What’s Vulnerable › Products

MISP vulnerabilities

246 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 150 published in the last 12 months.

Check whether your MISP version is affected

Latest MISP vulnerabilities

• CVE-2026-112192 — MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings (CVSS 5.3)
• CVE-2026-112188 — MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution (CVSS 7.1)
• CVE-2026-112184 — MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels (CVSS 4.8)
• CVE-2026-112183 — MISP CSS Injection via Remote Tag Colour in Event Preview (CVSS 4.8)
• CVE-2026-112180 — MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records (CVSS 5.1)
• CVE-2026-112179 — MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances (CVSS 5.3)
• CVE-2026-112178 — MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control (CVSS 7.1)
• CVE-2026-107278 — MISP Object Sync Drops Objects and Attributes When Description Is Empty (CVSS 5.3)
• CVE-2026-107276 — MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests (CVSS 6.3)
• CVE-2026-107180 — MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances (CVSS 7.1)
• CVE-2026-107175 — MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes (CVSS 5.3)
• CVE-2026-106513 — MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change (CVSS 6.9)
• CVE-2026-104914 — MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View (CVSS 5.3)
• CVE-2026-104912 — MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data (CVSS 7.1)
• CVE-2026-104910 — MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization (CVSS 5.3)
• CVE-2026-104908 — MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging (CVSS 7.1)
• CVE-2026-104907 — MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler (CVSS 4.8)
• CVE-2026-104906 — MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output (CVSS 6.2)
• CVE-2026-104901 — MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server (CVSS 5.1)
• CVE-2026-104900 — MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview Index (CVSS 5.3)
• CVE-2026-103858 — MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions (CVSS 5.3)
• CVE-2026-103664 — MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter (CVSS 4.8)
• CVE-2026-103662 — MISP Reflected XSS in Taxonomy Tag Confirmation Forms (CVSS 5.1)
• CVE-2026-103659 — MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes (CVSS 7.1)
• CVE-2026-103655 — MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period (CVSS 9.3)