Misp Cti-Transmute
17 CVEs affecting Misp Cti-Transmute. Latest disclosed: 2026-08-11. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-73162 | | 2026-08-11 | Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: * /account/follow * /account/delete_noti… | |
CVE-2026-73161 | | 2026-08-11 | Affected versions of cti-transmute improperly handle conversion-table values passed through the search highlighting feature. The highlight() function previousl… | |
CVE-2026-73160 | | 2026-08-11 | Affected versions of cti-transmute contain an SSRF vulnerability in the /fetch_misp_event and /misp_search_events endpoints. The URL validation routine check… | |
CVE-2026-73159 | | 2026-08-11 | Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into HTML through Vue's v-html. The helper mapIcon() previously… | |
CVE-2026-73158 | | 2026-08-11 | Affected versions of cti-transmute insufficiently validate saved graph configuration data. Graph configurations can contain style properties that are later con… | |
CVE-2026-73157 | | 2026-08-11 | Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields s… | |
CVE-2026-73156 | | 2026-08-11 | Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names may orig… | |
CVE-2026-73155 | | 2026-08-11 | Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether those users are author… | |
CVE-2026-73140 | | 2026-08-11 | Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normal comment retrieva… | |
CVE-2026-72760 | | 2026-08-10 | Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another… | |
CVE-2026-72759 | | 2026-08-10 | In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record reference… | |
CVE-2026-72751 | | 2026-08-10 | CTI-Transmute is affected by a stored cross-site scripting (XSS) vulnerability in the conversion graph used to visualise converted MISP and STIX content. Atta… | |
CVE-2026-71502 | | 2026-08-08 | CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-render… | |
CVE-2026-69082 | | 2026-08-03 | CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/<id> endpoint accepte… | |
CVE-2026-69079 | | 2026-08-03 | CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activity_timeline endpoint. The endpoint accepts a user-contr… | |
CVE-2026-69078 | | 2026-08-03 | CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality. User-controlled CTI content, i… | |
CVE-2026-9806 | | 2026-05-28 | A stored cross-site scripting (XSS) vulnerability exists in the notification panel of CTI Transmute in versions prior to the patched release. Notification mess… |