MI
Product
misp
145
CVEs
0
On KEV
10.0
Max CVSS
31
New 30D
Severity mix
Critical 10High 44Medium 91Low 0
Watch
Add misp to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-91851 | 5.3 | Sep 15 | MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag Comparison Affected: before 2.5.46 |
| CVE-2026-61474 | 5.3 | Jul 9 | MISP: Improper sharing group authorization check when adding attributes Affected: through 2.5.42 |
| CVE-2026-60125 | 5.3 | Jul 8 | importModule function in MISP ignores per-organisation import module restrictions Affected: through 2.5.42 |
| CVE-2026-60124 | 5.3 | Jul 8 | MISP importModule missing authorization allows read-only users to modify events via misp_standard imports Affected: through 2.5.42 |
| CVE-2026-54398 | 5.3 | Jun 12 | MISP object edit authorization bypass allows unauthorized sharing group assignment Affected: before 2.5.40 |
| CVE-2026-54396 | 5.3 | Jun 12 | MISP AuthKey edit endpoint allows authenticated user email enumeration Affected: before 2.5.40 |
| CVE-2026-54395 | 5.3 | Jun 12 | MISP UiBeta event index reflected XSS in advanced filter popup Affected: before 2.5.40 |
| CVE-2026-54394 | 5.3 | Jun 12 | MISP organisation logo path traversal allows retrieval of arbitrary PNG/SVG files Affected: before 2.5.40 |
| CVE-2026-54362 | 5.3 | Jun 12 | MISP template builder exposes non-visible custom galaxies across organisations Affected: before 2.5.40 |
| CVE-2026-44379 | 5.3 | May 13 | MISP: Improper UUID validation in MISP Collections Affected: < 2.5.37 |
| CVE-2026-44381 | 5.3 | May 13 | MISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listings Affected: < 2.5.37 |
| CVE-2026-112180 | 5.1 | Oct 19 | MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records Affected: through 2.5.48 |
| CVE-2026-104901 | 5.1 | Oct 2 | MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server Affected: before 2.5.48 |
| CVE-2026-103662 | 5.1 | Oct 1 | MISP Reflected XSS in Taxonomy Tag Confirmation Forms Affected: before 2.5.48 |
| CVE-2026-95703 | 5.1 | Sep 22 | MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_name Affected: before 2.5.47 |
| CVE-2026-95701 | 5.1 | Sep 22 | MISP Path Traversal via Organization Name in Org-Statistics Logo Check Affected: before 2.5.47 |
| CVE-2026-95665 | 5.1 | Sep 22 | MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON Affected: before 2.5.47 |
| CVE-2026-95661 | 5.1 | Sep 22 | MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type List Affected: before 2.5.47 |
| CVE-2026-92002 | 5.1 | Sep 15 | MISP: Authentication failure logging suppressed during Redis unavailability Affected: before 2.5.46 |
| CVE-2026-90957 | 5.1 | Sep 14 | MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures Affected: before 2.5.46 |
| CVE-2026-90893 | 5.1 | Sep 14 | MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints Affected: before 2.5.46 |
| CVE-2026-88921 | 5.1 | Sep 10 | MISP: Unescaped HTML Injection in PDF Report Element Rendering Affected: before 2.5.46 |
| CVE-2026-54393 | 5.1 | Jun 12 | MISP Overmind theme stored XSS via unvalidated homepage setting Affected: before 2.5.40 |
| CVE-2026-54357 | 5.1 | Jun 12 | MISP improper authorization allows organization administrators to modify site administrator user settings Affected: before 2.5.40 |
| CVE-2026-112184 | 4.8 | Oct 19 | MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels Affected: before 2.5.48 |
| CVE-2026-112183 | 4.8 | Oct 19 | MISP CSS Injection via Remote Tag Colour in Event Preview Affected: before 2.5.48 |
| CVE-2026-104907 | 4.8 | Oct 2 | MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler Affected: before 2.5.48 |
| CVE-2026-103664 | 4.8 | Oct 1 | MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter Affected: before 2.5.48 |
| CVE-2026-95682 | 4.8 | Sep 22 | MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View Affected: before 2.5.47 |
| CVE-2026-95659 | 4.8 | Sep 22 | MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread Affected: before 2.5.47 |
| CVE-2026-90955 | 4.6 | Sep 14 | MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load Affected: before 2.5.46 |
| CVE-2026-86451 | 4.3 | Sep 7 | MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects Affected: through 2.5.45 |
| CVE-2026-86441 | 4.3 | Sep 7 | MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data Affected: through 2.5.45 |
| CVE-2026-86418 | 4.3 | Sep 7 | MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users Affected: through 2.5.45 |
| CVE-2026-86417 | 4.3 | Sep 7 | MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Users Affected: through 2.5.45 |
| CVE-2026-86342 | 4.3 | Sep 7 | MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Information Affected: through 2.5.45 |
| CVE-2026-85226 | 4.3 | Sep 3 | MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations Affected: through 2.5.45 |
| CVE-2026-10864 | 4.3 | Jun 4 | MISP Dashboard widget field selection may expose restricted user and organisation data Affected: through 2.5.38 |
| CVE-2026-10855 | 4.3 | Jun 4 | MISP Event template importer authorization bypass Affected: through 2.5.38 |
| CVE-2026-10854 | 4.3 | Jun 4 | Unauthorized exposure of private galaxies in MISP event template creation Affected: through 2.5.38 |
| CVE-2025-66386 | 4.1 | Nov 28 | app/Model/EventReport.php in MISP before 2.5.27 allows path traversal in view picture for a site-admin Affected: before 2.5.27 |