CVE-2026-104914MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View Exploitation status Not confirmed Fix Affected product M MISP Published 10/02/2026 Severity Medium CVE-2026-104912MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data Exploitation status Not known exploited Fix Affected product M MISP Published 10/02/2026 Severity High CVE-2026-104910MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization Exploitation status Not known exploited Fix Affected product M MISP Published 10/02/2026 Severity Medium CVE-2026-104908MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging Exploitation status Not known exploited Fix Affected product M MISP Published 10/02/2026 Severity High CVE-2026-104907MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler Exploitation status Not known exploited Fix Affected product M MISP Published 10/02/2026 Severity Medium CVE-2026-104906MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output Exploitation status Not known exploited Fix Affected product M MISP Published 10/02/2026 Severity Medium CVE-2026-104901MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server Exploitation status Not known exploited Fix Affected product M MISP Published 10/02/2026 Severity Medium CVE-2026-104900MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview Index Exploitation status Not known exploited Fix Affected product M MISP Published 10/02/2026 Severity Medium CVE-2026-103858MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions Exploitation status Not known exploited Fix Affected product M MISP Published 10/01/2026 Severity Medium CVE-2026-103664MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter Exploitation status Not known exploited Fix Affected product M MISP Published 10/01/2026 Severity Medium CVE-2026-103662MISP Reflected XSS in Taxonomy Tag Confirmation Forms Exploitation status Not known exploited Fix Affected product M MISP Published 10/01/2026 Severity Medium CVE-2026-103659MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes Exploitation status Not known exploited Fix Affected product M MISP Published 10/01/2026 Severity High CVE-2026-103655MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period Exploitation status Not known exploited Fix Affected product M MISP Published 10/01/2026 Severity Critical CVE-2026-103651MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypass Exploitation status Not known exploited Fix Affected product M MISP Published 10/01/2026 Severity High CVE-2026-103389MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation Graph Exploitation status Not known exploited Fix Affected product M MISP Published 09/30/2026 Severity Medium CVE-2026-103388MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field Exploitation status Not known exploited Fix Affected product M MISP Published 09/30/2026 Severity Medium CVE-2026-103321MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image Exploitation status Not known exploited Fix Affected product M MISP Published 09/30/2026 Severity High CVE-2026-103239MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection Exploitation status Not known exploited Fix Affected product M MISP Published 09/30/2026 Severity High CVE-2026-103237MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows Exploitation status Not known exploited Fix Affected product M MISP Published 09/30/2026 Severity High CVE-2026-103235MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Events Exploitation status Not known exploited Fix Affected product M MISP Published 09/30/2026 Severity High CVE-2026-97863misp-modules: Shell Command Injection in MISP cisco_firesight_manager_ACL_rule_export Module via Unescaped Attribute Values Exploitation status Not known exploited Fix Affected product M misp-modules Published 09/25/2026 Severity Medium CVE-2026-95806MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths Exploitation status Not known exploited Fix Affected product M MISP Published 09/22/2026 Severity High CVE-2026-95805MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restriction Exploitation status Not known exploited Fix Affected product M MISP Published 09/22/2026 Severity Medium CVE-2026-95754MISP: Disabled-user check ineffective in pre-authentication TOTP login branch Exploitation status Not known exploited Fix Affected product M MISP Published 09/22/2026 Severity Medium CVE-2026-95703MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_name Exploitation status Not known exploited Fix Affected product M MISP Published 09/22/2026 Severity Medium CVE-2026-95701MISP Path Traversal via Organization Name in Org-Statistics Logo Check Exploitation status Not known exploited Fix Affected product M MISP Published 09/22/2026 Severity Medium CVE-2026-95698MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name Exploitation status Not known exploited Fix Affected product M MISP Published 09/22/2026 Severity Medium CVE-2026-95697MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Metadata Exploitation status Not known exploited Fix Affected product M MISP Published 09/22/2026 Severity Medium CVE-2026-95693MISP Information Disclosure via Forged Upload Path Exploitation status Not known exploited Fix Affected product M MISP Published 09/22/2026 Severity Medium CVE-2026-95685MISP Missing Authorization on replaceSuggestionInReport Event Report Action Exploitation status Not known exploited Fix Affected product M MISP Published 09/22/2026 Severity Medium CVE-2026-95683MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL Exploitation status Not known exploited Fix Affected product M MISP Published 09/22/2026 Severity Medium CVE-2026-95682MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View Exploitation status Not known exploited Fix Affected product M MISP Published 09/22/2026 Severity Medium CVE-2026-95679MISP Unauthenticated Blind SSRF via XML Body Processing Exploitation status Not known exploited Fix Affected product M MISP Published 09/22/2026 Severity Medium CVE-2026-95674MISP EventsController queryEnrichment allows querying unavailable or legacy modules without validation Exploitation status Not known exploited Fix Affected product M MISP Published 09/22/2026 Severity Medium CVE-2026-95671MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add Exploitation status Not known exploited Fix Affected product M MISP Published 09/22/2026 Severity Medium CVE-2026-95667MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials Exploitation status Not known exploited Fix Affected product M MISP Published 09/22/2026 Severity Medium CVE-2026-95665MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON Exploitation status Not known exploited Fix Affected product M MISP Published 09/22/2026 Severity Medium CVE-2026-95661MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type List Exploitation status Not known exploited Fix Affected product M MISP Published 09/22/2026 Severity Medium CVE-2026-95659MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread Exploitation status Not known exploited Fix Affected product M MISP Published 09/22/2026 Severity Medium CVE-2026-95658MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution of workflow modules Exploitation status Not known exploited Fix Affected product M MISP Published 09/22/2026 Severity Medium CVE-2026-94404MISP CSRF vulnerability allows unauthorized attribute modification Exploitation status Not known exploited Fix Affected product M MISP Published 09/21/2026 Severity High CVE-2026-94401MISP Arbitrary Local File Read and SSRF via MISP Export Upload Exploitation status Not known exploited Fix Affected product M MISP Published 09/21/2026 Severity High CVE-2026-94394MISP ObjectReferencesController: Granular Distribution and Sharing Group Restrictions Bypassed When Adding Object References Exploitation status Not known exploited Fix Affected product M MISP Published 09/21/2026 Severity Medium CVE-2026-94393MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport Exploitation status Not known exploited Fix Affected product M MISP Published 09/21/2026 Severity Medium CVE-2026-94383MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension Exploitation status Not known exploited Fix Affected product M MISP Published 09/21/2026 Severity High CVE-2026-94381MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTime Exploitation status Not known exploited Fix Affected product M MISP Published 09/21/2026 Severity High CVE-2026-94379MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP) Exploitation status Not known exploited Fix Affected product M MISP Published 09/21/2026 Severity Medium CVE-2026-94374MISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events' Reports Exploitation status Not known exploited Fix Affected product M MISP Published 09/21/2026 Severity High CVE-2026-94373MISP DOM-based Cross-Site Scripting via innerHTML in Contextual Menu Exploitation status Not known exploited Fix Affected product M MISP Published 09/21/2026 Severity Medium CVE-2026-94372Stored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies Index Exploitation status Not known exploited Fix Affected product M MISP Published 09/21/2026 Severity Medium CVE-2026-94277Stored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy Name Exploitation status Not known exploited Fix Affected product M MISP Published 09/21/2026 Severity Medium CVE-2026-93296MISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics Legends Exploitation status Not known exploited Fix Affected product M MISP Published 09/17/2026 Severity High CVE-2026-93295MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution Exploitation status Not known exploited Fix Affected product M MISP Published 09/17/2026 Severity High CVE-2026-92932MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabled Exploitation status Not known exploited Fix Affected product S sachertortephp Published 09/17/2026 Severity Medium CVE-2026-92003MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion Exploitation status Not known exploited Fix Affected product M MISP Published 09/15/2026 Severity Medium CVE-2026-92002MISP: Authentication failure logging suppressed during Redis unavailability Exploitation status Not known exploited Fix Affected product M MISP Published 09/15/2026 Severity Medium CVE-2026-91859MISP Access Log Entry Overwritten by Error Controller's Second beforeFilter Pass Exploitation status Not known exploited Fix Affected product M MISP Published 09/15/2026 Severity Medium CVE-2026-91857MISP: State-changing actions accessible via GET request enabling CSRF Exploitation status Not known exploited Fix Affected product M MISP Published 09/15/2026 Severity Medium CVE-2026-91851MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag Comparison Exploitation status Not known exploited Fix Affected product M MISP Published 09/15/2026 Severity Medium CVE-2026-91846MISP Collection Element Add Missing Authorization on Referenced Object UUID Exploitation status Not known exploited Fix Affected product M MISP Published 09/15/2026 Severity High CVE-2026-91825MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit Exploitation status Not known exploited Fix Affected product M MISP Published 09/15/2026 Severity High CVE-2026-91819MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent Exploitation status Not known exploited Fix Affected product M MISP Published 09/15/2026 Severity Medium CVE-2026-90961MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentials Exploitation status Not known exploited Fix Affected product M MISP Published 09/14/2026 Severity Critical CVE-2026-90957MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures Exploitation status Not known exploited Fix Affected product M MISP Published 09/14/2026 Severity Medium CVE-2026-90955MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load Exploitation status Not known exploited Fix Affected product M MISP Published 09/14/2026 Severity Medium CVE-2026-90895MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection Exploitation status Not known exploited Fix Affected product M MISP Published 09/14/2026 Severity High CVE-2026-90893MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints Exploitation status Not known exploited Fix Affected product M MISP Published 09/14/2026 Severity Medium CVE-2026-88921MISP: Unescaped HTML Injection in PDF Report Element Rendering Exploitation status Not known exploited Fix Affected product M MISP Published 09/10/2026 Severity Medium CVE-2026-88915MISP Event Template Instantiation Bypasses Sharing Group and Tagging Authorization Exploitation status Not known exploited Fix Affected product M MISP Published 09/10/2026 Severity High CVE-2026-86452MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding Exploitation status Not known exploited Fix Affected product M MISP Published 09/07/2026 Severity High CVE-2026-86451MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects Exploitation status Not known exploited Fix Affected product M MISP Published 09/07/2026 Severity Medium CVE-2026-86441MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data Exploitation status Not known exploited Fix Affected product M MISP Published 09/07/2026 Severity Low CVE-2026-86440MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs Exploitation status Not known exploited Fix Affected product M MISP Published 09/07/2026 Severity Medium CVE-2026-86419MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII Discovery Exploitation status Not known exploited Fix Affected product M MISP Published 09/07/2026 Severity High CVE-2026-86418MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users Exploitation status Not known exploited Fix Affected product M MISP Published 09/07/2026 Severity Low CVE-2026-86417MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Users Exploitation status Not known exploited Fix Affected product M MISP Published 09/07/2026 Severity Medium CVE-2026-86408MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected Events Exploitation status Not known exploited Fix Affected product M MISP Published 09/07/2026 Severity High CVE-2026-86351MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL Exploitation status Not known exploited Fix Affected product M MISP Published 09/07/2026 Severity Medium CVE-2026-86347MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion Exploitation status Not known exploited Fix Affected product M MISP Published 09/07/2026 Severity High CVE-2026-86342MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Information Exploitation status Not known exploited Fix Affected product M MISP Published 09/07/2026 Severity Medium CVE-2026-86283MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data Exploitation status Not known exploited Fix Affected product M MISP Published 09/06/2026 Severity High CVE-2026-85547Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP Exploitation status Not known exploited Fix Affected product M MISP Published 09/04/2026 Severity Medium CVE-2026-85546MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests Exploitation status Not known exploited Fix Affected product M MISP Published 09/04/2026 Severity High CVE-2026-85538MISP Attribute Deletion Authorization Bypass Allows Users Without Modify Permissions to Delete Attributes Exploitation status Not known exploited Fix Affected product M MISP Published 09/04/2026 Severity High CVE-2026-85533MISP Sharing Group Authorization Bypass via Omitted Distribution Parameter Exploitation status Not known exploited Fix Affected product M MISP Published 09/04/2026 Severity High CVE-2026-85239MISP Event Template Definition Validation Bypass Allows Persistent Denial of Service Exploitation status Not known exploited Fix Affected product M MISP Published 09/03/2026 Severity High CVE-2026-85238Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking Exploitation status Not known exploited Fix Affected product M MISP Published 09/03/2026 Severity High CVE-2026-85237Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass Exploitation status Not known exploited Fix Affected product M MISP Published 09/03/2026 Severity High CVE-2026-85236MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request Exploitation status Not known exploited Fix Affected product M MISP Published 09/03/2026 Severity High CVE-2026-85230MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection Exploitation status Not known exploited Fix Affected product M MISP Published 09/03/2026 Severity Medium CVE-2026-85227Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters Exploitation status Not known exploited Fix Affected product M MISP Published 09/03/2026 Severity Medium CVE-2026-85226MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations Exploitation status Not known exploited Fix Affected product M MISP Published 09/03/2026 Severity Medium CVE-2026-85221MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacks Exploitation status Not known exploited Fix Affected product M MISP Published 09/03/2026 Severity High CVE-2026-85216MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials Exploitation status Not known exploited Fix Affected product M MISP Published 09/03/2026 Severity Critical CVE-2026-77761Cross-Document Parser State Contamination in misp-stix Exploitation status Not known exploited Fix Affected product M misp-stix Published 08/21/2026 Severity Medium CVE-2026-77755Denial of Service in MISP-STIX Import via Malformed or Oversized STIX Documents in misp-stix library Exploitation status Not known exploited Fix Affected product M misp-stix Published 08/21/2026 Severity High CVE-2026-77751Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library Exploitation status Not known exploited Fix Affected product M misp-stix Published 08/21/2026 Severity High CVE-2026-77710STIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Injection in misp-stix library Exploitation status Not known exploited Fix Affected product M misp-stix Published 08/21/2026 Severity Medium CVE-2026-73162cti-transmute CSRF Allows Unauthorized Follow and Notification State Changes Exploitation status Not known exploited Fix Affected product C cti-transmute Published 08/11/2026 Severity Medium CVE-2026-73161cti-transmute Conversion Table Allows XSS via Unescaped Cell Content During Search Highlighting Exploitation status Not known exploited Fix Affected product C cti-transmute Published 08/11/2026 Severity Medium 
