CVE-2026-97863 | | | 2026-09-25 | The cisco_firesight_manager_ACL_rule_export module in misp-modules generates a shell script (.sh) that authenticates to and calls the Cisco fireSIGHT Manager A… |
CVE-2026-95806 | | | 2026-09-22 | MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point.
The phar stream wrapper causes PHP to treat a p… |
CVE-2026-95805 | | | 2026-09-22 | A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the permission string 'them… |
CVE-2026-95754 | | | 2026-09-22 | In MISP's UsersController login() method, the pre-authentication database query used for the TOTP (two-factor authentication) verification branch did not inclu… |
CVE-2026-95703 | | | 2026-09-22 | In MISP, the OrganisationsController::__uploadLogo method processed a caller-supplied tmp_name value with filesystem probes (file_exists, MIME type detection… |
CVE-2026-95701 | | | 2026-09-22 | In MISP, the __statisticsOrgs method in UsersController.php used the organization name directly as a file-system path component when checking for the existence… |
CVE-2026-95698 | | | 2026-09-22 | The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organization identifier with a fixed image directo… |
CVE-2026-95697 | | | 2026-09-22 | MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwri… |
CVE-2026-95693 | | | 2026-09-22 | In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmp_name field by invoking file_exists(), mime_content_type(), and exif_imagetype… |
CVE-2026-95685 | | | 2026-09-22 | MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allows modification of suggestion content w… |
CVE-2026-95683 | | | 2026-09-22 | In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using onl… |
CVE-2026-95682 | | | 2026-09-22 | MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated… |
CVE-2026-95679 | | | 2026-09-22 | MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. The underlying Xml::build() library contains a logic error in it… |
CVE-2026-95674 | | | 2026-09-22 | In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules to find a match. If… |
CVE-2026-95671 | | | 2026-09-22 | In MISP, the CollectionsController add() method enforced the sharing-group usability authorization check and element capture only when the HTTP request method… |
CVE-2026-95667 | | | 2026-09-22 | The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a log file at /var/log/misp_install.log and a named pipe (FIFO) at /va… |
CVE-2026-95665 | | | 2026-09-22 | MISP contains a reflected cross-site scripting (XSS) vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/ev… |
CVE-2026-95661 | | | 2026-09-22 | MISP contains a reflected cross-site scripting (XSS) vulnerability in the attribute histogram view. The $selectedTypes variable, which is derived from the URL… |
CVE-2026-95659 | | | 2026-09-22 | MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type… |
CVE-2026-95658 | | | 2026-09-22 | MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedActions list. In CakePHP, listing an action in unloc… |
CVE-2026-94404 | | | 2026-09-21 | MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’s browser without that user knowingly approving t… |
CVE-2026-94401 | | | 2026-09-21 | MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services.
When importi… |
CVE-2026-94394 | | | 2026-09-21 | When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whe… |
CVE-2026-94393 | | | 2026-09-21 | When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actual… |
CVE-2026-94383 | | | 2026-09-21 | The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied w… |
CVE-2026-94381 | | | 2026-09-21 | MISP has a security issue that can let a user gain more access than their API key is supposed to allow.
A read-only API key should only let someone view infor… |
CVE-2026-94379 | | | 2026-09-21 | The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code us… |
CVE-2026-94374 | | | 2026-09-21 | MISP contains an insecure direct object reference vulnerability in the processModuleResultsData method of the Event model. When processing module results, the… |
CVE-2026-94373 | | | 2026-09-21 | MISP contains a DOM-based cross-site scripting (XSS) vulnerability in the contextual menu JavaScript component. The ContextualMenu class populates HTML <option… |
CVE-2026-94372 | | | 2026-09-21 | MISP contains a stored cross-site scripting (XSS) vulnerability in the default theme's Galaxies index page. When a MISP instance detects unknown custom or defa… |
CVE-2026-94277 | | | 2026-09-21 | MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via sprintf() without any H… |
CVE-2026-93296 | | | 2026-09-17 | MISP contains a stored cross-site scripting (XSS) vulnerability in the Overmind theme's statistics views. The event General card and the server/feed preview ca… |
CVE-2026-93295 | | | 2026-09-17 | MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed d… |
CVE-2026-92932 | | | 2026-09-17 | In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-bas… |
CVE-2026-92003 | | | 2026-09-15 | Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle.
Two API authentication failure branches wrote direc… |
CVE-2026-92002 | | | 2026-09-15 | Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still record… |
CVE-2026-91859 | | | 2026-09-15 | Affected versions of MISP can record incorrect access-log data for requests that terminate in an exception.
Because CakeErrorController extends AppController… |
CVE-2026-91857 | | | 2026-09-15 | Affected versions of MISP expose several state-changing controller actions without restricting them to POST.
The affected actions are:
- EventReportsCont… |
CVE-2026-91851 | | | 2026-09-15 | Affected versions of MISP incorrectly filter dashboard templates that are restricted to a specific permission flag.
DashboardsController::listTemplates() all… |
CVE-2026-91846 | | | 2026-09-15 | Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access… |
CVE-2026-91825 | | | 2026-09-15 | Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path.
The vulnerable logic checked whether the acting user cou… |
CVE-2026-91819 | | | 2026-09-15 | Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation.
CakePHP honors a _me… |
CVE-2026-90961 | | | 2026-09-14 | The LdapAuth and LinOTPAuth authentication plugins in MISP contain an authentication bypass vulnerability. Both LdapAuthenticate and LinOTPAuthenticate replace… |
CVE-2026-90957 | | | 2026-09-14 | Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox.
The commit explains that SVG files are XML documents rather… |
CVE-2026-90955 | | | 2026-09-14 | Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging.
The shell is desi… |
CVE-2026-90895 | | | 2026-09-14 | Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsi… |
CVE-2026-90893 | | | 2026-09-14 | MISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle we… |
CVE-2026-88921 | | | 2026-09-10 | MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references (attrib… |
CVE-2026-88915 | | | 2026-09-10 | Affected versions of MISP do not consistently enforce the acting user's authorization when instantiating event templates.
For templates using distribution =… |
CVE-2026-86452 | High | 7.5 | 2026-09-07 | Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting… |
CVE-2026-86451 | Medium | 4.3 | 2026-09-07 | Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::get_reference_data() without first che… |
CVE-2026-86441 | Medium | 4.3 | 2026-09-07 | Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information.
Several organisation-rela… |
CVE-2026-86440 | Medium | 5.4 | 2026-09-07 | Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget.
The widget's URL is stored configuration co… |
CVE-2026-86419 | Critical | 9.1 | 2026-09-07 | Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality.
In f… |
CVE-2026-86418 | Medium | 4.3 | 2026-09-07 | Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by… |
CVE-2026-86417 | Medium | 4.3 | 2026-09-07 | Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates().
The query always fetched User.email, whi… |
CVE-2026-86408 | Medium | 6.5 | 2026-09-07 | Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view().
The vulnerable… |
CVE-2026-86351 | Medium | 6.1 | 2026-09-07 | Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because… |
CVE-2026-86347 | Medium | 6.5 | 2026-09-07 | Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile() because the ACL entry for templates/uploadFile used the wild… |
CVE-2026-86342 | Medium | 4.3 | 2026-09-07 | Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview performed correlation lookups against a… |
CVE-2026-86283 | | | 2026-09-06 | MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp) performed a secondary query of member events by UUID without applying the cal… |
CVE-2026-85547 | | | 2026-09-04 | A cross-site request forgery (CSRF) vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request… |
CVE-2026-85546 | | | 2026-09-04 | MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServ… |
CVE-2026-85538 | | | 2026-09-04 | An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite lacking the required perm_modify or perm_… |
CVE-2026-85533 | | | 2026-09-04 | An authorization flaw in MISP allowed an authenticated user to submit a sharing_group_id without verifying that the user was authorized to use the referenced S… |
CVE-2026-85239 | Medium | 6.5 | 2026-09-03 | A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the… |
CVE-2026-85238 | Medium | 6.8 | 2026-09-03 | MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow. When a user was successfully authenticated throu… |
CVE-2026-85237 | High | 8.1 | 2026-09-03 | A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perform an unrestricted number of OTP verification att… |
CVE-2026-85236 | High | 8.8 | 2026-09-03 | A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible opera… |
CVE-2026-85230 | Medium | 5.4 | 2026-09-03 | A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the wid… |
CVE-2026-85227 | Medium | 6.1 | 2026-09-03 | MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttri… |
CVE-2026-85226 | Medium | 4.3 | 2026-09-03 | MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applyin… |
CVE-2026-85221 | Critical | 9.1 | 2026-09-03 | MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and there… |
CVE-2026-85216 | Critical | 9.8 | 2026-09-03 | MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentia… |
CVE-2026-77761 | | | 2026-08-21 | A parser state isolation vulnerability in misp-stix could cause data from a previously processed STIX document to be retained and incorporated into the MISP ev… |
CVE-2026-77755 | | | 2026-08-21 | A denial-of-service vulnerability was identified in misp-stix when processing attacker-controlled STIX 1 or STIX 2 documents.
The STIX import code used sys.ex… |
CVE-2026-77751 | | | 2026-08-21 | A path traversal vulnerability existed in the handling of MISP object template names during STIX 2 import and MISP-to-STIX 2 export.
MISP object names are pas… |
CVE-2026-77710 | | | 2026-08-21 | A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata during import.
The STIX import logic… |
CVE-2026-73162 | | | 2026-08-11 | Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests:
*
/account/follow
*
/account/delete_noti… |
CVE-2026-73161 | | | 2026-08-11 | Affected versions of cti-transmute improperly handle conversion-table values passed through the search highlighting feature. The highlight() function previousl… |
CVE-2026-73160 | | | 2026-08-11 | Affected versions of cti-transmute contain an SSRF vulnerability in the /fetch_misp_event and /misp_search_events endpoints.
The URL validation routine check… |
CVE-2026-73159 | | | 2026-08-11 | Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into HTML through Vue's v-html. The helper mapIcon() previously… |
CVE-2026-73158 | | | 2026-08-11 | Affected versions of cti-transmute insufficiently validate saved graph configuration data. Graph configurations can contain style properties that are later con… |
CVE-2026-73157 | | | 2026-08-11 | Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields s… |
CVE-2026-73156 | | | 2026-08-11 | Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names may orig… |
CVE-2026-73155 | | | 2026-08-11 | Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether those users are author… |
CVE-2026-73140 | | | 2026-08-11 | Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normal comment retrieva… |
CVE-2026-72760 | | | 2026-08-10 | Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another… |
CVE-2026-72759 | | | 2026-08-10 | In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record reference… |
CVE-2026-72751 | | | 2026-08-10 | CTI-Transmute is affected by a stored cross-site scripting (XSS) vulnerability in the conversion graph used to visualise converted MISP and STIX content.
Atta… |
CVE-2026-71502 | | | 2026-08-08 | CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-render… |
CVE-2026-69082 | | | 2026-08-03 | CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/<id> endpoint accepte… |
CVE-2026-69079 | | | 2026-08-03 | CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activity_timeline endpoint. The endpoint accepts a user-contr… |
CVE-2026-69078 | | | 2026-08-03 | CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality.
User-controlled CTI content, i… |
CVE-2026-67178 | | | 2026-07-28 | MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect:
Redirect permanent /… |
CVE-2026-62143 | | | 2026-07-13 | A Server-Side Request Forgery (SSRF) protection bypass existed in the html_to_markdown expansion module of misp-modules.
The module attempts to prevent reques… |
CVE-2026-61474 | | | 2026-07-09 | An improper authorization check in MISP’s attribute creation endpoint allowed an authenticated user with permission to add attributes to submit a sharing_group… |
CVE-2026-60125 | | | 2026-07-08 | MISP’s importModule() path used getEnabledModule() to resolve a single import module by name, but this lookup did not enforce the per-organisation module restr… |
CVE-2026-60124 | | | 2026-07-08 | An authorization bypass in MISP’s EventsController::importModule() allowed authenticated users or read-only API keys with event view access to persist data to… |
CVE-2026-56447 | High | 7.2 | 2026-06-22 | MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config setting to an arbitrary filesystem path. MISP subsequently parsed the referenc… |