Misp
Page 2 of 3 — Misp CVEs from a corpus of 218, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-56446 | High | 7.2 | 2026-06-22 | MISP allowed a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool. Because log entries can include attac… |
CVE-2026-56425 | High | 8.8 | 2026-06-22 | The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its OAuth 2.0 authorization flow that could allow attackers to… |
CVE-2026-56424 | High | 8.8 | 2026-06-22 | MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong entity, or where ownership/editability che… |
CVE-2026-56423 | High | 8.8 | 2026-06-22 | MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The affected deleteSelection handlers authori… |
CVE-2026-56422 | | 2026-06-22 | Multiple MISP core controllers and model capture paths accepted client-controlled request fields such as primary keys (id) and ownership/scope foreign keys (ev… | |
CVE-2026-54398 | | 2026-06-12 | An authorization flaw in MISP’s object add/edit handling allowed an authenticated user with object editing permissions to assign a MISP object, or attributes c… | |
CVE-2026-54397 | | 2026-06-12 | A vulnerability in MISP’s non-REST event editing path allowed an authenticated user with event edit permissions to manipulate the submitted form data and set a… | |
CVE-2026-54396 | | 2026-06-12 | An information disclosure vulnerability exists in the MISP AuthKey edit functionality. When a validation error occurs during an AuthKey edit request, the user… | |
CVE-2026-54395 | | 2026-06-12 | MISP contains a reflected cross-site scripting vulnerability in the UiBeta event index view. The urlparams value is inserted into an inline JavaScript handler… | |
CVE-2026-54394 | | 2026-06-12 | MISP contains a path traversal vulnerability in OrganisationsController::getOrgLogo. The vulnerable code builds organisation logo file paths using organisation… | |
CVE-2026-54393 | | 2026-06-12 | A stored cross-site scripting vulnerability exists in MISP when the Overmind theme is used. The setHomePage endpoint previously saved the user-controlled path… | |
CVE-2026-54362 | | 2026-06-12 | An incorrect visibility condition in the MISP event template builder allowed authenticated non-site-admin users to view galaxies that should not have been visi… | |
CVE-2026-54361 | | 2026-06-12 | MISP contained multiple mass assignment vulnerabilities in the handling of collections, tag collections, event delegations, and shadow attributes. Several cont… | |
CVE-2026-54360 | | 2026-06-12 | A mass assignment vulnerability exists in MISP’s sharing group creation endpoint. When creating a new sharing group, the controller did not remove a user-suppl… | |
CVE-2026-54359 | | 2026-06-12 | MISP contains an insecure default configuration in which the Security.check_sec_fetch_site_header control is disabled. When this setting is disabled, state-cha… | |
CVE-2026-54358 | | 2026-06-12 | An incorrect authorization vulnerability in MISP allows an organization administrator to target site administrator accounts belonging to the same organization… | |
CVE-2026-54357 | | 2026-06-12 | An improper authorization vulnerability in MISP allowed an authenticated organization administrator to access or modify user settings belonging to site adminis… | |
CVE-2026-53693 | | 2026-06-10 | A stored cross-site scripting vulnerability existed in MISP BSimVis tag rendering code. Several client-side rendering paths interpolated tag names, collection… | |
CVE-2026-10868 | | 2026-06-04 | A mass assignment vulnerability exists in the MISP user edit functionality due to insufficient filtering of user-supplied fields in UsersController::edit(). Wh… | |
CVE-2026-10864 | Medium | 4.3 | 2026-06-04 | A vulnerability in the MISP dashboard widgets allowed an authenticated user to manipulate the fields option and influence which fields were returned by the New… |
CVE-2026-10863 | High | 8.1 | 2026-06-04 | A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parame… |
CVE-2026-10860 | Medium | 6.5 | 2026-06-04 | A logic error in the MISP CRUD component delete handler allowed validation failures to be bypassed when requests used the HTTP DELETE method. Due to missing pa… |
CVE-2026-10861 | Medium | 6.1 | 2026-06-04 | An open redirect vulnerability existed in MISP UsersController::routeafterlogin() because the value stored in the pre_login_requested_url session key was used… |
CVE-2026-10856 | Medium | 6.1 | 2026-06-04 | A URL validation flaw in the MISP dashboard button widget allowed a crafted relative-looking URL to be accepted as a local path while being interpreted by brow… |
CVE-2026-10855 | Medium | 4.3 | 2026-06-04 | An authorization flaw existed in the MISP Event Template Importer overwrite workflow. When importing an event template in overwrite mode, the application check… |
CVE-2026-10854 | Medium | 4.3 | 2026-06-04 | A visibility control issue in the event template creation workflow allowed non-site-admin users to access private galaxies belonging to other organisations. Th… |
CVE-2026-10611 | Critical | 10.0 | 2026-06-02 | An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement. In deployments configured with LdapAuth.m… |
CVE-2026-9806 | | 2026-05-28 | A stored cross-site scripting (XSS) vulnerability exists in the notification panel of CTI Transmute in versions prior to the patched release. Notification mess… | |
CVE-2026-9137 | High | 7.5 | 2026-05-20 | The CSP report endpoint in MISP intended to limit logged CSP reports to 1 KB but incorrectly allowed reports up to 1 MB before truncation. On deployments where… |
CVE-2026-9136 | Medium | 6.5 | 2026-05-20 | A vulnerability was identified in the ShadowAttribute proposal creation workflow. The add action accepted user-controlled ShadowAttribute request data without… |
CVE-2026-9084 | | 2026-05-20 | MISP’s OIDC authentication plugin allowed automatic linking of an OIDC identity to an existing local user account based on the email claim when the local accou… | |
CVE-2026-44381 | Medium | 5.3 | 2026-05-13 | MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, a SQL injection vulnerability existed in the handling of user-controlled orde… |
CVE-2026-44380 | High | 7.2 | 2026-05-13 | MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, an improper access control vulnerability in the authentication key reset func… |
CVE-2026-44379 | Medium | 5.3 | 2026-05-13 | MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, MISP Collections did not enforce RFC 4122 UUID validation on the uuid field… |
CVE-2026-44364 | | 2026-05-13 | MISP modules are autonomous modules that can be used to extend MISP for new services. In 3.0.7 and earlier, a Cross-Site Request Forgery vulnerability in the M… | |
CVE-2026-44363 | | 2026-05-13 | MISP modules are autonomous modules that can be used to extend MISP for new services. Prior to 3.0.7, an unsafe remote resource fetching vulnerability existed… | |
CVE-2026-8080 | Medium | 5.4 | 2026-05-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in misp allows Stored XSS. This issue affects M… |
CVE-2026-39962 | Critical | 9.6 | 2026-04-09 | MISP is an open source threat intelligence and sharing platform. Prior to 2.5.36, improper neutralization of special elements in an LDAP query in ApacheAuthent… |
CVE-2025-67906 | Medium | 5.4 | 2025-12-15 | In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path. |
CVE-2025-66386 | Medium | 4.1 | 2025-11-28 | app/Model/EventReport.php in MISP before 2.5.27 allows path traversal in view picture for a site-admin. |
CVE-2025-66384 | High | 8.2 | 2025-11-28 | app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity, related to tmp_name. |
CVE-2024-58130 | High | 7.2 | 2025-03-28 | In app/Controller/Component/RestResponseComponent.php in MISP before 2.4.193, REST endpoints have a lack of sanitization for non-JSON responses. |
CVE-2024-58129 | Medium | 5.5 | 2025-03-28 | In MISP before 2.4.193, menu_custom_right_link_html parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can… |
CVE-2024-58128 | Medium | 5.5 | 2025-03-28 | In MISP before 2.4.193, menu_custom_right_link parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can cond… |
CVE-2024-57969 | Medium | 4.3 | 2025-02-14 | app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search. |
CVE-2024-46918 | Medium | 4.9 | 2024-09-15 | app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in… |
CVE-2024-45509 | Medium | 6.5 | 2024-09-01 | In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org ad… |
CVE-2024-29859 | Critical | 9.8 | 2024-03-21 | In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload. |
CVE-2024-29858 | Critical | 9.8 | 2024-03-21 | In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload. |
CVE-2024-25675 | Critical | 9.8 | 2024-02-09 | An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to app/Controller/Job… |
CVE-2024-25674 | Critical | 9.8 | 2024-02-09 | An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and MIME type. |
CVE-2023-50918 | Critical | 9.8 | 2023-12-15 | app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs. |
CVE-2023-49926 | Medium | 6.1 | 2023-12-03 | app/Lib/Tools/EventTimelineTool.php in MISP before 2.4.179 allows XSS in the event timeline widget. |
CVE-2023-41098 | Medium | 6.1 | 2023-08-23 | An issue was discovered in MISP 2.4.174. In app/Controller/DashboardsController.php, a reflected XSS issue exists via the id parameter upon a dashboard edit. |
CVE-2023-40224 | Medium | 6.1 | 2023-08-10 | MISP 2.4.174 allows XSS in app/View/Events/index.ctp. |
CVE-2022-48329 | Critical | 9.8 | 2023-02-20 | MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php… |
CVE-2022-48328 | Critical | 9.8 | 2023-02-20 | app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters. |
CVE-2023-24027 | Medium | 6.1 | 2023-01-20 | In MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name. |
CVE-2022-29534 | High | 7.5 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vectors involving an "Accept: application/jso… |
CVE-2022-29533 | Medium | 6.1 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. There is XSS in app/Controller/OrganisationsController.php in a situation with a "weird single checkbox page." |
CVE-2022-29532 | Medium | 4.8 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. There is XSS in the cerebrate view if one administrator puts a javascript: URL in the URL field, and another ad… |
CVE-2022-29531 | Medium | 5.4 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. There is stored XSS in the event graph via a tag name. |
CVE-2022-29530 | Medium | 5.4 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. There is stored XSS in the galaxy clusters. |
CVE-2022-29529 | Medium | 5.4 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. There is stored XSS via the LinOTP login field. |
CVE-2022-29528 | Critical | 9.8 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. PHAR deserialization can occur. |
CVE-2022-27246 | Medium | 6.1 | 2022-03-18 | An issue was discovered in MISP before 2.4.156. An SVG org logo (which may contain JavaScript) is not forbidden by default. |
CVE-2022-27245 | High | 8.8 | 2022-03-18 | An issue was discovered in MISP before 2.4.156. app/Model/Server.php does not restrict generateServerSettings to the CLI. This could lead to SSRF. |
CVE-2022-27244 | Medium | 4.8 | 2022-03-18 | An issue was discovered in MISP before 2.4.156. A malicious site administrator could store an XSS payload in the custom auth name. This would be executed each… |
CVE-2022-27243 | High | 7.8 | 2022-03-18 | An issue was discovered in MISP before 2.4.156. app/View/Users/terms.ctp allows Local File Inclusion via the custom terms file setting. |
CVE-2021-41326 | Critical | 9.8 | 2021-09-17 | In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call. |
CVE-2021-39302 | Critical | 9.8 | 2021-08-19 | MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions['org'] value. |
CVE-2021-37743 | Medium | 5.4 | 2021-07-30 | app/View/GalaxyElements/ajax/index.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster elements in JSON format. |
CVE-2021-37742 | Medium | 5.4 | 2021-07-30 | app/View/Elements/GalaxyClusters/view_relation_tree.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster relationships. |
CVE-2021-37534 | Medium | 5.4 | 2021-07-26 | app/View/GalaxyClusters/add.ctp in MISP 2.4.146 allows Stored XSS when forking a galaxy cluster. |
CVE-2021-36212 | Medium | 6.1 | 2021-07-07 | app/View/SharingGroups/view.ctp in MISP before 2.4.146 allows stored XSS in the sharing groups view. |
CVE-2021-35502 | Critical | 9.8 | 2021-06-25 | app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data related to generic-template:index. |
CVE-2021-31780 | High | 7.5 | 2021-04-23 | In app/Model/MispObject.php in MISP 2.4.141, an incorrect sharing group association could lead to information disclosure on an event edit. When an object has a… |
CVE-2021-27904 | Medium | 5.5 | 2021-03-02 | An issue was discovered in app/Model/SharingGroupServer.php in MISP 2.4.139. In the implementation of Sharing Groups, the "all org" flag sometimes provided vie… |
CVE-2020-24085 | Medium | 6.1 | 2021-01-26 | A cross-site scripting (XSS) vulnerability exists in MISP v2.4.128 in app/Controller/UserSettingsController.php at SetHomePage() function. Due to a lack of con… |
CVE-2021-3184 | Medium | 6.1 | 2021-01-19 | MISP 2.4.136 has XSS via a crafted URL to the app/View/Elements/global_menu.ctp user homepage favourite button. |
CVE-2021-25325 | Medium | 6.1 | 2021-01-19 | MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs. |
CVE-2021-25324 | Medium | 6.1 | 2021-01-19 | MISP 2.4.136 has Stored XSS in the galaxy cluster view via a cluster name to app/View/GalaxyClusters/view.ctp. |
CVE-2021-25323 | Critical | 9.1 | 2021-01-19 | The default setting of MISP 2.4.136 did not enable the requirements (aka require_password_confirmation) to provide the previous password when changing a passwo… |
CVE-2020-29572 | Medium | 6.1 | 2020-12-06 | app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field. |
CVE-2020-29006 | Critical | 9.8 | 2020-11-24 | MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyElement.php. |
CVE-2020-28947 | Medium | 6.1 | 2020-11-19 | In MISP 2.4.134, XSS exists in the template element index view because the id parameter is mishandled. |
CVE-2020-28043 | High | 7.5 | 2020-11-02 | MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL. |
CVE-2020-25766 | High | 7.5 | 2020-09-18 | An issue was discovered in MISP before 2.4.132. It can perform an unwanted action because of a POST operation on a form that is not linked to the login page. |
CVE-2020-15711 | High | 8.8 | 2020-07-14 | In MISP before 2.4.129, setting a favourite homepage was not CSRF protected. |
CVE-2020-15412 | Medium | 4.3 | 2020-06-30 | An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contac… |
CVE-2020-15411 | Critical | 9.8 | 2020-06-30 | An issue was discovered in MISP 2.4.128. app/Controller/AttributesController.php has insufficient ACL checks in the attachment downloader. |
CVE-2020-14969 | High | 7.5 | 2020-06-22 | app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations. This occurs when querying the attribute restsearch API, revealing metada… |
CVE-2020-13153 | Medium | 6.1 | 2020-05-18 | app/View/Events/resolved_attributes.ctp in MISP before 2.4.126 has XSS in the resolved attributes view. |
CVE-2020-12889 | Critical | 9.8 | 2020-05-15 | MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case. |
CVE-2020-11458 | Medium | 4.9 | 2020-04-02 | app/Model/feed.php in MISP before 2.4.124 allows administrators to choose arbitrary files that should be ingested by MISP. This does not cause a leak of the fu… |
CVE-2020-10247 | Medium | 6.1 | 2020-03-09 | MISP 2.4.122 has Persistent XSS in the sighting popover tool. This is related to app/View/Elements/Events/View/sighting_field.ctp. |
CVE-2020-10246 | Medium | 6.1 | 2020-03-09 | MISP 2.4.122 has reflected XSS via unsanitized URL parameters. This is related to app/View/Users/statistics_orgs.ctp. |
CVE-2020-8894 | Medium | 6.5 | 2020-02-12 | An issue was discovered in MISP before 2.4.121. ACLs for discussion threads were mishandled in app/Controller/ThreadsController.php and app/Model/Thread.php. |
CVE-2020-8893 | High | 7.5 | 2020-02-12 | An issue was discovered in MISP before 2.4.121. The Galaxy view contained an incorrectly sanitized search string in app/View/Galaxies/view.ctp. |
CVE-2020-8892 | High | 8.1 | 2020-02-12 | An issue was discovered in MISP before 2.4.121. It did not consider the HTTP PUT method when trying to block a brute-force series of invalid requests. |