2026-10856Open redirect in MISP dashboard button widget URL handlingmisp

CVE-2026-10855MISP Event template importer authorization bypassmisp

CVE-2026-10854Unauthorized exposure of private galaxies in MISP event template creationmisp

CVE-2026-10611OTP bypass via plugin-based LDAP authentication in MISP when LDAP mixed authentication is enabledmisp

CVE-2025-67906no title heldMISP

CVE-2025-66386no title heldMISP

CVE-2025-66384no title heldMISP

CVE-2024-58130no title heldMISP

CVE-2024-58129no title heldMISP

CVE-2024-58128no title heldMISP

CVE-2024-57969no title heldMISP

114 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.