Cti-transmute (Misp) - vulnerabilities (CVEs)
17 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-08-11. Vendor: Misp.
CVEs of Cti-transmute
- CVE-2026-73162 - CVSS 5.3 (medium), 2026-08-11: Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: * /account/follow * /account/delete_notification *…
- CVE-2026-73161 - CVSS 5.1 (medium), 2026-08-11: Affected versions of cti-transmute improperly handle conversion-table values passed through the search highlighting feature. The highlight() function…
- CVE-2026-73160 - CVSS 8.7 (high), 2026-08-11: Affected versions of cti-transmute contain an SSRF vulnerability in the /fetch_misp_event and /misp_search_events endpoints. The URL validation routine…
- CVE-2026-73159 - CVSS 5.1 (medium), 2026-08-11: Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into HTML through Vue's v-html. The helper mapIcon()…
- CVE-2026-73158 - CVSS 5.1 (medium), 2026-08-11: Affected versions of cti-transmute insufficiently validate saved graph configuration data. Graph configurations can contain style properties that are later…
- CVE-2026-73157 - CVSS 2.3 (low), 2026-08-11: Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields…
- CVE-2026-73156 - CVSS 5.3 (medium), 2026-08-11: Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names may…
- CVE-2026-73155 - CVSS 5.3 (medium), 2026-08-11: Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether those users are…
- CVE-2026-73140 - CVSS 5.3 (medium), 2026-08-11: Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normal comment…
- CVE-2026-72760 - CVSS 5.3 (medium), 2026-08-10: Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows…
- CVE-2026-72759 - CVSS 6.9 (medium), 2026-08-10: In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record…
- CVE-2026-72751 - CVSS 5.1 (medium), 2026-08-10: CTI-Transmute is affected by a stored cross-site scripting (XSS) vulnerability in the conversion graph used to visualise converted MISP and STIX content.…
- CVE-2026-71502 - CVSS 5.1 (medium), 2026-08-06: CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in…
- CVE-2026-69082 - CVSS 8.8 (high), 2026-08-03: CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/<id> endpoint…
- CVE-2026-69079 - CVSS 8.7 (high), 2026-08-03: CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activity_timeline endpoint. The endpoint accepts a…
- CVE-2026-69078 - CVSS 8.8 (high), 2026-08-03: CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality. User-controlled CTI content,…
- CVE-2026-9806 - CVSS 6.3 (medium), 2026-05-28: A stored cross-site scripting (XSS) vulnerability exists in the notification panel of CTI Transmute in versions prior to the patched release. Notification…
