MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request

MISP AAD authentication plugin - Improper OAuth State Handling, Missing Session Rotation, Insecure Redirect URI Validation, and Log Injection

Broken access control in MISP core allows cross-organization unauthorized modification or deletion of analyst data, event reports, collections, templates, and decaying models

MISP Core: Broken access control allows instance-wide unauthorized deletion of event reports and sharing groups via bulk deletion endpoints

MISP mass assignment vulnerabilities allow unauthorized modification of ownership and delegation records

MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Events

MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTime

MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution

MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection

MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension

MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests

MISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics Legends

MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection

MISP sharing group creation mass assignment allows unauthorized takeover of existing sharing groups

MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image

MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows

MISP Arbitrary Local File Read and SSRF via MISP Export Upload

MISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events' Reports

MISP Attribute Deletion Authorization Bypass Allows Users Without Modify Permissions to Delete Attributes

Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass

MISP User-controlled order parameter in correlations over-correlation endpoint

Open Redirect in MISP Installer-Generated Apache Configuration

MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths

MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypass

MISP Sharing Group Authorization Bypass via Omitted Distribution Parameter

MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding

MISP organization administrators can target site administrator accounts for password reset

CSP Report Endpoint Log Flooding in MISP via Incorrect Size Limit

MISP remote code execution via arbitrary rdkafka configuration path

Authenticated Remote Code Execution via Arbitrary NDJSON Error Log Path in MISP

MISP: Improper access control in auth key reset allows privilege escalation to site administrator

MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution

MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control

MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances

MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data

MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging

MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes

MISP CSRF vulnerability allows unauthorized attribute modification

MISP Collection Element Add Missing Authorization on Referenced Object UUID

MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit

MISP Event Template Instantiation Bypasses Sharing Group and Tagging Authorization

MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data

MISP automation endpoints may be exposed to CSRF when Sec-Fetch-Site protection is disabled by default