OTP bypass via plugin-based LDAP authentication in MISP when LDAP mixed authentication is enabled

MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials

LDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variable

MISP Core: Mass Assignment and Object Re-ownership via Unvalidated Request Fields

MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period

MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentials

MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII Discovery

MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacks

MISP user edit endpoint mass assignment vulnerability allows unauthorized user account modification

MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request

MISP AAD authentication plugin - Improper OAuth State Handling, Missing Session Rotation, Insecure Redirect URI Validation, and Log Injection

Broken access control in MISP core allows cross-organization unauthorized modification or deletion of analyst data, event reports, collections, templates, and decaying models

MISP Core: Broken access control allows instance-wide unauthorized deletion of event reports and sharing groups via bulk deletion endpoints

MISP mass assignment vulnerabilities allow unauthorized modification of ownership and delegation records

MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Events

MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTime

MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution

MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection

MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension

MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests

MISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics Legends

MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection

MISP sharing group creation mass assignment allows unauthorized takeover of existing sharing groups

MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image

MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows

MISP Arbitrary Local File Read and SSRF via MISP Export Upload

MISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events' Reports

MISP Attribute Deletion Authorization Bypass Allows Users Without Modify Permissions to Delete Attributes

Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass

MISP User-controlled order parameter in correlations over-correlation endpoint

Open Redirect in MISP Installer-Generated Apache Configuration

MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths

MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypass

MISP Sharing Group Authorization Bypass via Omitted Distribution Parameter

MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding

MISP organization administrators can target site administrator accounts for password reset

CSP Report Endpoint Log Flooding in MISP via Incorrect Size Limit

MISP remote code execution via arbitrary rdkafka configuration path

Authenticated Remote Code Execution via Arbitrary NDJSON Error Log Path in MISP

MISP: Improper access control in auth key reset allows privilege escalation to site administrator

MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution

MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control

MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances

MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data

MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging

MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes

MISP CSRF vulnerability allows unauthorized attribute modification

MISP Collection Element Add Missing Authorization on Referenced Object UUID

MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit

MISP Event Template Instantiation Bypasses Sharing Group and Tagging Authorization