Vulnerabilidades em MISP
182 resultadosAnálise Vexday
O MISP apresenta 13 vulnerabilidades catalogadas, sendo 5 divulgadas nos últimos 90 dias, o que indica atividade contínua de descoberta de falhas. Embora nenhuma esteja sob ataque ativo no momento, 2 vulnerabilidades críticas e a predominância de injeção de conteúdo (CWE-79) requerem atenção, especialmente considerando o papel estratégico da plataforma em ecossistemas de compartilhamento de inteligência de ameaças.
CVE-2026-94404HIGHMISP CSRF vulnerability allows unauthorized attribute modificationEPSS 0.2%CVE-2026-107276MEDIUMMISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent RequestsEPSS 0.2%CVE-2026-107175MEDIUMMISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group ChangesEPSS 0.2%CVE-2026-54362MEDIUMMISP template builder exposes non-visible custom galaxies across organisationsEPSS 0.2%CVE-2026-85546HIGHMISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET RequestsEPSS 0.2%CVE-2026-104912HIGHMISP Correlation Authorization Bypass Exposes Restricted Event and Attribute DataEPSS 0.2%CVE-2026-91819MEDIUMMISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponentEPSS 0.2%CVE-2026-10860HIGHMISP CRUDComponent delete validation bypass via operator precedence errorEPSS 0.2%CVE-2026-103651HIGHMISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication BypassEPSS 0.2%CVE-2026-54359HIGHMISP automation endpoints may be exposed to CSRF when Sec-Fetch-Site protection is disabled by defaultEPSS 0.2%CVE-2026-44364CRITICALmisp-modules website - Missing CSRF protection in the website home blueprintEPSS 0.2%CVE-2026-9084MEDIUMMISP OIDC authentication bypass via automatic email-based account linking under insecure IdP configurationsEPSS 0.2%CVE-2026-95667MEDIUMMISP Installer Log and FIFO Created World-Readable, Exposing Sensitive CredentialsEPSS 0.2%CVE-2026-44379MEDIUMMISP: Improper UUID validation in MISP CollectionsEPSS 0.2%CVE-2026-10864MEDIUMMISP Dashboard widget field selection may expose restricted user and organisation dataEPSS 0.2%CVE-2026-10854MEDIUMUnauthorized exposure of private galaxies in MISP event template creationEPSS 0.2%CVE-2026-90955MEDIUMMISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model LoadEPSS 0.2%CVE-2026-10855MEDIUMMISP Event template importer authorization bypassEPSS 0.2%CVE-2026-90895HIGHMISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal InjectionEPSS 0.1%CVE-2026-10856MEDIUMOpen redirect in MISP dashboard button widget URL handlingEPSS 0.1%