MISP Access Log Entry Overwritten by Error Controller's Second beforeFilter Pass

MISP: State-changing actions accessible via GET request enabling CSRF

MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag Comparison

MISP: Improper sharing group authorization check when adding attributes

importModule function in MISP ignores per-organisation import module restrictions

MISP importModule missing authorization allows read-only users to modify events via misp_standard imports

MISP object edit authorization bypass allows unauthorized sharing group assignment

MISP AuthKey edit endpoint allows authenticated user email enumeration

MISP UiBeta event index reflected XSS in advanced filter popup

MISP organisation logo path traversal allows retrieval of arbitrary PNG/SVG files

MISP template builder exposes non-visible custom galaxies across organisations

MISP: Improper UUID validation in MISP Collections

MISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listings

MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records

MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server

MISP Reflected XSS in Taxonomy Tag Confirmation Forms

MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_name

MISP Path Traversal via Organization Name in Org-Statistics Logo Check

MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON

MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type List

MISP: Authentication failure logging suppressed during Redis unavailability

MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures

MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints

MISP: Unescaped HTML Injection in PDF Report Element Rendering

MISP Overmind theme stored XSS via unvalidated homepage setting

MISP improper authorization allows organization administrators to modify site administrator user settings

MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels

MISP CSS Injection via Remote Tag Colour in Event Preview

MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler

MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter

MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View

MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread

MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load

MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects

MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data

MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users

MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Users

MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Information

MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations

MISP Dashboard widget field selection may expose restricted user and organisation data

MISP Event template importer authorization bypass

Unauthorized exposure of private galaxies in MISP event template creation