Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

MISP — Vulnerabilities & Security Advisories 183

Browse all 183 CVE security advisories affecting MISP. AI-powered Chinese analysis, POCs, and references for each vulnerability.

MISP is an open-source threat intelligence platform designed for sharing cyber threat information between organizations. Historically, vulnerabilities in MISP have included remote code execution, cross-site scripting, and privilege escalation flaws, often stemming from improper input validation or access control issues. The platform's security characteristics emphasize collaborative information sharing, though past incidents have highlighted risks in default configurations and plugin vulnerabilities. With 9 CVEs on record, MISP remains widely adopted for threat intelligence sharing, requiring proper hardening and regular updates to mitigate potential exploitation risks. Organizations should implement strict access controls and validate all shared data to prevent misuse.

CVE ID Title CVSS Severity Published
CVE-2026-54361 MISP mass assignment vulnerabilities allow unauthorized modification of ownership and delegation records — misp CWE-639 - - 2026-06-12
CVE-2026-54360 MISP sharing group creation mass assignment allows unauthorized takeover of existing sharing groups — misp CWE-639 - - 2026-06-12
CVE-2026-54359 MISP automation endpoints may be exposed to CSRF when Sec-Fetch-Site protection is disabled by default — misp CWE-352 - - 2026-06-12
CVE-2026-54358 MISP organization administrators can target site administrator accounts for password reset — misp CWE-863 - - 2026-06-12
CVE-2026-54357 MISP improper authorization allows organization administrators to modify site administrator user settings — misp CWE-863 - - 2026-06-12
CVE-2026-53693 MISP BSimVis stored cross-site scripting in tag and cluster rendering paths via unescaped tag metadata and UI labels — bsimvis CWE-79 - - 2026-06-10
CVE-2026-10868 MISP user edit endpoint mass assignment vulnerability allows unauthorized user account modification — misp CWE-269 - - 2026-06-04
CVE-2026-10864 MISP Dashboard widget field selection may expose restricted user and organisation data — misp CWE-200 - - 2026-06-04
CVE-2026-10863 MISP User-controlled order parameter in correlations over-correlation endpoint — misp CWE-20 - - 2026-06-04
CVE-2026-10860 MISP CRUDComponent delete validation bypass via operator precedence error — misp CWE-863 - - 2026-06-04
CVE-2026-10861 MISP post-login open redirect via pre_login_requested_url — misp CWE-601 - - 2026-06-04
CVE-2026-10856 Open redirect in MISP dashboard button widget URL handling — misp CWE-601 - - 2026-06-04
CVE-2026-10855 MISP Event template importer authorization bypass — misp CWE-862 - - 2026-06-04
CVE-2026-10854 Unauthorized exposure of private galaxies in MISP event template creation — misp CWE-200 - - 2026-06-04
CVE-2026-10611 OTP bypass via plugin-based LDAP authentication in MISP when LDAP mixed authentication is enabled — misp CWE-287 - - 2026-06-02
CVE-2026-9806 Stored Cross-Site Scripting (XSS) in CTI Transmute Notification Panel via Malicious Convert Names — cti-transmute CWE-79 - - 2026-05-28
CVE-2026-9137 CSP Report Endpoint Log Flooding in MISP via Incorrect Size Limit — misp CWE-400 - - 2026-05-20
CVE-2026-9136 Unauthorized ShadowAttribute modification in MISP via client-supplied identifier — misp CWE-639 - - 2026-05-20
CVE-2026-9084 MISP OIDC authentication bypass via automatic email-based account linking under insecure IdP configurations — misp CWE-287 - - 2026-05-20
CVE-2026-44379 MISP: Improper UUID validation in MISP Collections — MISP CWE-20 - - 2026-05-13
CVE-2026-44380 MISP: Improper access control in auth key reset allows privilege escalation to site administrator — MISP CWE-863 - - 2026-05-13
CVE-2026-44381 MISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listings — MISP CWE-89 - - 2026-05-13
CVE-2026-44363 Unsafe remote resource fetching in expansion misp-modules — misp-modules CWE-295 - - 2026-05-13
CVE-2026-44364 misp-modules website - Missing CSRF protection in the website home blueprint — misp-modules CWE-352 - - 2026-05-13
CVE-2026-8080 MISP core - Stored XSS in MISP template (old engine) element attribute type — misp CWE-79 5.4AI Medium AI 2026-05-07
CVE-2026-39962 LDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variable — MISP CWE-90 8.2AI High AI 2026-04-09
CVE-2025-67906 MISP 安全漏洞 — MISP CWE-79 5.4 Medium 2025-12-15
CVE-2025-66386 MISP 安全漏洞 — MISP CWE-23 4.1 Medium 2025-11-28
CVE-2025-66384 MISP 安全漏洞 — MISP CWE-684 8.2 High 2025-11-28
CVE-2024-58128 MISP 安全漏洞 — MISP CWE-79 5.5 Medium 2025-03-28

This page lists every published CVE security advisory associated with MISP. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.