Vulnerabilidades em misp
182 resultadosAnálise Vexday
MISP apresenta 37 vulnerabilidades catalogadas, todas publicadas nos últimos 90 dias, com 5 classificadas como críticas (CVSS alto). Não há registros de exploração ativa em campo (KEV), mas o volume recente e a dominância de falhas de autorização (CWE-863) indicam exposição significativa em ambientes de compartilhamento de inteligência de ameaças. Recomenda-se priorizar patches críticos e revisar controles de acesso.
CVE-2026-103655CRITICALMISP TOTP Code Replay Allows Duplicate Authentication Within Validity PeriodEPSS 0.4%CVE-2026-92932MEDIUMMISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is DisabledEPSS 0.4%CVE-2026-95683MEDIUMMISP Overmind Event View Discloses Report Content Bypassing Report-Level ACLEPSS 0.4%CVE-2026-91825HIGHMISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During EditEPSS 0.4%CVE-2025-66384HIGHapp/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity, related to tmp_name.EPSS 0.4%CVE-2026-72760MEDIUMcti-transmute Following List Exposes User Email Addresses to Authenticated UsersEPSS 0.4%CVE-2026-95697MEDIUMMISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization MetadataEPSS 0.4%CVE-2026-94401HIGHMISP Arbitrary Local File Read and SSRF via MISP Export UploadEPSS 0.4%CVE-2026-54393MEDIUMMISP Overmind theme stored XSS via unvalidated homepage settingEPSS 0.4%CVE-2026-86283HIGHMISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event DataEPSS 0.4%CVE-2026-94374HIGHMISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events' ReportsEPSS 0.4%CVE-2026-94393MEDIUMMISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReportEPSS 0.4%CVE-2026-95671MEDIUMMISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/addEPSS 0.4%CVE-2026-85533HIGHMISP Sharing Group Authorization Bypass via Omitted Distribution ParameterEPSS 0.4%CVE-2026-60124MEDIUMMISP importModule missing authorization allows read-only users to modify events via misp_standard importsEPSS 0.4%CVE-2026-94381HIGHMISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTimeEPSS 0.4%CVE-2026-116469HIGHMISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data ForwardingEPSS 0.4%CVE-2026-112192MEDIUMMISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only SettingsEPSS 0.4%CVE-2026-9137MEDIUMCSP Report Endpoint Log Flooding in MISP via Incorrect Size LimitEPSS 0.4%CVE-2026-116372HIGHMISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rulesEPSS 0.4%