Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

MISP — Vulnerabilities & Security Advisories 183

Browse all 183 CVE security advisories affecting MISP. AI-powered Chinese analysis, POCs, and references for each vulnerability.

MISP is an open-source threat intelligence platform designed for sharing cyber threat information between organizations. Historically, vulnerabilities in MISP have included remote code execution, cross-site scripting, and privilege escalation flaws, often stemming from improper input validation or access control issues. The platform's security characteristics emphasize collaborative information sharing, though past incidents have highlighted risks in default configurations and plugin vulnerabilities. With 9 CVEs on record, MISP remains widely adopted for threat intelligence sharing, requiring proper hardening and regular updates to mitigate potential exploitation risks. Organizations should implement strict access controls and validate all shared data to prevent misuse.

CVE ID Title CVSS Severity Published
CVE-2026-94394 MISP ObjectReferencesController: Granular Distribution and Sharing Group Restrictions Bypassed When Adding Object References — MISP CWE-862 6.3 Medium 2026-09-21
CVE-2026-94393 MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport — MISP CWE-639 6.4 Medium 2026-09-21
CVE-2026-94383 MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension — MISP CWE-434 8.6 High 2026-09-21
CVE-2026-94381 MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTime — MISP CWE-269 8.7 High 2026-09-21
CVE-2026-94379 MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP) — MISP CWE-20 6.9 Medium 2026-09-21
CVE-2026-94374 MISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events' Reports — MISP CWE-639 8.3 High 2026-09-21
CVE-2026-94373 MISP DOM-based Cross-Site Scripting via innerHTML in Contextual Menu — MISP CWE-79 6.3 Medium 2026-09-21
CVE-2026-94372 Stored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies Index — MISP CWE-79 6.3 Medium 2026-09-21
CVE-2026-94277 Stored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy Name — MISP CWE-79 6.3 Medium 2026-09-21
CVE-2026-93296 MISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics Legends — misp CWE-79 8.5 High 2026-09-17
CVE-2026-93295 MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution — misp CWE-74 8.7 High 2026-09-17
CVE-2026-92932 MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabled — sachertortephp CWE-918 5.1 Medium 2026-09-17
CVE-2026-92003 MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion — MISP CWE-770 6.9 Medium 2026-09-15
CVE-2026-92002 MISP: Authentication failure logging suppressed during Redis unavailability — MISP CWE-778 5.1 Medium 2026-09-15
CVE-2026-91859 MISP Access Log Entry Overwritten by Error Controller's Second beforeFilter Pass — MISP CWE-778 5.3 Medium 2026-09-15
CVE-2026-91857 MISP: State-changing actions accessible via GET request enabling CSRF — MISP CWE-352 5.3 Medium 2026-09-15
CVE-2026-91851 MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag Comparison — MISP CWE-863 5.3 Medium 2026-09-15
CVE-2026-91846 MISP Collection Element Add Missing Authorization on Referenced Object UUID — MISP CWE-862 7.1 High 2026-09-15
CVE-2026-91825 MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit — MISP CWE-862 7.1 High 2026-09-15
CVE-2026-91819 MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent — MISP CWE-352 6.9 Medium 2026-09-15
CVE-2026-90961 MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentials — MISP CWE-287 9.3 Critical 2026-09-14
CVE-2026-90957 MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures — MISP CWE-79 5.1 Medium 2026-09-14
CVE-2026-90955 MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load — MISP CWE-778 4.6 Medium 2026-09-14
CVE-2026-90895 MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection — MISP CWE-862 8.4 High 2026-09-14
CVE-2026-90893 MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints — MISP CWE-352 5.1 Medium 2026-09-14
CVE-2026-88921 MISP: Unescaped HTML Injection in PDF Report Element Rendering — MISP CWE-79 5.1 Medium 2026-09-10
CVE-2026-88915 MISP Event Template Instantiation Bypasses Sharing Group and Tagging Authorization — MISP CWE-862 7.1 High 2026-09-10
CVE-2026-86452 MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding — MISP CWE-400 8.7 High 2026-09-07
CVE-2026-86451 MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects — MISP CWE-639 5.3 Medium 2026-09-07
CVE-2026-86441 MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data — MISP CWE-862 2.3 Low 2026-09-07

This page lists every published CVE security advisory associated with MISP. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.