Login Request a demo
MP
Vendor
Misp Project
1 product with CVEs on record
142
CVEs
0
On KEV
0
New 30D
Products
MI
Misp
Misp Project
10.0
142 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-86452
MI
Misp
Misp-project
7.5
1%
Sep 7MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding
CVE-2026-86451
MI
Misp
Misp-project
4.3
0%
Sep 7MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects
CVE-2026-86441
MI
Misp
Misp-project
4.3
0%
Sep 7MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data
CVE-2026-86440
MI
Misp
Misp-project
5.4
0%
Sep 7MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs
CVE-2026-86419
MI
Misp
Misp-project
9.1
0%
Sep 7MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII Discovery
CVE-2026-86418
MI
Misp
Misp-project
4.3
0%
Sep 7MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users
CVE-2026-86417
MI
Misp
Misp-project
4.3
0%
Sep 7MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Users
CVE-2026-86408
MI
Misp
Misp-project
6.5
0%
Sep 7MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected Events
CVE-2026-86351
MI
Misp
Misp-project
6.1
0%
Sep 7MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL
CVE-2026-86347
MI
Misp
Misp-project
6.5
0%
Sep 7MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion
CVE-2026-86342
MI
Misp
Misp-project
4.3
0%
Sep 7MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Information
CVE-2026-85239
MI
Misp
Misp-project
6.5
0%
Sep 3MISP Event Template Definition Validation Bypass Allows Persistent Denial of Service
CVE-2026-85238
MI
Misp
Misp-project
6.8
0%
Sep 3Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking
CVE-2026-85237
MI
Misp
Misp-project
8.1
0%
Sep 3Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass
CVE-2026-85236
MI
Misp
Misp-project
8.8
0%
Sep 3MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request
CVE-2026-85230
MI
Misp
Misp-project
5.4
0%
Sep 3MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection
CVE-2026-85227
MI
Misp
Misp-project
6.1
0%
Sep 3Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters
CVE-2026-85226
MI
Misp
Misp-project
4.3
0%
Sep 3MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations
CVE-2026-85221
MI
Misp
Misp-project
9.1
0%
Sep 3MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacks
CVE-2026-85216
MI
Misp
Misp-project
9.8
1%
Sep 3MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials
CVE-2026-56447
MI
Misp
Misp-project
7.2
1%
Jun 22MISP remote code execution via arbitrary rdkafka configuration path
CVE-2026-56446
MI
Misp
Misp-project
7.2
1%
Jun 22Authenticated Remote Code Execution via Arbitrary NDJSON Error Log Path in MISP
CVE-2026-56425
MI
Misp
Misp-project
8.8
0%
Jun 22MISP AAD authentication plugin - Improper OAuth State Handling, Missing Session Rotation, Insecure Redirect URI Validation, and Log Injection
CVE-2026-56424
MI
Misp
Misp-project
8.8
1%
Jun 22Broken access control in MISP core allows cross-organization unauthorized modification or deletion of analyst data, event reports, collections, templates, and decaying models
CVE-2026-56423
MI
Misp
Misp-project
8.8
0%
Jun 22MISP Core: Broken access control allows instance-wide unauthorized deletion of event reports and sharing groups via bulk deletion endpoints
CVE-2026-10864
MI
Misp
Misp-project
4.3
0%
Jun 4MISP Dashboard widget field selection may expose restricted user and organisation data
CVE-2026-10863
MI
Misp
Misp-project
8.1
0%
Jun 4MISP User-controlled order parameter in correlations over-correlation endpoint
CVE-2026-10860
MI
Misp
Misp-project
6.5
0%
Jun 4MISP CRUDComponent delete validation bypass via operator precedence error
CVE-2026-10861
MI
Misp
Misp-project
6.1
0%
Jun 4MISP post-login open redirect via pre_login_requested_url
CVE-2026-10856
MI
Misp
Misp-project
6.1
0%
Jun 4Open redirect in MISP dashboard button widget URL handling
CVE-2026-10855
MI
Misp
Misp-project
4.3
0%
Jun 4MISP Event template importer authorization bypass
CVE-2026-10854
MI
Misp
Misp-project
4.3
0%
Jun 4Unauthorized exposure of private galaxies in MISP event template creation
CVE-2026-10611
MI
Misp
Misp-project
10.0
0%
Jun 2OTP bypass via plugin-based LDAP authentication in MISP when LDAP mixed authentication is enabled
CVE-2026-9137
MI
Misp
Misp-project
7.5
0%
May 20CSP Report Endpoint Log Flooding in MISP via Incorrect Size Limit
CVE-2026-9136
MI
Misp
Misp-project
6.5
0%
May 20Unauthorized ShadowAttribute modification in MISP via client-supplied identifier
CVE-2026-44379
MI
Misp
Misp-project
5.3
0%
May 13MISP: Improper UUID validation in MISP Collections
CVE-2026-44380
MI
Misp
Misp-project
7.2
0%
May 13MISP: Improper access control in auth key reset allows privilege escalation to site administrator
CVE-2026-44381
MI
Misp
Misp-project
5.3
1%
May 13MISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listings
CVE-2026-8080
MI
Misp
Misp-project
5.4
0%
May 7MISP core - Stored XSS in MISP template (old engine) element attribute type
CVE-2026-39962
MI
Misp
Misp-project
9.6
0%
Apr 9LDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variable
CVE-2025-67906
MI
Misp
Misp-project
9.0
0%
Dec 15In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path
CVE-2024-58130
MI
Misp
Misp-project
6.1
0%
Mar 28In app/Controller/Component/RestResponseComponent.php in MISP before 2.4.193, REST endpoints have a lack of sanitization for non-JSON responses
CVE-2024-58128
MI
Misp
Misp-project
4.8
0%
Mar 28In MISP before 2.4.193, menu_custom_right_link parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can conduct XSS attacks via…
CVE-2024-58129
MI
Misp
Misp-project
4.8
0%
Mar 28In MISP before 2.4.193, menu_custom_right_link_html parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can conduct XSS attacks…
CVE-2024-57969
MI
Misp
Misp-project
4.3
0%
Feb 14app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search
CVE-2024-46918
MI
Misp
Misp-project
4.9
0%
Sep 15app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in the same org
CVE-2024-45509
MI
Misp
Misp-project
6.5
0%
Sep 1In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org admin
CVE-2024-29858
MI
Misp
Misp-project
9.8
0%
Mar 21In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload
CVE-2024-29859
MI
Misp
Misp-project
9.8
1%
Mar 21In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload
CVE-2024-25675
MI
Misp
Misp-project
9.8
1%
Feb 9An issue was discovered in MISP before 2.4.184
CVE-2024-25674
MI
Misp
Misp-project
9.8
1%
Feb 9An issue was discovered in MISP before 2.4.184
CVE-2023-50918
MI
Misp
Misp-project
9.8
1%
Dec 15app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs
CVE-2023-49926
MI
Misp
Misp-project
6.1
0%
Dec 3app/Lib/Tools/EventTimelineTool.php in MISP before 2.4.179 allows XSS in the event timeline widget
CVE-2023-48657
MI
Misp
Misp-project
9.8
1%
Nov 17An issue was discovered in MISP before 2.4.176
CVE-2023-48658
MI
Misp
Misp-project
9.8
1%
Nov 17An issue was discovered in MISP before 2.4.176
CVE-2023-48656
MI
Misp
Misp-project
9.8
1%
Nov 17An issue was discovered in MISP before 2.4.176
CVE-2023-48659
MI
Misp
Misp-project
9.8
1%
Nov 17An issue was discovered in MISP before 2.4.176
CVE-2023-48655
MI
Misp
Misp-project
9.8
1%
Nov 17An issue was discovered in MISP before 2.4.176
CVE-2023-41098
MI
Misp
Misp-project
6.1
0%
Aug 23An issue was discovered in MISP 2.4.174
CVE-2023-40224
MI
Misp
Misp-project
6.1
0%
Aug 10MISP 2.4.174 allows XSS in app/View/Events/index.ctp