CVE-2026-56447 | High | 7.2 | 2026-06-22 | MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config setting to an arbitrary filesystem path. MISP subsequently parsed the referenc… |
CVE-2026-56446 | High | 7.2 | 2026-06-22 | MISP allowed a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool. Because log entries can include attac… |
CVE-2026-56425 | High | 8.8 | 2026-06-22 | The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its OAuth 2.0 authorization flow that could allow attackers to… |
CVE-2026-56424 | High | 8.8 | 2026-06-22 | MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong entity, or where ownership/editability che… |
CVE-2026-56423 | High | 8.8 | 2026-06-22 | MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The affected deleteSelection handlers authori… |
CVE-2026-10864 | Medium | 4.3 | 2026-06-04 | A vulnerability in the MISP dashboard widgets allowed an authenticated user to manipulate the fields option and influence which fields were returned by the New… |
CVE-2026-10863 | High | 8.1 | 2026-06-04 | A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parame… |
CVE-2026-10860 | Medium | 6.5 | 2026-06-04 | A logic error in the MISP CRUD component delete handler allowed validation failures to be bypassed when requests used the HTTP DELETE method. Due to missing pa… |
CVE-2026-10861 | Medium | 6.1 | 2026-06-04 | An open redirect vulnerability existed in MISP UsersController::routeafterlogin() because the value stored in the pre_login_requested_url session key was used… |
CVE-2026-10856 | Medium | 6.1 | 2026-06-04 | A URL validation flaw in the MISP dashboard button widget allowed a crafted relative-looking URL to be accepted as a local path while being interpreted by brow… |
CVE-2026-10855 | Medium | 4.3 | 2026-06-04 | An authorization flaw existed in the MISP Event Template Importer overwrite workflow. When importing an event template in overwrite mode, the application check… |
CVE-2026-10854 | Medium | 4.3 | 2026-06-04 | A visibility control issue in the event template creation workflow allowed non-site-admin users to access private galaxies belonging to other organisations. Th… |
CVE-2026-10611 | Critical | 10.0 | 2026-06-02 | An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement. In deployments configured with LdapAuth.m… |
CVE-2026-9137 | High | 7.5 | 2026-05-20 | The CSP report endpoint in MISP intended to limit logged CSP reports to 1 KB but incorrectly allowed reports up to 1 MB before truncation. On deployments where… |
CVE-2026-9136 | Medium | 6.5 | 2026-05-20 | A vulnerability was identified in the ShadowAttribute proposal creation workflow. The add action accepted user-controlled ShadowAttribute request data without… |
CVE-2026-44381 | Medium | 5.3 | 2026-05-13 | MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, a SQL injection vulnerability existed in the handling of user-controlled orde… |
CVE-2026-44380 | High | 7.2 | 2026-05-13 | MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, an improper access control vulnerability in the authentication key reset func… |
CVE-2026-44379 | Medium | 5.3 | 2026-05-13 | MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, MISP Collections did not enforce RFC 4122 UUID validation on the uuid field… |
CVE-2026-8080 | Medium | 5.4 | 2026-05-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in misp allows Stored XSS.
This issue affects M… |
CVE-2026-39962 | Critical | 9.6 | 2026-04-09 | MISP is an open source threat intelligence and sharing platform. Prior to 2.5.36, improper neutralization of special elements in an LDAP query in ApacheAuthent… |
CVE-2025-67906 | Medium | 5.4 | 2025-12-15 | In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path. |
CVE-2024-58130 | High | 7.2 | 2025-03-28 | In app/Controller/Component/RestResponseComponent.php in MISP before 2.4.193, REST endpoints have a lack of sanitization for non-JSON responses. |
CVE-2024-58129 | Medium | 5.5 | 2025-03-28 | In MISP before 2.4.193, menu_custom_right_link_html parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can… |
CVE-2024-58128 | Medium | 5.5 | 2025-03-28 | In MISP before 2.4.193, menu_custom_right_link parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can cond… |
CVE-2024-57969 | Medium | 4.3 | 2025-02-14 | app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search. |
CVE-2024-46918 | Medium | 4.9 | 2024-09-15 | app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in… |
CVE-2024-45509 | Medium | 6.5 | 2024-09-01 | In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org ad… |
CVE-2024-29859 | Critical | 9.8 | 2024-03-21 | In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload. |
CVE-2024-29858 | Critical | 9.8 | 2024-03-21 | In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload. |
CVE-2024-25675 | Critical | 9.8 | 2024-02-09 | An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to app/Controller/Job… |
CVE-2024-25674 | Critical | 9.8 | 2024-02-09 | An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and MIME type. |
CVE-2023-50918 | Critical | 9.8 | 2023-12-15 | app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs. |
CVE-2023-49926 | Medium | 6.1 | 2023-12-03 | app/Lib/Tools/EventTimelineTool.php in MISP before 2.4.179 allows XSS in the event timeline widget. |
CVE-2023-48659 | Critical | 9.8 | 2023-11-17 | An issue was discovered in MISP before 2.4.176. app/Controller/AppController.php mishandles parameter parsing. |
CVE-2023-48658 | Critical | 9.8 | 2023-11-17 | An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php lacks a checkParam function for alphanumerics, underscore, dash, period, and space. |
CVE-2023-48657 | Critical | 9.8 | 2023-11-17 | An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles filters. |
CVE-2023-48656 | Critical | 9.8 | 2023-11-17 | An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles order clauses. |
CVE-2023-48655 | Critical | 9.8 | 2023-11-17 | An issue was discovered in MISP before 2.4.176. app/Controller/Component/IndexFilterComponent.php does not properly filter out query parameters. |
CVE-2023-41098 | Medium | 6.1 | 2023-08-23 | An issue was discovered in MISP 2.4.174. In app/Controller/DashboardsController.php, a reflected XSS issue exists via the id parameter upon a dashboard edit. |
CVE-2023-40224 | Medium | 6.1 | 2023-08-10 | MISP 2.4.174 allows XSS in app/View/Events/index.ctp. |
CVE-2023-37307 | Medium | 5.4 | 2023-06-30 | In MISP before 2.4.172, title_for_layout is not properly sanitized in Correlations, CorrelationExclusions, and Layouts. |
CVE-2023-37306 | High | 7.5 | 2023-06-30 | MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error m… |
CVE-2023-28884 | Medium | 6.1 | 2023-03-27 | In MISP 2.4.169, app/Lib/Tools/CustomPaginationTool.php allows XSS in the community index. |
CVE-2023-28607 | Medium | 6.1 | 2023-03-18 | js/event-graph.js in MISP before 2.4.169 allows XSS via the event-graph relationship tooltip. |
CVE-2023-28606 | Medium | 6.1 | 2023-03-18 | js/event-graph.js in MISP before 2.4.169 allows XSS via event-graph node tooltips. |
CVE-2022-48329 | Critical | 9.8 | 2023-02-20 | MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php… |
CVE-2022-48328 | Critical | 9.8 | 2023-02-20 | app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters. |
CVE-2023-24070 | Medium | 6.1 | 2023-01-23 | app/View/AuthKeys/authkey_display.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field. |
CVE-2023-24028 | Critical | 9.8 | 2023-01-20 | In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function. |
CVE-2023-24027 | Medium | 6.1 | 2023-01-20 | In MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name. |
CVE-2023-24026 | Medium | 6.1 | 2023-01-20 | In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload. |
CVE-2022-47928 | Medium | 6.1 | 2022-12-22 | In MISP before 2.4.167, there is XSS in the template file uploads in app/View/Templates/upload_file.ctp. |
CVE-2022-42724 | Medium | 4.3 | 2022-10-10 | app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names (this is information that only the site admin should have). |
CVE-2022-29534 | High | 7.5 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vectors involving an "Accept: application/jso… |
CVE-2022-29533 | Medium | 6.1 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. There is XSS in app/Controller/OrganisationsController.php in a situation with a "weird single checkbox page." |
CVE-2022-29532 | Medium | 4.8 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. There is XSS in the cerebrate view if one administrator puts a javascript: URL in the URL field, and another ad… |
CVE-2022-29531 | Medium | 5.4 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. There is stored XSS in the event graph via a tag name. |
CVE-2022-29530 | Medium | 5.4 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. There is stored XSS in the galaxy clusters. |
CVE-2022-29529 | Medium | 5.4 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. There is stored XSS via the LinOTP login field. |
CVE-2022-29528 | Critical | 9.8 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. PHAR deserialization can occur. |
CVE-2022-27246 | Medium | 6.1 | 2022-03-18 | An issue was discovered in MISP before 2.4.156. An SVG org logo (which may contain JavaScript) is not forbidden by default. |
CVE-2022-27245 | High | 8.8 | 2022-03-18 | An issue was discovered in MISP before 2.4.156. app/Model/Server.php does not restrict generateServerSettings to the CLI. This could lead to SSRF. |
CVE-2022-27244 | Medium | 4.8 | 2022-03-18 | An issue was discovered in MISP before 2.4.156. A malicious site administrator could store an XSS payload in the custom auth name. This would be executed each… |
CVE-2022-27243 | High | 7.8 | 2022-03-18 | An issue was discovered in MISP before 2.4.156. app/View/Users/terms.ctp allows Local File Inclusion via the custom terms file setting. |
CVE-2021-41326 | Critical | 9.8 | 2021-09-17 | In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call. |
CVE-2021-39302 | Critical | 9.8 | 2021-08-19 | MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions['org'] value. |
CVE-2021-37743 | Medium | 5.4 | 2021-07-30 | app/View/GalaxyElements/ajax/index.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster elements in JSON format. |
CVE-2021-37742 | Medium | 5.4 | 2021-07-30 | app/View/Elements/GalaxyClusters/view_relation_tree.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster relationships. |
CVE-2021-37534 | Medium | 5.4 | 2021-07-26 | app/View/GalaxyClusters/add.ctp in MISP 2.4.146 allows Stored XSS when forking a galaxy cluster. |
CVE-2021-36212 | Medium | 6.1 | 2021-07-07 | app/View/SharingGroups/view.ctp in MISP before 2.4.146 allows stored XSS in the sharing groups view. |
CVE-2021-35502 | Critical | 9.8 | 2021-06-25 | app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data related to generic-template:index. |
CVE-2021-31780 | High | 7.5 | 2021-04-23 | In app/Model/MispObject.php in MISP 2.4.141, an incorrect sharing group association could lead to information disclosure on an event edit. When an object has a… |
CVE-2021-27904 | Medium | 5.5 | 2021-03-02 | An issue was discovered in app/Model/SharingGroupServer.php in MISP 2.4.139. In the implementation of Sharing Groups, the "all org" flag sometimes provided vie… |
CVE-2020-24085 | Medium | 6.1 | 2021-01-26 | A cross-site scripting (XSS) vulnerability exists in MISP v2.4.128 in app/Controller/UserSettingsController.php at SetHomePage() function. Due to a lack of con… |
CVE-2021-3184 | Medium | 6.1 | 2021-01-19 | MISP 2.4.136 has XSS via a crafted URL to the app/View/Elements/global_menu.ctp user homepage favourite button. |
CVE-2021-25325 | Medium | 6.1 | 2021-01-19 | MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs. |
CVE-2021-25324 | Medium | 6.1 | 2021-01-19 | MISP 2.4.136 has Stored XSS in the galaxy cluster view via a cluster name to app/View/GalaxyClusters/view.ctp. |
CVE-2021-25323 | Critical | 9.1 | 2021-01-19 | The default setting of MISP 2.4.136 did not enable the requirements (aka require_password_confirmation) to provide the previous password when changing a passwo… |
CVE-2020-29572 | Medium | 6.1 | 2020-12-06 | app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field. |
CVE-2020-29006 | Critical | 9.8 | 2020-11-24 | MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyElement.php. |
CVE-2020-28947 | Medium | 6.1 | 2020-11-19 | In MISP 2.4.134, XSS exists in the template element index view because the id parameter is mishandled. |
CVE-2020-28043 | High | 7.5 | 2020-11-02 | MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL. |
CVE-2020-25766 | High | 7.5 | 2020-09-18 | An issue was discovered in MISP before 2.4.132. It can perform an unwanted action because of a POST operation on a form that is not linked to the login page. |
CVE-2020-15711 | High | 8.8 | 2020-07-14 | In MISP before 2.4.129, setting a favourite homepage was not CSRF protected. |
CVE-2020-15412 | Medium | 4.3 | 2020-06-30 | An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contac… |
CVE-2020-15411 | Critical | 9.8 | 2020-06-30 | An issue was discovered in MISP 2.4.128. app/Controller/AttributesController.php has insufficient ACL checks in the attachment downloader. |
CVE-2020-14969 | High | 7.5 | 2020-06-22 | app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations. This occurs when querying the attribute restsearch API, revealing metada… |
CVE-2020-13153 | Medium | 6.1 | 2020-05-18 | app/View/Events/resolved_attributes.ctp in MISP before 2.4.126 has XSS in the resolved attributes view. |
CVE-2020-11458 | Medium | 4.9 | 2020-04-02 | app/Model/feed.php in MISP before 2.4.124 allows administrators to choose arbitrary files that should be ingested by MISP. This does not cause a leak of the fu… |
CVE-2020-10247 | Medium | 6.1 | 2020-03-09 | MISP 2.4.122 has Persistent XSS in the sighting popover tool. This is related to app/View/Elements/Events/View/sighting_field.ctp. |
CVE-2020-10246 | Medium | 6.1 | 2020-03-09 | MISP 2.4.122 has reflected XSS via unsanitized URL parameters. This is related to app/View/Users/statistics_orgs.ctp. |
CVE-2020-8894 | Medium | 6.5 | 2020-02-12 | An issue was discovered in MISP before 2.4.121. ACLs for discussion threads were mishandled in app/Controller/ThreadsController.php and app/Model/Thread.php. |
CVE-2020-8893 | High | 7.5 | 2020-02-12 | An issue was discovered in MISP before 2.4.121. The Galaxy view contained an incorrectly sanitized search string in app/View/Galaxies/view.ctp. |
CVE-2020-8892 | High | 8.1 | 2020-02-12 | An issue was discovered in MISP before 2.4.121. It did not consider the HTTP PUT method when trying to block a brute-force series of invalid requests. |
CVE-2020-8891 | Medium | 5.9 | 2020-02-12 | An issue was discovered in MISP before 2.4.121. It did not canonicalize usernames when trying to block a brute-force series of invalid requests. |
CVE-2020-8890 | Medium | 5.9 | 2020-02-12 | An issue was discovered in MISP before 2.4.121. It mishandled time skew (between the machine hosting the web server and the machine hosting the database) when… |
CVE-2019-19379 | Medium | 5.3 | 2019-11-28 | In app/Controller/TagsController.php in MISP 2.4.118, users can bypass intended restrictions on tagging data. |
CVE-2019-16202 | Medium | 6.5 | 2019-09-10 | MISP before 2.4.115 allows privilege escalation in certain situations. After updating to 2.4.115, escalation attempts are blocked by the __checkLoggedActions f… |
CVE-2019-14286 | Medium | 6.1 | 2019-07-27 | In app/webroot/js/event-graph.js in MISP 2.4.111, a stored XSS vulnerability exists in the event-graph view when a user toggles the event graph view. A malicio… |
CVE-2019-12868 | High | 7.2 | 2019-06-18 | app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP file_exists function is used with user-controlled… |