Vulnerabilities in misp
182 resultsCVE-2026-95682MEDIUMMISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email ViewEPSS 0.4%CVE-2026-86419HIGHMISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII DiscoveryEPSS 0.4%CVE-2026-85538HIGHMISP Attribute Deletion Authorization Bypass Allows Users Without Modify Permissions to Delete AttributesEPSS 0.4%CVE-2026-95805MEDIUMMISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restrictionEPSS 0.4%CVE-2026-61474MEDIUMMISP: Improper sharing group authorization check when adding attributesEPSS 0.4%CVE-2026-69078HIGHServer-Side Request Forgery and Local File Disclosure in CTI-Transmute Evaluation PDF RenderingEPSS 0.4%CVE-2026-73160HIGHcti-transmute Unauthenticated SSRF via Hostnames Resolving to Internal IP AddressesEPSS 0.4%CVE-2026-95674MEDIUMMISP EventsController queryEnrichment allows querying unavailable or legacy modules without validationEPSS 0.4%CVE-2026-62143HIGHServer-Side Request Forgery protection bypass in misp-modules html_to_markdown via IPv4-mapped IPv6 addressesEPSS 0.4%CVE-2026-44380HIGHMISP: Improper access control in auth key reset allows privilege escalation to site administratorEPSS 0.4%CVE-2026-73159MEDIUMcti-transmute Stored XSS via Crafted Tag Icon on Admin Triage InterfaceEPSS 0.4%CVE-2026-73161MEDIUMcti-transmute Conversion Table Allows XSS via Unescaped Cell Content During Search HighlightingEPSS 0.4%CVE-2026-90957MEDIUMMISP: Stored XSS via Inline-Served SVG Organisation Logos and Report PicturesEPSS 0.4%CVE-2026-94277MEDIUMStored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy NameEPSS 0.4%CVE-2026-73158MEDIUMcti-transmute Saved Graph Configuration Allows Stored Cross-Site Scripting via svgIconEPSS 0.4%CVE-2026-95806HIGHMISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem pathsEPSS 0.4%CVE-2026-94373MEDIUMMISP DOM-based Cross-Site Scripting via innerHTML in Contextual MenuEPSS 0.4%CVE-2026-95659MEDIUMMISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind ThreadEPSS 0.4%CVE-2026-103655CRITICALMISP TOTP Code Replay Allows Duplicate Authentication Within Validity PeriodEPSS 0.4%CVE-2026-93296HIGHMISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics LegendsEPSS 0.4%