Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

MISP — Vulnerabilities & Security Advisories 150

All 150 CVE vulnerabilities found in MISP, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security weaknesses specifically affecting the MISP threat intelligence platform developed by the MISP Project. The collection encompasses a comprehensive range of reported issues, including remote code execution, privilege escalation, and information disclosure vulnerabilities, covering the historical timeline from the product's initial release to the most recent security updates. Visitors can utilize this resource to track official vendor advisories regarding MISP, analyze the prevalence and characteristics of specific weakness classes within the ecosystem, or review the complete vulnerability history of the platform to assess long-term security posture. By centralizing these data points, the page serves as a factual reference for security professionals, system administrators, and researchers seeking to understand the evolving risk landscape associated with MISP deployments. The information presented is derived from public disclosures and vendor communications, ensuring that users can make informed decisions about patching and mitigation strategies without relying on fragmented sources. This aggregation supports proactive defense measures by highlighting recurring patterns in how MISP has been targeted or exposed to flaws over time. Users are encouraged to cross-reference the listed weaknesses with their specific deployment configurations to determine applicable risks and necessary remediation steps for their environments.

Vendor: MISP

CVE ID Title CVSS Severity Published
CVE-2026-103237 MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows CWE-639 8.3 High 2026-09-30
CVE-2026-103235 MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Events CWE-915 8.7 High 2026-09-30
CVE-2026-95806 MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths CWE-502 7.7 High 2026-09-22
CVE-2026-95805 MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restriction CWE-285 5.3 Medium 2026-09-22
CVE-2026-95754 MISP: Disabled-user check ineffective in pre-authentication TOTP login branch CWE-285 6.9 Medium 2026-09-22
CVE-2026-95703 MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_name CWE-200 5.1 Medium 2026-09-22
CVE-2026-95701 MISP Path Traversal via Organization Name in Org-Statistics Logo Check CWE-22 5.1 Medium 2026-09-22
CVE-2026-95698 MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name CWE-22 5.3 Medium 2026-09-22
CVE-2026-95697 MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Metadata CWE-862 5.3 Medium 2026-09-22
CVE-2026-95693 MISP Information Disclosure via Forged Upload Path CWE-200 5.3 Medium 2026-09-22
CVE-2026-95685 MISP Missing Authorization on replaceSuggestionInReport Event Report Action CWE-862 5.3 Medium 2026-09-22
CVE-2026-95683 MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL CWE-862 5.3 Medium 2026-09-22
CVE-2026-95682 MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View CWE-79 4.8 Medium 2026-09-22
CVE-2026-95679 MISP Unauthenticated Blind SSRF via XML Body Processing CWE-918 6.9 Medium 2026-09-22
CVE-2026-95674 MISP EventsController queryEnrichment allows querying unavailable or legacy modules without validation CWE-20 5.3 Medium 2026-09-22
CVE-2026-95671 MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add CWE-862 5.3 Medium 2026-09-22
CVE-2026-95667 MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials CWE-732 6.9 Medium 2026-09-22
CVE-2026-95665 MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON CWE-79 5.1 Medium 2026-09-22
CVE-2026-95661 MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type List CWE-79 5.1 Medium 2026-09-22
CVE-2026-95659 MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread CWE-79 4.8 Medium 2026-09-22
CVE-2026-95658 MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution of workflow modules CWE-352 6.9 Medium 2026-09-22
CVE-2026-94404 MISP CSRF vulnerability allows unauthorized attribute modification CWE-352 7.1 High 2026-09-21
CVE-2026-94401 MISP Arbitrary Local File Read and SSRF via MISP Export Upload CWE-918 8.3 High 2026-09-21
CVE-2026-94394 MISP ObjectReferencesController: Granular Distribution and Sharing Group Restrictions Bypassed When Adding Object References CWE-862 6.3 Medium 2026-09-21
CVE-2026-94393 MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport CWE-639 6.4 Medium 2026-09-21
CVE-2026-94383 MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension CWE-434 8.6 High 2026-09-21
CVE-2026-94381 MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTime CWE-269 8.7 High 2026-09-21
CVE-2026-94379 MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP) CWE-20 6.9 Medium 2026-09-21
CVE-2026-94374 MISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events' Reports CWE-639 8.3 High 2026-09-21
CVE-2026-94373 MISP DOM-based Cross-Site Scripting via innerHTML in Contextual Menu CWE-79 6.3 Medium 2026-09-21

All 150 known CVE vulnerabilities affecting MISP with full Chinese analysis, references, and POCs where available.