Misp - vulnerabilities (CVEs)

188 CVEs in 11 products, 37 in the last 30 days, newest from 2026-10-27.

Products

• Misp - 111 CVEs
• Cti-transmute - 17 CVEs
• Misp-modules - 4 CVEs
• Misp-stix - 4 CVEs
• Misp-guard - 3 CVEs
• Bsimvis - 1 CVEs
• Misp-maltego - 1 CVEs
• Misp (malware Information Sharing Platform) - 1 CVEs
• Misp Modules (html To Markdown Expansion Module) - 1 CVEs
• Sachertortephp - 1 CVEs
• Sachertortephp (cakephp-based Misp Application) - 1 CVEs

Newest CVEs of Misp

• CVE-2026-118173 - CVSS 6.1 (medium), 2026-10-27: MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags. When a feed event…
• CVE-2026-116469 - CVSS 7.1 (high), 2026-10-26: MISP Guard, a proxy-based security filter for MISP feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions…
• CVE-2026-116372 - CVSS 7.7 (high), 2026-10-26: MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules. The process_feed_response method in…
• CVE-2026-112991 - CVSS 6.3 (medium), 2026-10-19: The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation…
• CVE-2026-112192 - CVSS 5.3 (medium), 2026-10-19: MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the…
• CVE-2026-112188 - CVSS 7.1 (high), 2026-10-19: MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should…
• CVE-2026-112184 - CVSS 4.8 (medium), 2026-10-19: MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are…
• CVE-2026-112183 - CVSS 4.8 (medium), 2026-10-19: MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value…
• CVE-2026-112180 - CVSS 5.1 (medium), 2026-10-19: MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database,…
• CVE-2026-112179 - CVSS 5.3 (medium), 2026-10-19: In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags…
• CVE-2026-112178 - CVSS 7.1 (high), 2026-10-19: MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying…
• CVE-2026-107278 - CVSS 5.3 (medium), 2026-10-07: MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the…
• CVE-2026-107276 - CVSS 6.3 (medium), 2026-10-07: MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted…
• CVE-2026-107180 - CVSS 7.1 (high), 2026-10-07: On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication setup applied only…
• CVE-2026-107175 - CVSS 5.3 (medium), 2026-10-07: MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or…
• CVE-2026-106513 - CVSS 6.9 (medium), 2026-10-06: MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the…
• CVE-2026-106512 - CVSS 8.4 (high), 2026-10-06: The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied…
• CVE-2026-104914 - CVSS 5.3 (medium), 2026-10-02: MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints. When a user queries for soft-deleted…
• CVE-2026-104912 - CVSS 7.1 (high), 2026-10-02: MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation…
• CVE-2026-104910 - CVSS 5.3 (medium), 2026-10-02: MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the…
• CVE-2026-104908 - CVSS 7.1 (high), 2026-10-02: MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying…
• CVE-2026-104907 - CVSS 4.8 (medium), 2026-10-02: MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page. When a linked (remote) MISP server is configured, the event preview…
• CVE-2026-104906 - CVSS 6.2 (medium), 2026-10-02: MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string…
• CVE-2026-104901 - CVSS 5.1 (medium), 2026-10-02: MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries…
• CVE-2026-104900 - CVSS 5.3 (medium), 2026-10-02: MISP contains a stored cross-site scripting (XSS) vulnerability in the index table rendering of the remote event preview. The count field template escaped the…
• CVE-2026-103858 - CVSS 5.3 (medium), 2026-10-01: MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing…
• CVE-2026-103664 - CVSS 4.8 (medium), 2026-10-01: MISP contains a reflected cross-site scripting (XSS) vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL,…
• CVE-2026-103662 - CVSS 5.1 (medium), 2026-10-01: MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag). The…
• CVE-2026-103659 - CVSS 7.1 (high), 2026-10-01: MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes…
• CVE-2026-103655 - CVSS 9.3 (critical), 2026-10-01: MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once…