Vulnerabilidades en MISP
182 resultadosCVE-2026-54396MEDIUMMISP AuthKey edit endpoint allows authenticated user email enumerationEPSS 0.2%CVE-2026-103388MEDIUMMISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source FieldEPSS 0.2%CVE-2026-10868CRITICALMISP user edit endpoint mass assignment vulnerability allows unauthorized user account modificationEPSS 0.2%CVE-2026-86440MEDIUMMISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLsEPSS 0.2%CVE-2024-58130HIGHIn app/Controller/Component/RestResponseComponent.php in MISP before 2.4.193, REST endpoints have a lack of sanitization for non-JSON responEPSS 0.2%CVE-2026-103237HIGHMISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant RowsEPSS 0.2%CVE-2026-112178HIGHMISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access ControlEPSS 0.2%CVE-2026-9136HIGHUnauthorized ShadowAttribute modification in MISP via client-supplied identifierEPSS 0.2%CVE-2026-54358HIGHMISP organization administrators can target site administrator accounts for password resetEPSS 0.2%CVE-2026-103659HIGHMISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only AttributesEPSS 0.2%CVE-2024-58128MEDIUMIn MISP before 2.4.193, menu_custom_right_link parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin EPSS 0.2%CVE-2024-58129MEDIUMIn MISP before 2.4.193, menu_custom_right_link_html parameters can be set via the UI (i.e., without using the CLI) and thus attackers with aEPSS 0.2%CVE-2026-54360HIGHMISP sharing group creation mass assignment allows unauthorized takeover of existing sharing groupsEPSS 0.2%CVE-2026-54397MEDIUMMISP event editing allows unauthorized assignment to undisclosed sharing groupsEPSS 0.2%CVE-2026-10863MEDIUMMISP User-controlled order parameter in correlations over-correlation endpointEPSS 0.2%CVE-2026-10861MEDIUMMISP post-login open redirect via pre_login_requested_urlEPSS 0.2%CVE-2026-54398MEDIUMMISP object edit authorization bypass allows unauthorized sharing group assignmentEPSS 0.2%CVE-2026-103858MEDIUMMISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to DiscussionsEPSS 0.2%CVE-2026-104914MEDIUMMISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated ViewEPSS 0.2%CVE-2026-91857MEDIUMMISP: State-changing actions accessible via GET request enabling CSRFEPSS 0.2%