Vulnerabilidades em MISP
145 resultadosAnálise Vexday
O MISP apresenta 13 vulnerabilidades catalogadas, sendo 5 divulgadas nos últimos 90 dias, o que indica atividade contínua de descoberta de falhas. Embora nenhuma esteja sob ataque ativo no momento, 2 vulnerabilidades críticas e a predominância de injeção de conteúdo (CWE-79) requerem atenção, especialmente considerando o papel estratégico da plataforma em ecossistemas de compartilhamento de inteligência de ameaças.
CVE-2026-94277MEDIUMStored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy NameEPSS 0.4%CVE-2026-73161MEDIUMcti-transmute Conversion Table Allows XSS via Unescaped Cell Content During Search HighlightingEPSS 0.4%CVE-2026-73159MEDIUMcti-transmute Stored XSS via Crafted Tag Icon on Admin Triage InterfaceEPSS 0.4%CVE-2026-95806HIGHMISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem pathsEPSS 0.4%CVE-2026-95659MEDIUMMISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind ThreadEPSS 0.4%CVE-2026-94373MEDIUMMISP DOM-based Cross-Site Scripting via innerHTML in Contextual MenuEPSS 0.4%CVE-2026-93296HIGHMISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics LegendsEPSS 0.4%CVE-2026-94372MEDIUMStored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies IndexEPSS 0.4%CVE-2026-91825HIGHMISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During EditEPSS 0.4%CVE-2026-95683MEDIUMMISP Overmind Event View Discloses Report Content Bypassing Report-Level ACLEPSS 0.4%CVE-2026-92932MEDIUMMISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is DisabledEPSS 0.4%CVE-2026-54358HIGHMISP organization administrators can target site administrator accounts for password resetEPSS 0.4%CVE-2026-72760MEDIUMcti-transmute Following List Exposes User Email Addresses to Authenticated UsersEPSS 0.4%CVE-2026-54396MEDIUMMISP AuthKey edit endpoint allows authenticated user email enumerationEPSS 0.4%CVE-2026-95697MEDIUMMISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization MetadataEPSS 0.4%CVE-2026-94401HIGHMISP Arbitrary Local File Read and SSRF via MISP Export UploadEPSS 0.4%CVE-2026-60124MEDIUMMISP importModule missing authorization allows read-only users to modify events via misp_standard importsEPSS 0.4%CVE-2026-94393MEDIUMMISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReportEPSS 0.4%CVE-2026-85533HIGHMISP Sharing Group Authorization Bypass via Omitted Distribution ParameterEPSS 0.4%CVE-2026-94374HIGHMISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events' ReportsEPSS 0.4%