Vulnerabilidades en MISP
182 resultadosCVE-2026-112180MEDIUMMISP Incomplete Event Deletion Leaves Orphaned Sensitive RecordsEPSS 0.3%CVE-2025-67906MEDIUMIn MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path.EPSS 0.3%CVE-2025-66386MEDIUMapp/Model/EventReport.php in MISP before 2.5.27 allows path traversal in view picture for a site-admin.EPSS 0.3%CVE-2026-106512HIGHMISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSSEPSS 0.3%CVE-2026-112991MEDIUMMISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()EPSS 0.3%CVE-2026-97863MEDIUMmisp-modules: Shell Command Injection in MISP cisco_firesight_manager_ACL_rule_export Module via Unescaped Attribute ValuesEPSS 0.3%CVE-2026-54394MEDIUMMISP organisation logo path traversal allows retrieval of arbitrary PNG/SVG filesEPSS 0.3%CVE-2026-104901MEDIUMMISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked ServerEPSS 0.3%CVE-2026-107180HIGHMISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required InstancesEPSS 0.3%CVE-2026-112179MEDIUMMISP Event Synchronization Exposes Non-Exportable Tags on Remote InstancesEPSS 0.3%CVE-2026-103664MEDIUMMISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed ParameterEPSS 0.3%CVE-2026-103389MEDIUMMISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation GraphEPSS 0.3%CVE-2026-118173MEDIUMMISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy Tags to Bypass Feed Policy EnforcementEPSS 0.3%CVE-2026-85230MEDIUMMISP Dashboard Button Widget Allows Persistent JavaScript URL InjectionEPSS 0.3%CVE-2026-112183MEDIUMMISP CSS Injection via Remote Tag Colour in Event PreviewEPSS 0.3%CVE-2026-104908HIGHMISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default FlaggingEPSS 0.3%CVE-2026-86441LOWMISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation DataEPSS 0.3%CVE-2026-104910MEDIUMMISP Information Disclosure via Related Events Listing Bypassing Per-Event AuthorizationEPSS 0.3%CVE-2026-53693MEDIUMMISP BSimVis stored cross-site scripting in tag and cluster rendering paths via unescaped tag metadata and UI labelsEPSS 0.3%CVE-2026-103235HIGHMISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary EventsEPSS 0.3%