CVE-2026-88921MISP: Unescaped HTML Injection in PDF Report Element Rendering Exploitation status Not known exploited Fix Affected product M MISP Published 09/10/2026 Severity Medium CVE-2026-88915MISP Event Template Instantiation Bypasses Sharing Group and Tagging Authorization Exploitation status Not known exploited Fix Affected product M MISP Published 09/10/2026 Severity High CVE-2026-86452MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding Exploitation status Not known exploited Fix Affected product M MISP Published 09/07/2026 Severity High CVE-2026-86451MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects Exploitation status Not known exploited Fix Affected product M MISP Published 09/07/2026 Severity Medium CVE-2026-86441MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data Exploitation status Not known exploited Fix Affected product M MISP Published 09/07/2026 Severity Low CVE-2026-86440MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs Exploitation status Not known exploited Fix Affected product M MISP Published 09/07/2026 Severity Medium CVE-2026-86419MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII Discovery Exploitation status Not known exploited Fix Affected product M MISP Published 09/07/2026 Severity High CVE-2026-86418MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users Exploitation status Not known exploited Fix Affected product M MISP Published 09/07/2026 Severity Low CVE-2026-86417MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Users Exploitation status Not known exploited Fix Affected product M MISP Published 09/07/2026 Severity Medium CVE-2026-86408MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected Events Exploitation status Not known exploited Fix Affected product M MISP Published 09/07/2026 Severity High CVE-2026-86351MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL Exploitation status Not known exploited Fix Affected product M MISP Published 09/07/2026 Severity Medium CVE-2026-86347MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion Exploitation status Not known exploited Fix Affected product M MISP Published 09/07/2026 Severity High CVE-2026-86342MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Information Exploitation status Not known exploited Fix Affected product M MISP Published 09/07/2026 Severity Medium CVE-2026-86283MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data Exploitation status Not known exploited Fix Affected product M MISP Published 09/06/2026 Severity High CVE-2026-85547Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP Exploitation status Not known exploited Fix Affected product M MISP Published 09/04/2026 Severity Medium CVE-2026-85546MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests Exploitation status Not known exploited Fix Affected product M MISP Published 09/04/2026 Severity High CVE-2026-85538MISP Attribute Deletion Authorization Bypass Allows Users Without Modify Permissions to Delete Attributes Exploitation status Not known exploited Fix Affected product M MISP Published 09/04/2026 Severity High CVE-2026-85533MISP Sharing Group Authorization Bypass via Omitted Distribution Parameter Exploitation status Not known exploited Fix Affected product M MISP Published 09/04/2026 Severity High CVE-2026-85239MISP Event Template Definition Validation Bypass Allows Persistent Denial of Service Exploitation status Not known exploited Fix Affected product M MISP Published 09/03/2026 Severity High CVE-2026-85238Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking Exploitation status Not known exploited Fix Affected product M MISP Published 09/03/2026 Severity High CVE-2026-85237Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass Exploitation status Not known exploited Fix Affected product M MISP Published 09/03/2026 Severity High CVE-2026-85236MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request Exploitation status Not known exploited Fix Affected product M MISP Published 09/03/2026 Severity High CVE-2026-85230MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection Exploitation status Not known exploited Fix Affected product M MISP Published 09/03/2026 Severity Medium CVE-2026-85227Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters Exploitation status Not known exploited Fix Affected product M MISP Published 09/03/2026 Severity Medium CVE-2026-85226MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations Exploitation status Not known exploited Fix Affected product M MISP Published 09/03/2026 Severity Medium CVE-2026-85221MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacks Exploitation status Not known exploited Fix Affected product M MISP Published 09/03/2026 Severity High CVE-2026-85216MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials Exploitation status Not known exploited Fix Affected product M MISP Published 09/03/2026 Severity Critical CVE-2026-77761Cross-Document Parser State Contamination in misp-stix Exploitation status Not known exploited Fix Affected product M misp-stix Published 08/21/2026 Severity Medium CVE-2026-77755Denial of Service in MISP-STIX Import via Malformed or Oversized STIX Documents in misp-stix library Exploitation status Not known exploited Fix Affected product M misp-stix Published 08/21/2026 Severity High CVE-2026-77751Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library Exploitation status Not known exploited Fix Affected product M misp-stix Published 08/21/2026 Severity High CVE-2026-77710STIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Injection in misp-stix library Exploitation status Not known exploited Fix Affected product M misp-stix Published 08/21/2026 Severity Medium CVE-2026-73162cti-transmute CSRF Allows Unauthorized Follow and Notification State Changes Exploitation status Not known exploited Fix Affected product C cti-transmute Published 08/11/2026 Severity Medium CVE-2026-73161cti-transmute Conversion Table Allows XSS via Unescaped Cell Content During Search Highlighting Exploitation status Not known exploited Fix Affected product C cti-transmute Published 08/11/2026 Severity Medium CVE-2026-73160cti-transmute Unauthenticated SSRF via Hostnames Resolving to Internal IP Addresses Exploitation status Not known exploited Fix Affected product C cti-transmute Published 08/11/2026 Severity High CVE-2026-73159cti-transmute Stored XSS via Crafted Tag Icon on Admin Triage Interface Exploitation status Not known exploited Fix Affected product C cti-transmute Published 08/11/2026 Severity Medium CVE-2026-73158cti-transmute Saved Graph Configuration Allows Stored Cross-Site Scripting via svgIcon Exploitation status Not known exploited Fix Affected product C cti-transmute Published 08/11/2026 Severity Medium CVE-2026-73157cti-transmute Remote MISP Event Browser Allows Cross-Site Scripting via Malicious Event Metadata Exploitation status Not known exploited Fix Affected product C cti-transmute Published 08/11/2026 Severity Low CVE-2026-73156cti-transmute Sunburst and Treemap Tooltips Allow Cross-Site Scripting via Crafted Conversion Data Exploitation status Not known exploited Fix Affected product C cti-transmute Published 08/11/2026 Severity Medium CVE-2026-73155cti-transmute Missing Authorization Allows Reactions to Private Comments Exploitation status Not known exploited Fix Affected product C cti-transmute Published 08/11/2026 Severity Medium CVE-2026-73140cti-transmute Evaluation Report Exports Expose Private Comments and Author Information Exploitation status Not known exploited Fix Affected product C cti-transmute Published 08/11/2026 Severity Medium CVE-2026-72760cti-transmute Following List Exposes User Email Addresses to Authenticated Users Exploitation status Not known exploited Fix Affected product C cti-transmute Published 08/10/2026 Severity Medium CVE-2026-72759cti-transmute Conversion History Authorization Bypass Leads to Sensitive Data Disclosure After Conversion Deletion Exploitation status Not known exploited Fix Affected product C cti-transmute Published 08/10/2026 Severity Medium CVE-2026-72751Stored Cross-Site Scripting in CTI-Transmute Conversion Graph via Malicious STIX/MISP Content Exploitation status Not known exploited Fix Affected product C cti-transmute Published 08/10/2026 Severity Medium CVE-2026-71502Unauthenticated Stored Vue Template Injection Leads to Cross-Site Scripting in CTI-Transmute Exploitation status Not known exploited Fix Affected product C cti-transmute Published 08/06/2026 Severity Medium CVE-2026-69082Cross-Site Request Forgery in the Administrative User Deletion Endpoint Exploitation status Not known exploited Fix Affected product C cti-transmute Published 08/03/2026 Severity High CVE-2026-69079Unauthenticated Denial of Service via Unbounded Activity-Timeline Range in CTI-Transmute Exploitation status Not known exploited Fix Affected product C cti-transmute Published 08/03/2026 Severity High CVE-2026-69078Server-Side Request Forgery and Local File Disclosure in CTI-Transmute Evaluation PDF Rendering Exploitation status Not known exploited Fix Affected product C cti-transmute Published 08/03/2026 Severity High CVE-2026-67178Open Redirect in MISP Installer-Generated Apache Configuration Exploitation status Not known exploited Fix Affected product M MISP Published 07/28/2026 Severity High CVE-2026-62143Server-Side Request Forgery protection bypass in misp-modules html_to_markdown via IPv4-mapped IPv6 addresses Exploitation status Not known exploited Fix Affected product M misp-modules Published 07/13/2026 Severity High CVE-2026-61474MISP: Improper sharing group authorization check when adding attributes Exploitation status Not known exploited Fix Affected product M MISP Published 07/09/2026 Severity Medium CVE-2026-60125importModule function in MISP ignores per-organisation import module restrictions Exploitation status Not known exploited Fix Affected product M MISP Published 07/08/2026 Severity Medium CVE-2026-60124MISP importModule missing authorization allows read-only users to modify events via misp_standard imports Exploitation status Not known exploited Fix Affected product M MISP Published 07/08/2026 Severity Medium CVE-2026-56447MISP remote code execution via arbitrary rdkafka configuration path Exploitation status Not known exploited Fix Affected product M MISP Published 06/22/2026 Severity Critical CVE-2026-56446Authenticated Remote Code Execution via Arbitrary NDJSON Error Log Path in MISP Exploitation status Not known exploited Fix Affected product M MISP Published 06/22/2026 Severity High CVE-2026-56425MISP AAD authentication plugin - Improper OAuth State Handling, Missing Session Rotation, Insecure Redirect URI Validation, and Log Injection Exploitation status Not known exploited Fix Affected product M MISP Published 06/22/2026 Severity Critical CVE-2026-56424Broken access control in MISP core allows cross-organization unauthorized modification or deletion of analyst data, event reports, collections, templates, and decaying models Exploitation status Not known exploited Fix Affected product M MISP Published 06/22/2026 Severity High CVE-2026-56423MISP Core: Broken access control allows instance-wide unauthorized deletion of event reports and sharing groups via bulk deletion endpoints Exploitation status Not known exploited Fix Affected product M MISP Published 06/22/2026 Severity Critical CVE-2026-56422MISP Core: Mass Assignment and Object Re-ownership via Unvalidated Request Fields Exploitation status Not known exploited Fix Affected product M MISP Published 06/22/2026 Severity Critical CVE-2026-54398MISP object edit authorization bypass allows unauthorized sharing group assignment Exploitation status Not known exploited Fix Affected product M MISP Published 06/12/2026 Severity Medium CVE-2026-54397MISP event editing allows unauthorized assignment to undisclosed sharing groups Exploitation status Not known exploited Fix Affected product M MISP Published 06/12/2026 Severity Medium CVE-2026-54396MISP AuthKey edit endpoint allows authenticated user email enumeration Exploitation status Not known exploited Fix Affected product M MISP Published 06/12/2026 Severity Medium CVE-2026-54395MISP UiBeta event index reflected XSS in advanced filter popup Exploitation status Not known exploited Fix Affected product M MISP Published 06/12/2026 Severity Medium CVE-2026-54394MISP organisation logo path traversal allows retrieval of arbitrary PNG/SVG files Exploitation status Not known exploited Fix Affected product M MISP Published 06/12/2026 Severity Medium CVE-2026-54393MISP Overmind theme stored XSS via unvalidated homepage setting Exploitation status Not known exploited Fix Affected product M MISP Published 06/12/2026 Severity Medium CVE-2026-54362MISP template builder exposes non-visible custom galaxies across organisations Exploitation status Not known exploited Fix Affected product M MISP Published 06/12/2026 Severity Medium CVE-2026-54361MISP mass assignment vulnerabilities allow unauthorized modification of ownership and delegation records Exploitation status Not known exploited Fix Affected product M MISP Published 06/12/2026 Severity High CVE-2026-54360MISP sharing group creation mass assignment allows unauthorized takeover of existing sharing groups Exploitation status Not known exploited Fix Affected product M MISP Published 06/12/2026 Severity High CVE-2026-54359MISP automation endpoints may be exposed to CSRF when Sec-Fetch-Site protection is disabled by default Exploitation status Not known exploited Fix Affected product M MISP Published 06/12/2026 Severity High CVE-2026-54358MISP organization administrators can target site administrator accounts for password reset Exploitation status Not known exploited Fix Affected product M MISP Published 06/12/2026 Severity High CVE-2026-54357MISP improper authorization allows organization administrators to modify site administrator user settings Exploitation status Not known exploited Fix Affected product M MISP Published 06/12/2026 Severity Medium CVE-2026-53693MISP BSimVis stored cross-site scripting in tag and cluster rendering paths via unescaped tag metadata and UI labels Exploitation status Not known exploited Fix Affected product B bsimvis Published 06/10/2026 Severity Medium CVE-2026-10868MISP user edit endpoint mass assignment vulnerability allows unauthorized user account modification Exploitation status Not known exploited Fix Affected product M MISP Published 06/04/2026 Severity Critical CVE-2026-10864MISP Dashboard widget field selection may expose restricted user and organisation data Exploitation status Not known exploited Fix Affected product M MISP Published 06/04/2026 Severity Medium CVE-2026-10863MISP User-controlled order parameter in correlations over-correlation endpoint Exploitation status Not known exploited Fix Affected product M MISP Published 06/04/2026 Severity Medium CVE-2026-10860MISP CRUDComponent delete validation bypass via operator precedence error Exploitation status Not known exploited Fix Affected product M MISP Published 06/04/2026 Severity High CVE-2026-10861MISP post-login open redirect via pre_login_requested_url Exploitation status Not known exploited Fix Affected product M MISP Published 06/04/2026 Severity Medium CVE-2026-10856Open redirect in MISP dashboard button widget URL handling Exploitation status Not known exploited Fix Affected product M MISP Published 06/04/2026 Severity Medium CVE-2026-10855MISP Event template importer authorization bypass Exploitation status Not known exploited Fix Affected product M MISP Published 06/04/2026 Severity Medium CVE-2026-10854Unauthorized exposure of private galaxies in MISP event template creation Exploitation status Not known exploited Fix Affected product M MISP Published 06/04/2026 Severity Medium CVE-2026-10611OTP bypass via plugin-based LDAP authentication in MISP when LDAP mixed authentication is enabled Exploitation status Not known exploited Fix Affected product M MISP Published 06/02/2026 Severity High CVE-2026-9806Stored Cross-Site Scripting (XSS) in CTI Transmute Notification Panel via Malicious Convert Names Exploitation status Not known exploited Fix Affected product Not confirmed Published 05/28/2026 Severity Medium CVE-2026-9137CSP Report Endpoint Log Flooding in MISP via Incorrect Size Limit Exploitation status Not known exploited Fix Affected product M MISP Published 05/20/2026 Severity Medium CVE-2026-9136Unauthorized ShadowAttribute modification in MISP via client-supplied identifier Exploitation status Not known exploited Fix Affected product M MISP Published 05/20/2026 Severity High CVE-2026-9084MISP OIDC authentication bypass via automatic email-based account linking under insecure IdP configurations Exploitation status Not known exploited Fix Affected product M MISP Published 05/20/2026 Severity Medium CVE-2026-44379MISP: Improper UUID validation in MISP Collections Exploitation status Not known exploited Fix Affected product M MISP Published 05/13/2026 Severity Medium CVE-2026-44380MISP: Improper access control in auth key reset allows privilege escalation to site administrator Exploitation status Not known exploited Fix Affected product M MISP Published 05/13/2026 Severity High CVE-2026-44381MISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listings Exploitation status Not known exploited Fix Affected product M MISP Published 05/13/2026 Severity Critical CVE-2026-44363Unsafe remote resource fetching in expansion misp-modules Exploitation status Not known exploited Fix Affected product M misp-modules Published 05/13/2026 Severity Medium CVE-2026-44364misp-modules website - Missing CSRF protection in the website home blueprint Exploitation status Not known exploited Fix Affected product M misp-modules Published 05/13/2026 Severity Critical CVE-2026-8080MISP core - Stored XSS in MISP template (old engine) element attribute type Exploitation status Not known exploited Fix Affected product M MISP Published 05/07/2026 Severity Medium CVE-2026-39962LDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variable Exploitation status Not known exploited Fix Affected product M MISP Published 04/09/2026 Severity High CVE-2025-67906Exploitation status Public exploit Fix Affected product M MISP Published 12/15/2025 Severity Medium CVE-2025-66384Exploitation status Not known exploited Fix Affected product M MISP Published 11/28/2025 Severity High CVE-2025-66386Exploitation status Not known exploited Fix Affected product M MISP Published 11/28/2025 Severity Medium CVE-2024-58130Exploitation status Not known exploited Fix Affected product M MISP Published 03/28/2025 Severity High CVE-2024-58128Exploitation status Not known exploited Fix Affected product M MISP Published 03/28/2025 Severity Medium CVE-2024-58129Exploitation status Not known exploited Fix Affected product M MISP Published 03/28/2025 Severity Medium CVE-2024-57969Exploitation status Not known exploited Fix Affected product M MISP Published 02/14/2025 Severity Medium CVE-2024-46918Exploitation status Not known exploited Fix Not confirmed Affected product Not confirmed Published 09/15/2024 Severity Critical CVE-2024-45509Exploitation status Not known exploited Fix Not confirmed Affected product Not confirmed Published 09/01/2024 Severity Critical 
