Vulnerabilities in misp
145 resultsVexday analysis
MISP apresenta 37 vulnerabilidades catalogadas, todas publicadas nos últimos 90 dias, com 5 classificadas como críticas (CVSS alto). Não há registros de exploração ativa em campo (KEV), mas o volume recente e a dominância de falhas de autorização (CWE-863) indicam exposição significativa em ambientes de compartilhamento de inteligência de ameaças. Recomenda-se priorizar patches críticos e revisar controles de acesso.
CVE-2026-94277MEDIUMStored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy NameEPSS 0.4%CVE-2026-73161MEDIUMcti-transmute Conversion Table Allows XSS via Unescaped Cell Content During Search HighlightingEPSS 0.4%CVE-2026-73159MEDIUMcti-transmute Stored XSS via Crafted Tag Icon on Admin Triage InterfaceEPSS 0.4%CVE-2026-95806HIGHMISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem pathsEPSS 0.4%CVE-2026-95659MEDIUMMISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind ThreadEPSS 0.4%CVE-2026-94373MEDIUMMISP DOM-based Cross-Site Scripting via innerHTML in Contextual MenuEPSS 0.4%CVE-2026-93296HIGHMISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics LegendsEPSS 0.4%CVE-2026-94372MEDIUMStored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies IndexEPSS 0.4%CVE-2026-91825HIGHMISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During EditEPSS 0.4%CVE-2026-95683MEDIUMMISP Overmind Event View Discloses Report Content Bypassing Report-Level ACLEPSS 0.4%CVE-2026-92932MEDIUMMISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is DisabledEPSS 0.4%CVE-2026-54358HIGHMISP organization administrators can target site administrator accounts for password resetEPSS 0.4%CVE-2026-72760MEDIUMcti-transmute Following List Exposes User Email Addresses to Authenticated UsersEPSS 0.4%CVE-2026-54396MEDIUMMISP AuthKey edit endpoint allows authenticated user email enumerationEPSS 0.4%CVE-2026-95697MEDIUMMISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization MetadataEPSS 0.4%CVE-2026-94401HIGHMISP Arbitrary Local File Read and SSRF via MISP Export UploadEPSS 0.4%CVE-2026-60124MEDIUMMISP importModule missing authorization allows read-only users to modify events via misp_standard importsEPSS 0.4%CVE-2026-94393MEDIUMMISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReportEPSS 0.4%CVE-2026-85533HIGHMISP Sharing Group Authorization Bypass via Omitted Distribution ParameterEPSS 0.4%CVE-2026-94374HIGHMISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events' ReportsEPSS 0.4%