Vulnerabilidades en MISP
182 resultadosCVE-2026-85221HIGHMISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle AttacksEPSS 0.3%CVE-2026-112188HIGHMISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name ResolutionEPSS 0.3%CVE-2026-86417MEDIUMMISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized UsersEPSS 0.3%CVE-2026-86418LOWMISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized UsersEPSS 0.3%CVE-2026-69082HIGHCross-Site Request Forgery in the Administrative User Deletion EndpointEPSS 0.3%CVE-2026-86451MEDIUMMISP Event Graph Object Reference Lookup Exposes References from Unauthorized ObjectsEPSS 0.3%CVE-2026-95658MEDIUMMISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution of workflow modulesEPSS 0.3%CVE-2026-90893MEDIUMMISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle EndpointsEPSS 0.3%CVE-2026-54361HIGHMISP mass assignment vulnerabilities allow unauthorized modification of ownership and delegation recordsEPSS 0.3%CVE-2026-86351MEDIUMMISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URLEPSS 0.3%CVE-2026-9806MEDIUMStored Cross-Site Scripting (XSS) in CTI Transmute Notification Panel via Malicious Convert NamesEPSS 0.3%CVE-2024-57969MEDIUMapp/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search.EPSS 0.3%CVE-2026-54395MEDIUMMISP UiBeta event index reflected XSS in advanced filter popupEPSS 0.3%CVE-2026-103239HIGHMISP Tag Collection Save Allows Privilege Escalation via Sibling Model InjectionEPSS 0.3%CVE-2026-85226MEDIUMMISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted CorrelationsEPSS 0.3%CVE-2026-54357MEDIUMMISP improper authorization allows organization administrators to modify site administrator user settingsEPSS 0.3%CVE-2026-85227MEDIUMReflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes ParametersEPSS 0.3%CVE-2026-85236HIGHMISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET RequestEPSS 0.3%CVE-2026-107278MEDIUMMISP Object Sync Drops Objects and Attributes When Description Is EmptyEPSS 0.3%CVE-2026-73162MEDIUMcti-transmute CSRF Allows Unauthorized Follow and Notification State ChangesEPSS 0.2%