# MISP.

Every CVE that names MISP among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings](https://agentprime.io/advisories/CVE-2026-112192.md)
  `CVE-2026-112192` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure, Broken access control
- [MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution](https://agentprime.io/advisories/CVE-2026-112188.md)
  `CVE-2026-112188` · CVE record: MISP MISP · CVSS 7.1 High · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure, Broken access control
- [MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels](https://agentprime.io/advisories/CVE-2026-112184.md)
  `CVE-2026-112184` · CVE record: MISP MISP · CVSS 4.8 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS)
- [MISP CSS Injection via Remote Tag Colour in Event Preview](https://agentprime.io/advisories/CVE-2026-112183.md)
  `CVE-2026-112183` · CVE record: MISP MISP · CVSS 4.8 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Other injection
- [MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records](https://agentprime.io/advisories/CVE-2026-112180.md)
  `CVE-2026-112180` · CVE record: MISP MISP · CVSS 5.1 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-459
- [MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances](https://agentprime.io/advisories/CVE-2026-112179.md)
  `CVE-2026-112179` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure
- [MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control](https://agentprime.io/advisories/CVE-2026-112178.md)
  `CVE-2026-112178` · CVE record: MISP MISP · CVSS 7.1 High · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [MISP Object Sync Drops Objects and Attributes When Description Is Empty](https://agentprime.io/advisories/CVE-2026-107278.md)
  `CVE-2026-107278` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-20
- [MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests](https://agentprime.io/advisories/CVE-2026-107276.md)
  `CVE-2026-107276` · CVE record: MISP MISP · CVSS 6.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Race condition
- [MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances](https://agentprime.io/advisories/CVE-2026-107180.md)
  `CVE-2026-107180` · CVE record: MISP MISP · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass
- [MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes](https://agentprime.io/advisories/CVE-2026-107175.md)
  `CVE-2026-107175` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control, CWE-665
- [MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change](https://agentprime.io/advisories/CVE-2026-106513.md)
  `CVE-2026-106513` · CVE record: MISP MISP · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control, CWE-749
- [MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View](https://agentprime.io/advisories/CVE-2026-104914.md)
  `CVE-2026-104914` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data](https://agentprime.io/advisories/CVE-2026-104912.md)
  `CVE-2026-104912` · CVE record: MISP MISP · CVSS 7.1 High · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization](https://agentprime.io/advisories/CVE-2026-104910.md)
  `CVE-2026-104910` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging](https://agentprime.io/advisories/CVE-2026-104908.md)
  `CVE-2026-104908` · CVE record: MISP MISP · CVSS 7.1 High · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler](https://agentprime.io/advisories/CVE-2026-104907.md)
  `CVE-2026-104907` · CVE record: MISP MISP · CVSS 4.8 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output](https://agentprime.io/advisories/CVE-2026-104906.md)
  `CVE-2026-104906` · CVE record: MISP MISP · CVSS 6.2 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server](https://agentprime.io/advisories/CVE-2026-104901.md)
  `CVE-2026-104901` · CVE record: MISP MISP · CVSS 5.1 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview Index](https://agentprime.io/advisories/CVE-2026-104900.md)
  `CVE-2026-104900` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions](https://agentprime.io/advisories/CVE-2026-103858.md)
  `CVE-2026-103858` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter](https://agentprime.io/advisories/CVE-2026-103664.md)
  `CVE-2026-103664` · CVE record: MISP MISP · CVSS 4.8 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [MISP Reflected XSS in Taxonomy Tag Confirmation Forms](https://agentprime.io/advisories/CVE-2026-103662.md)
  `CVE-2026-103662` · CVE record: MISP MISP · CVSS 5.1 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes](https://agentprime.io/advisories/CVE-2026-103659.md)
  `CVE-2026-103659` · CVE record: MISP MISP · CVSS 7.1 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period](https://agentprime.io/advisories/CVE-2026-103655.md)
  `CVE-2026-103655` · CVE record: MISP MISP · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Authentication bypass
- [MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypass](https://agentprime.io/advisories/CVE-2026-103651.md)
  `CVE-2026-103651` · CVE record: MISP MISP · CVSS 7.6 High · Not analysed yet · Published 1 Oct 2026 · Tags: Authentication bypass, Race condition
- [MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation Graph](https://agentprime.io/advisories/CVE-2026-103389.md)
  `CVE-2026-103389` · CVE record: MISP MISP · CVSS 6.2 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-20
- [MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field](https://agentprime.io/advisories/CVE-2026-103388.md)
  `CVE-2026-103388` · CVE record: MISP MISP · CVSS 6.2 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image](https://agentprime.io/advisories/CVE-2026-103321.md)
  `CVE-2026-103321` · CVE record: MISP MISP · CVSS 8.3 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-20
- [MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection](https://agentprime.io/advisories/CVE-2026-103239.md)
  `CVE-2026-103239` · CVE record: MISP MISP · CVSS 8.6 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows](https://agentprime.io/advisories/CVE-2026-103237.md)
  `CVE-2026-103237` · CVE record: MISP MISP · CVSS 8.3 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control, CWE-20
- [MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Events](https://agentprime.io/advisories/CVE-2026-103235.md)
  `CVE-2026-103235` · CVE record: MISP MISP · CVSS 8.7 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths](https://agentprime.io/advisories/CVE-2026-95806.md)
  `CVE-2026-95806` · CVE record: MISP MISP · CVSS 7.7 High · Not analysed yet · Published 22 Sept 2026 · Tags: Other injection, Insecure deserialization
- [MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restriction](https://agentprime.io/advisories/CVE-2026-95805.md)
  `CVE-2026-95805` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control
- [MISP: Disabled-user check ineffective in pre-authentication TOTP login branch](https://agentprime.io/advisories/CVE-2026-95754.md)
  `CVE-2026-95754` · CVE record: MISP MISP · CVSS 6.9 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control
- [MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_name](https://agentprime.io/advisories/CVE-2026-95703.md)
  `CVE-2026-95703` · CVE record: MISP MISP · CVSS 5.1 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Information disclosure, CWE-20
- [MISP Path Traversal via Organization Name in Org-Statistics Logo Check](https://agentprime.io/advisories/CVE-2026-95701.md)
  `CVE-2026-95701` · CVE record: MISP MISP · CVSS 5.1 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Path traversal
- [MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name](https://agentprime.io/advisories/CVE-2026-95698.md)
  `CVE-2026-95698` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Path traversal
- [MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Metadata](https://agentprime.io/advisories/CVE-2026-95697.md)
  `CVE-2026-95697` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control
- [MISP Information Disclosure via Forged Upload Path](https://agentprime.io/advisories/CVE-2026-95693.md)
  `CVE-2026-95693` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Path traversal, Information disclosure
- [MISP Missing Authorization on replaceSuggestionInReport Event Report Action](https://agentprime.io/advisories/CVE-2026-95685.md)
  `CVE-2026-95685` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control
- [MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL](https://agentprime.io/advisories/CVE-2026-95683.md)
  `CVE-2026-95683` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control
- [MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View](https://agentprime.io/advisories/CVE-2026-95682.md)
  `CVE-2026-95682` · CVE record: MISP MISP · CVSS 4.8 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS)
- [MISP Unauthenticated Blind SSRF via XML Body Processing](https://agentprime.io/advisories/CVE-2026-95679.md)
  `CVE-2026-95679` · CVE record: MISP MISP · CVSS 6.9 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Server-side request forgery (SSRF), CWE-20
- [MISP EventsController queryEnrichment allows querying unavailable or legacy modules without validation](https://agentprime.io/advisories/CVE-2026-95674.md)
  `CVE-2026-95674` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-20
- [MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add](https://agentprime.io/advisories/CVE-2026-95671.md)
  `CVE-2026-95671` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control
- [MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials](https://agentprime.io/advisories/CVE-2026-95667.md)
  `CVE-2026-95667` · CVE record: MISP MISP · CVSS 6.9 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Path traversal, Broken access control
- [MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON](https://agentprime.io/advisories/CVE-2026-95665.md)
  `CVE-2026-95665` · CVE record: MISP MISP · CVSS 5.1 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS)
- [MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type List](https://agentprime.io/advisories/CVE-2026-95661.md)
  `CVE-2026-95661` · CVE record: MISP MISP · CVSS 5.1 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS)
- [MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread](https://agentprime.io/advisories/CVE-2026-95659.md)
  `CVE-2026-95659` · CVE record: MISP MISP · CVSS 4.8 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-20, CWE-116
- [MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution of workflow modules](https://agentprime.io/advisories/CVE-2026-95658.md)
  `CVE-2026-95658` · CVE record: MISP MISP · CVSS 6.9 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site request forgery (CSRF)
- [MISP CSRF vulnerability allows unauthorized attribute modification](https://agentprime.io/advisories/CVE-2026-94404.md)
  `CVE-2026-94404` · CVE record: MISP MISP · CVSS 7.1 High · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site request forgery (CSRF)
- [MISP Arbitrary Local File Read and SSRF via MISP Export Upload](https://agentprime.io/advisories/CVE-2026-94401.md)
  `CVE-2026-94401` · CVE record: MISP MISP · CVSS 8.3 High · Not analysed yet · Published 21 Sept 2026 · Tags: Path traversal, Server-side request forgery (SSRF)
- [MISP ObjectReferencesController: Granular Distribution and Sharing Group Restrictions Bypassed When Adding Object References](https://agentprime.io/advisories/CVE-2026-94394.md)
  `CVE-2026-94394` · CVE record: MISP MISP · CVSS 6.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control
- [MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport](https://agentprime.io/advisories/CVE-2026-94393.md)
  `CVE-2026-94393` · CVE record: MISP MISP · CVSS 6.4 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control
- [MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension](https://agentprime.io/advisories/CVE-2026-94383.md)
  `CVE-2026-94383` · CVE record: MISP MISP · CVSS 8.6 High · Not analysed yet · Published 21 Sept 2026 · Tags: Unrestricted file upload, CWE-20
- [MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTime](https://agentprime.io/advisories/CVE-2026-94381.md)
  `CVE-2026-94381` · CVE record: MISP MISP · CVSS 8.7 High · Not analysed yet · Published 21 Sept 2026 · Tags: Privilege escalation
- [MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP)](https://agentprime.io/advisories/CVE-2026-94379.md)
  `CVE-2026-94379` · CVE record: MISP MISP · CVSS 6.9 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control, CWE-20
- [MISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events' Reports](https://agentprime.io/advisories/CVE-2026-94374.md)
  `CVE-2026-94374` · CVE record: MISP MISP · CVSS 8.3 High · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control, CWE-472
- [MISP DOM-based Cross-Site Scripting via innerHTML in Contextual Menu](https://agentprime.io/advisories/CVE-2026-94373.md)
  `CVE-2026-94373` · CVE record: MISP MISP · CVSS 6.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)

Older: <https://agentprime.io/advisories/technology/misp.md?cursor=WyIyMDI2LTA5LTIxVDEyOjE2OjQ3Ljg3NzAwMFoiLCJDVkUtMjAyNi05NDM3MyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=misp>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/misp/>. Everything for agents: <https://agentprime.io/llms.txt>.