Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

MISP — Vulnerabilities & Security Advisories 150

All 150 CVE vulnerabilities found in MISP, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security weaknesses specifically affecting the MISP threat intelligence platform developed by the MISP Project. The collection encompasses a comprehensive range of reported issues, including remote code execution, privilege escalation, and information disclosure vulnerabilities, covering the historical timeline from the product's initial release to the most recent security updates. Visitors can utilize this resource to track official vendor advisories regarding MISP, analyze the prevalence and characteristics of specific weakness classes within the ecosystem, or review the complete vulnerability history of the platform to assess long-term security posture. By centralizing these data points, the page serves as a factual reference for security professionals, system administrators, and researchers seeking to understand the evolving risk landscape associated with MISP deployments. The information presented is derived from public disclosures and vendor communications, ensuring that users can make informed decisions about patching and mitigation strategies without relying on fragmented sources. This aggregation supports proactive defense measures by highlighting recurring patterns in how MISP has been targeted or exposed to flaws over time. Users are encouraged to cross-reference the listed weaknesses with their specific deployment configurations to determine applicable risks and necessary remediation steps for their environments.

Vendor: MISP

CVE ID Title CVSS Severity Published
CVE-2026-112192 MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings CWE-200 5.3 Medium 2026-10-19
CVE-2026-112188 MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution CWE-200 7.1 High 2026-10-19
CVE-2026-112184 MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels CWE-79 4.8 Medium 2026-10-19
CVE-2026-112183 MISP CSS Injection via Remote Tag Colour in Event Preview CWE-74 4.8 Medium 2026-10-19
CVE-2026-112180 MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records CWE-459 5.1 Medium 2026-10-19
CVE-2026-112179 MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances CWE-200 5.3 Medium 2026-10-19
CVE-2026-112178 MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control CWE-862 7.1 High 2026-10-19
CVE-2026-107278 MISP Object Sync Drops Objects and Attributes When Description Is Empty CWE-20 5.3 Medium 2026-10-07
CVE-2026-107276 MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests CWE-362 6.3 Medium 2026-10-07
CVE-2026-107180 MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances CWE-287 7.1 High 2026-10-07
CVE-2026-107175 MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes CWE-284 5.3 Medium 2026-10-07
CVE-2026-106513 MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change CWE-284 6.9 Medium 2026-10-06
CVE-2026-104914 MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View CWE-862 5.3 Medium 2026-10-02
CVE-2026-104912 MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data CWE-862 7.1 High 2026-10-02
CVE-2026-104910 MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization CWE-862 5.3 Medium 2026-10-02
CVE-2026-104908 MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging CWE-915 7.1 High 2026-10-02
CVE-2026-104907 MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler CWE-79 4.8 Medium 2026-10-02
CVE-2026-104906 MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output CWE-79 6.2 Medium 2026-10-02
CVE-2026-104901 MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server CWE-79 5.1 Medium 2026-10-02
CVE-2026-104900 MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview Index CWE-79 5.3 Medium 2026-10-02
CVE-2026-103858 MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions CWE-285 5.3 Medium 2026-10-01
CVE-2026-103664 MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter CWE-79 4.8 Medium 2026-10-01
CVE-2026-103662 MISP Reflected XSS in Taxonomy Tag Confirmation Forms CWE-79 5.1 Medium 2026-10-01
CVE-2026-103659 MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes CWE-862 7.1 High 2026-10-01
CVE-2026-103655 MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period CWE-294 9.3 Critical 2026-10-01
CVE-2026-103651 MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypass CWE-362 7.6 High 2026-10-01
CVE-2026-103389 MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation Graph CWE-79 6.2 Medium 2026-09-30
CVE-2026-103388 MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field CWE-79 6.2 Medium 2026-09-30
CVE-2026-103321 MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image CWE-79 8.3 High 2026-09-30
CVE-2026-103239 MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection CWE-284 8.6 High 2026-09-30

All 150 known CVE vulnerabilities affecting MISP with full Chinese analysis, references, and POCs where available.