MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data

MISP automation endpoints may be exposed to CSRF when Sec-Fetch-Site protection is disabled by default

MISP: Disabled-user check ineffective in pre-authentication TOTP login branch

MISP Unauthenticated Blind SSRF via XML Body Processing

MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials

MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution of workflow modules

MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP)

MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion

MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent

Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking

MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected Events

MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion

MISP Event Template Definition Validation Bypass Allows Persistent Denial of Service

MISP CRUDComponent delete validation bypass via operator precedence error

Unauthorized ShadowAttribute modification in MISP via client-supplied identifier

MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport

MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests

MISP ObjectReferencesController: Granular Distribution and Sharing Group Restrictions Bypassed When Adding Object References

MISP DOM-based Cross-Site Scripting via innerHTML in Contextual Menu

Stored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies Index

Stored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy Name

MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output

MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation Graph

MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field

Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP

MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL

Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters

MISP event editing allows unauthorized assignment to undisclosed sharing groups

MISP post-login open redirect via pre_login_requested_url

Open redirect in MISP dashboard button widget URL handling

MISP OIDC authentication bypass via automatic email-based account linking under insecure IdP configurations

MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs

MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection

MISP core - Stored XSS in MISP template (old engine) element attribute type

MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings

MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances

MISP Object Sync Drops Objects and Attributes When Description Is Empty

MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes

MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View

MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization

MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview Index

MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions

MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restriction

MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name

MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Metadata

MISP Information Disclosure via Forged Upload Path

MISP Missing Authorization on replaceSuggestionInReport Event Report Action

MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL

MISP EventsController queryEnrichment allows querying unavailable or legacy modules without validation

MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add