Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

MISP — Vulnerabilities & Security Advisories 183

Browse all 183 CVE security advisories affecting MISP. AI-powered Chinese analysis, POCs, and references for each vulnerability.

MISP is an open-source threat intelligence platform designed for sharing cyber threat information between organizations. Historically, vulnerabilities in MISP have included remote code execution, cross-site scripting, and privilege escalation flaws, often stemming from improper input validation or access control issues. The platform's security characteristics emphasize collaborative information sharing, though past incidents have highlighted risks in default configurations and plugin vulnerabilities. With 9 CVEs on record, MISP remains widely adopted for threat intelligence sharing, requiring proper hardening and regular updates to mitigate potential exploitation risks. Organizations should implement strict access controls and validate all shared data to prevent misuse.

CVE ID Title CVSS Severity Published
CVE-2026-125871 MISP sourcecache module SSRF allows fetching arbitrary internal URLs via attribute enrichment — misp-modules CWE-918 6.3 Medium 2026-11-10
CVE-2026-118173 MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy Tags to Bypass Feed Policy Enforcement — misp-guard CWE-20 6.1 Medium 2026-10-27
CVE-2026-116469 MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding — misp-guard CWE-178 7.1 High 2026-10-26
CVE-2026-116372 MISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rules — misp-guard CWE-20 7.7 High 2026-10-26
CVE-2026-112991 MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url() — misp-modules CWE-918 6.3 Medium 2026-10-19
CVE-2026-112192 MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings — MISP CWE-200 5.3 Medium 2026-10-19
CVE-2026-112188 MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution — MISP CWE-200 7.1 High 2026-10-19
CVE-2026-112184 MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels — MISP CWE-79 4.8 Medium 2026-10-19
CVE-2026-112183 MISP CSS Injection via Remote Tag Colour in Event Preview — MISP CWE-74 4.8 Medium 2026-10-19
CVE-2026-112180 MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records — MISP CWE-459 5.1 Medium 2026-10-19
CVE-2026-112179 MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances — MISP CWE-200 5.3 Medium 2026-10-19
CVE-2026-112178 MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control — MISP CWE-862 7.1 High 2026-10-19
CVE-2026-107278 MISP Object Sync Drops Objects and Attributes When Description Is Empty — MISP CWE-20 5.3 Medium 2026-10-07
CVE-2026-107276 MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests — MISP CWE-362 6.3 Medium 2026-10-07
CVE-2026-107180 MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances — MISP CWE-287 7.1 High 2026-10-07
CVE-2026-107175 MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes — MISP CWE-284 5.3 Medium 2026-10-07
CVE-2026-106513 MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change — MISP CWE-284 6.9 Medium 2026-10-06
CVE-2026-106512 MISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSS — sachertortephp CWE-113 8.4 High 2026-10-06
CVE-2026-104914 MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View — MISP CWE-862 5.3 Medium 2026-10-02
CVE-2026-104912 MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data — MISP CWE-862 7.1 High 2026-10-02
CVE-2026-104910 MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization — MISP CWE-862 5.3 Medium 2026-10-02
CVE-2026-104908 MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging — MISP CWE-915 7.1 High 2026-10-02
CVE-2026-104907 MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler — MISP CWE-79 4.8 Medium 2026-10-02
CVE-2026-104906 MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output — MISP CWE-79 6.2 Medium 2026-10-02
CVE-2026-104901 MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server — MISP CWE-79 5.1 Medium 2026-10-02
CVE-2026-104900 MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview Index — MISP CWE-79 5.3 Medium 2026-10-02
CVE-2026-103858 MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions — MISP CWE-285 5.3 Medium 2026-10-01
CVE-2026-103664 MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter — MISP CWE-79 4.8 Medium 2026-10-01
CVE-2026-103662 MISP Reflected XSS in Taxonomy Tag Confirmation Forms — MISP CWE-79 5.1 Medium 2026-10-01
CVE-2026-103659 MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes — MISP CWE-862 7.1 High 2026-10-01

This page lists every published CVE security advisory associated with MISP. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.