CVE-2026-86452 | High | 7.5 | 2026-09-07 | Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting… |
CVE-2026-86451 | Medium | 4.3 | 2026-09-07 | Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::get_reference_data() without first che… |
CVE-2026-86441 | Medium | 4.3 | 2026-09-07 | Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information.
Several organisation-rela… |
CVE-2026-86440 | Medium | 5.4 | 2026-09-07 | Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget.
The widget's URL is stored configuration co… |
CVE-2026-86419 | Critical | 9.1 | 2026-09-07 | Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality.
In f… |
CVE-2026-86418 | Medium | 4.3 | 2026-09-07 | Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by… |
CVE-2026-86417 | Medium | 4.3 | 2026-09-07 | Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates().
The query always fetched User.email, whi… |
CVE-2026-86408 | Medium | 6.5 | 2026-09-07 | Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view().
The vulnerable… |
CVE-2026-86351 | Medium | 6.1 | 2026-09-07 | Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because… |
CVE-2026-86347 | Medium | 6.5 | 2026-09-07 | Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile() because the ACL entry for templates/uploadFile used the wild… |
CVE-2026-86342 | Medium | 4.3 | 2026-09-07 | Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview performed correlation lookups against a… |
CVE-2026-85239 | Medium | 6.5 | 2026-09-03 | A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the… |
CVE-2026-85238 | Medium | 6.8 | 2026-09-03 | MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow. When a user was successfully authenticated throu… |
CVE-2026-85237 | High | 8.1 | 2026-09-03 | A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perform an unrestricted number of OTP verification att… |
CVE-2026-85236 | High | 8.8 | 2026-09-03 | A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible opera… |
CVE-2026-85230 | Medium | 5.4 | 2026-09-03 | A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the wid… |
CVE-2026-85227 | Medium | 6.1 | 2026-09-03 | MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttri… |
CVE-2026-85226 | Medium | 4.3 | 2026-09-03 | MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applyin… |
CVE-2026-85221 | Critical | 9.1 | 2026-09-03 | MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and there… |
CVE-2026-85216 | Critical | 9.8 | 2026-09-03 | MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentia… |
CVE-2026-56447 | High | 7.2 | 2026-06-22 | MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config setting to an arbitrary filesystem path. MISP subsequently parsed the referenc… |
CVE-2026-56446 | High | 7.2 | 2026-06-22 | MISP allowed a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool. Because log entries can include attac… |
CVE-2026-56425 | High | 8.8 | 2026-06-22 | The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its OAuth 2.0 authorization flow that could allow attackers to… |
CVE-2026-56424 | High | 8.8 | 2026-06-22 | MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong entity, or where ownership/editability che… |
CVE-2026-56423 | High | 8.8 | 2026-06-22 | MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The affected deleteSelection handlers authori… |
CVE-2026-10864 | Medium | 4.3 | 2026-06-04 | A vulnerability in the MISP dashboard widgets allowed an authenticated user to manipulate the fields option and influence which fields were returned by the New… |
CVE-2026-10863 | High | 8.1 | 2026-06-04 | A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parame… |
CVE-2026-10860 | Medium | 6.5 | 2026-06-04 | A logic error in the MISP CRUD component delete handler allowed validation failures to be bypassed when requests used the HTTP DELETE method. Due to missing pa… |
CVE-2026-10861 | Medium | 6.1 | 2026-06-04 | An open redirect vulnerability existed in MISP UsersController::routeafterlogin() because the value stored in the pre_login_requested_url session key was used… |
CVE-2026-10856 | Medium | 6.1 | 2026-06-04 | A URL validation flaw in the MISP dashboard button widget allowed a crafted relative-looking URL to be accepted as a local path while being interpreted by brow… |
CVE-2026-10855 | Medium | 4.3 | 2026-06-04 | An authorization flaw existed in the MISP Event Template Importer overwrite workflow. When importing an event template in overwrite mode, the application check… |
CVE-2026-10854 | Medium | 4.3 | 2026-06-04 | A visibility control issue in the event template creation workflow allowed non-site-admin users to access private galaxies belonging to other organisations. Th… |
CVE-2026-10611 | Critical | 10.0 | 2026-06-02 | An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement. In deployments configured with LdapAuth.m… |
CVE-2026-9137 | High | 7.5 | 2026-05-20 | The CSP report endpoint in MISP intended to limit logged CSP reports to 1 KB but incorrectly allowed reports up to 1 MB before truncation. On deployments where… |
CVE-2026-9136 | Medium | 6.5 | 2026-05-20 | A vulnerability was identified in the ShadowAttribute proposal creation workflow. The add action accepted user-controlled ShadowAttribute request data without… |
CVE-2026-44381 | Medium | 5.3 | 2026-05-13 | MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, a SQL injection vulnerability existed in the handling of user-controlled orde… |
CVE-2026-44380 | High | 7.2 | 2026-05-13 | MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, an improper access control vulnerability in the authentication key reset func… |
CVE-2026-44379 | Medium | 5.3 | 2026-05-13 | MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, MISP Collections did not enforce RFC 4122 UUID validation on the uuid field… |
CVE-2026-8080 | Medium | 5.4 | 2026-05-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in misp allows Stored XSS.
This issue affects M… |
CVE-2026-39962 | Critical | 9.6 | 2026-04-09 | MISP is an open source threat intelligence and sharing platform. Prior to 2.5.36, improper neutralization of special elements in an LDAP query in ApacheAuthent… |
CVE-2025-67906 | Medium | 5.4 | 2025-12-15 | In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path. |
CVE-2024-58130 | High | 7.2 | 2025-03-28 | In app/Controller/Component/RestResponseComponent.php in MISP before 2.4.193, REST endpoints have a lack of sanitization for non-JSON responses. |
CVE-2024-58129 | Medium | 5.5 | 2025-03-28 | In MISP before 2.4.193, menu_custom_right_link_html parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can… |
CVE-2024-58128 | Medium | 5.5 | 2025-03-28 | In MISP before 2.4.193, menu_custom_right_link parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can cond… |
CVE-2024-57969 | Medium | 4.3 | 2025-02-14 | app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search. |
CVE-2024-46918 | Medium | 4.9 | 2024-09-15 | app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in… |
CVE-2024-45509 | Medium | 6.5 | 2024-09-01 | In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org ad… |
CVE-2024-29859 | Critical | 9.8 | 2024-03-21 | In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload. |
CVE-2024-29858 | Critical | 9.8 | 2024-03-21 | In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload. |
CVE-2024-25675 | Critical | 9.8 | 2024-02-09 | An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to app/Controller/Job… |
CVE-2024-25674 | Critical | 9.8 | 2024-02-09 | An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and MIME type. |
CVE-2023-50918 | Critical | 9.8 | 2023-12-15 | app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs. |
CVE-2023-49926 | Medium | 6.1 | 2023-12-03 | app/Lib/Tools/EventTimelineTool.php in MISP before 2.4.179 allows XSS in the event timeline widget. |
CVE-2023-48659 | Critical | 9.8 | 2023-11-17 | An issue was discovered in MISP before 2.4.176. app/Controller/AppController.php mishandles parameter parsing. |
CVE-2023-48658 | Critical | 9.8 | 2023-11-17 | An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php lacks a checkParam function for alphanumerics, underscore, dash, period, and space. |
CVE-2023-48657 | Critical | 9.8 | 2023-11-17 | An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles filters. |
CVE-2023-48656 | Critical | 9.8 | 2023-11-17 | An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles order clauses. |
CVE-2023-48655 | Critical | 9.8 | 2023-11-17 | An issue was discovered in MISP before 2.4.176. app/Controller/Component/IndexFilterComponent.php does not properly filter out query parameters. |
CVE-2023-41098 | Medium | 6.1 | 2023-08-23 | An issue was discovered in MISP 2.4.174. In app/Controller/DashboardsController.php, a reflected XSS issue exists via the id parameter upon a dashboard edit. |
CVE-2023-40224 | Medium | 6.1 | 2023-08-10 | MISP 2.4.174 allows XSS in app/View/Events/index.ctp. |
CVE-2023-37307 | Medium | 5.4 | 2023-06-30 | In MISP before 2.4.172, title_for_layout is not properly sanitized in Correlations, CorrelationExclusions, and Layouts. |
CVE-2023-37306 | High | 7.5 | 2023-06-30 | MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error m… |
CVE-2023-28884 | Medium | 6.1 | 2023-03-27 | In MISP 2.4.169, app/Lib/Tools/CustomPaginationTool.php allows XSS in the community index. |
CVE-2023-28607 | Medium | 6.1 | 2023-03-18 | js/event-graph.js in MISP before 2.4.169 allows XSS via the event-graph relationship tooltip. |
CVE-2023-28606 | Medium | 6.1 | 2023-03-18 | js/event-graph.js in MISP before 2.4.169 allows XSS via event-graph node tooltips. |
CVE-2022-48329 | Critical | 9.8 | 2023-02-20 | MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php… |
CVE-2022-48328 | Critical | 9.8 | 2023-02-20 | app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters. |
CVE-2023-24070 | Medium | 6.1 | 2023-01-23 | app/View/AuthKeys/authkey_display.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field. |
CVE-2023-24028 | Critical | 9.8 | 2023-01-20 | In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function. |
CVE-2023-24027 | Medium | 6.1 | 2023-01-20 | In MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name. |
CVE-2023-24026 | Medium | 6.1 | 2023-01-20 | In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload. |
CVE-2022-47928 | Medium | 6.1 | 2022-12-22 | In MISP before 2.4.167, there is XSS in the template file uploads in app/View/Templates/upload_file.ctp. |
CVE-2022-42724 | Medium | 4.3 | 2022-10-10 | app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names (this is information that only the site admin should have). |
CVE-2022-29534 | High | 7.5 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vectors involving an "Accept: application/jso… |
CVE-2022-29533 | Medium | 6.1 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. There is XSS in app/Controller/OrganisationsController.php in a situation with a "weird single checkbox page." |
CVE-2022-29532 | Medium | 4.8 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. There is XSS in the cerebrate view if one administrator puts a javascript: URL in the URL field, and another ad… |
CVE-2022-29531 | Medium | 5.4 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. There is stored XSS in the event graph via a tag name. |
CVE-2022-29530 | Medium | 5.4 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. There is stored XSS in the galaxy clusters. |
CVE-2022-29529 | Medium | 5.4 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. There is stored XSS via the LinOTP login field. |
CVE-2022-29528 | Critical | 9.8 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. PHAR deserialization can occur. |
CVE-2022-27246 | Medium | 6.1 | 2022-03-18 | An issue was discovered in MISP before 2.4.156. An SVG org logo (which may contain JavaScript) is not forbidden by default. |
CVE-2022-27245 | High | 8.8 | 2022-03-18 | An issue was discovered in MISP before 2.4.156. app/Model/Server.php does not restrict generateServerSettings to the CLI. This could lead to SSRF. |
CVE-2022-27244 | Medium | 4.8 | 2022-03-18 | An issue was discovered in MISP before 2.4.156. A malicious site administrator could store an XSS payload in the custom auth name. This would be executed each… |
CVE-2022-27243 | High | 7.8 | 2022-03-18 | An issue was discovered in MISP before 2.4.156. app/View/Users/terms.ctp allows Local File Inclusion via the custom terms file setting. |
CVE-2021-41326 | Critical | 9.8 | 2021-09-17 | In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call. |
CVE-2021-39302 | Critical | 9.8 | 2021-08-19 | MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions['org'] value. |
CVE-2021-37743 | Medium | 5.4 | 2021-07-30 | app/View/GalaxyElements/ajax/index.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster elements in JSON format. |
CVE-2021-37742 | Medium | 5.4 | 2021-07-30 | app/View/Elements/GalaxyClusters/view_relation_tree.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster relationships. |
CVE-2021-37534 | Medium | 5.4 | 2021-07-26 | app/View/GalaxyClusters/add.ctp in MISP 2.4.146 allows Stored XSS when forking a galaxy cluster. |
CVE-2021-36212 | Medium | 6.1 | 2021-07-07 | app/View/SharingGroups/view.ctp in MISP before 2.4.146 allows stored XSS in the sharing groups view. |
CVE-2021-35502 | Critical | 9.8 | 2021-06-25 | app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data related to generic-template:index. |
CVE-2021-31780 | High | 7.5 | 2021-04-23 | In app/Model/MispObject.php in MISP 2.4.141, an incorrect sharing group association could lead to information disclosure on an event edit. When an object has a… |
CVE-2021-27904 | Medium | 5.5 | 2021-03-02 | An issue was discovered in app/Model/SharingGroupServer.php in MISP 2.4.139. In the implementation of Sharing Groups, the "all org" flag sometimes provided vie… |
CVE-2020-24085 | Medium | 6.1 | 2021-01-26 | A cross-site scripting (XSS) vulnerability exists in MISP v2.4.128 in app/Controller/UserSettingsController.php at SetHomePage() function. Due to a lack of con… |
CVE-2021-3184 | Medium | 6.1 | 2021-01-19 | MISP 2.4.136 has XSS via a crafted URL to the app/View/Elements/global_menu.ctp user homepage favourite button. |
CVE-2021-25325 | Medium | 6.1 | 2021-01-19 | MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs. |
CVE-2021-25324 | Medium | 6.1 | 2021-01-19 | MISP 2.4.136 has Stored XSS in the galaxy cluster view via a cluster name to app/View/GalaxyClusters/view.ctp. |
CVE-2021-25323 | Critical | 9.1 | 2021-01-19 | The default setting of MISP 2.4.136 did not enable the requirements (aka require_password_confirmation) to provide the previous password when changing a passwo… |
CVE-2020-29572 | Medium | 6.1 | 2020-12-06 | app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field. |
CVE-2020-29006 | Critical | 9.8 | 2020-11-24 | MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyElement.php. |