XSS in Misp

CVE-2026-54393

A stored cross-site scripting vulnerability exists in MISP when the Overmind theme is used. The setHomePage endpoint previously saved the user-controlled path value through setSettingInternal(), bypassing the normal setSetting() validation…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.004 (30.3th percentile) — read the EPSS interpretation.