# MISP. Every CVE that names MISP among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first (an older page) - [Stored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies Index](https://agentprime.io/advisories/CVE-2026-94372.md) `CVE-2026-94372` · CVE record: MISP MISP · CVSS 6.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS) - [Stored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy Name](https://agentprime.io/advisories/CVE-2026-94277.md) `CVE-2026-94277` · CVE record: MISP MISP · CVSS 6.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS) - [MISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics Legends](https://agentprime.io/advisories/CVE-2026-93296.md) `CVE-2026-93296` · CVE record: misp misp · CVSS 8.5 High · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution](https://agentprime.io/advisories/CVE-2026-93295.md) `CVE-2026-93295` · CVE record: misp misp · CVSS 8.7 High · Not analysed yet · Published 17 Sept 2026 · Tags: Other injection, CWE-20 - [MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion](https://agentprime.io/advisories/CVE-2026-92003.md) `CVE-2026-92003` · CVE record: MISP MISP · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service - [MISP: Authentication failure logging suppressed during Redis unavailability](https://agentprime.io/advisories/CVE-2026-92002.md) `CVE-2026-92002` · CVE record: MISP MISP · CVSS 5.1 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-778 - [MISP Access Log Entry Overwritten by Error Controller's Second beforeFilter Pass](https://agentprime.io/advisories/CVE-2026-91859.md) `CVE-2026-91859` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-223, CWE-778 - [MISP: State-changing actions accessible via GET request enabling CSRF](https://agentprime.io/advisories/CVE-2026-91857.md) `CVE-2026-91857` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Cross-site request forgery (CSRF) - [MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag Comparison](https://agentprime.io/advisories/CVE-2026-91851.md) `CVE-2026-91851` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control, CWE-697 - [MISP Collection Element Add Missing Authorization on Referenced Object UUID](https://agentprime.io/advisories/CVE-2026-91846.md) `CVE-2026-91846` · CVE record: MISP MISP · CVSS 7.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control - [MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit](https://agentprime.io/advisories/CVE-2026-91825.md) `CVE-2026-91825` · CVE record: MISP MISP · CVSS 7.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control - [MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent](https://agentprime.io/advisories/CVE-2026-91819.md) `CVE-2026-91819` · CVE record: MISP MISP · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Cross-site request forgery (CSRF), CWE-20 - [MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentials](https://agentprime.io/advisories/CVE-2026-90961.md) `CVE-2026-90961` · CVE record: MISP MISP · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass, CWE-20 - [MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures](https://agentprime.io/advisories/CVE-2026-90957.md) `CVE-2026-90957` · CVE record: MISP MISP · CVSS 5.1 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-693 - [MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load](https://agentprime.io/advisories/CVE-2026-90955.md) `CVE-2026-90955` · CVE record: MISP MISP · CVSS 4.6 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-223, CWE-778 - [MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection](https://agentprime.io/advisories/CVE-2026-90895.md) `CVE-2026-90895` · CVE record: MISP MISP · CVSS 8.4 High · Not analysed yet · Published 14 Sept 2026 · Tags: Information disclosure, Hard-coded credentials, Broken access control, CWE-150 - [MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints](https://agentprime.io/advisories/CVE-2026-90893.md) `CVE-2026-90893` · CVE record: MISP MISP · CVSS 5.1 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Cross-site request forgery (CSRF) - [MISP: Unescaped HTML Injection in PDF Report Element Rendering](https://agentprime.io/advisories/CVE-2026-88921.md) `CVE-2026-88921` · CVE record: MISP MISP · CVSS 5.1 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [MISP Event Template Instantiation Bypasses Sharing Group and Tagging Authorization](https://agentprime.io/advisories/CVE-2026-88915.md) `CVE-2026-88915` · CVE record: MISP MISP · CVSS 7.1 High · Not analysed yet · Published 10 Sept 2026 · Tags: Broken access control - [MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding](https://agentprime.io/advisories/CVE-2026-86452.md) `CVE-2026-86452` · CVE record: MISP MISP · CVSS 8.7 High · Not analysed yet · Published 7 Sept 2026 · Tags: Denial of service - [MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects](https://agentprime.io/advisories/CVE-2026-86451.md) `CVE-2026-86451` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Broken access control - [MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data](https://agentprime.io/advisories/CVE-2026-86441.md) `CVE-2026-86441` · CVE record: MISP MISP · CVSS 2.3 Low · Not analysed yet · Published 7 Sept 2026 · Tags: Information disclosure, Broken access control - [MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs](https://agentprime.io/advisories/CVE-2026-86440.md) `CVE-2026-86440` · CVE record: MISP MISP · CVSS 5.1 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-20 - [MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII Discovery](https://agentprime.io/advisories/CVE-2026-86419.md) `CVE-2026-86419` · CVE record: MISP MISP · CVSS 7.0 High · Not analysed yet · Published 7 Sept 2026 · Tags: Information disclosure, Server-side request forgery (SSRF) - [MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users](https://agentprime.io/advisories/CVE-2026-86418.md) `CVE-2026-86418` · CVE record: MISP MISP · CVSS 2.3 Low · Not analysed yet · Published 7 Sept 2026 · Tags: Information disclosure, Broken access control - [MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Users](https://agentprime.io/advisories/CVE-2026-86417.md) `CVE-2026-86417` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Information disclosure, Broken access control - [MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected Events](https://agentprime.io/advisories/CVE-2026-86408.md) `CVE-2026-86408` · CVE record: MISP MISP · CVSS 7.1 High · Not analysed yet · Published 7 Sept 2026 · Tags: Broken access control - [MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL](https://agentprime.io/advisories/CVE-2026-86351.md) `CVE-2026-86351` · CVE record: MISP MISP · CVSS 5.1 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Open redirect, CWE-20 - [MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion](https://agentprime.io/advisories/CVE-2026-86347.md) `CVE-2026-86347` · CVE record: MISP MISP · CVSS 7.1 High · Not analysed yet · Published 7 Sept 2026 · Tags: Denial of service, Broken access control - [MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Information](https://agentprime.io/advisories/CVE-2026-86342.md) `CVE-2026-86342` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Broken access control - [MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data](https://agentprime.io/advisories/CVE-2026-86283.md) `CVE-2026-86283` · CVE record: MISP MISP · CVSS 7.1 High · Not analysed yet · Published 6 Sept 2026 · Tags: Broken access control - [Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP](https://agentprime.io/advisories/CVE-2026-85547.md) `CVE-2026-85547` · CVE record: misp misp · CVSS 6.2 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site request forgery (CSRF) - [MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests](https://agentprime.io/advisories/CVE-2026-85546.md) `CVE-2026-85546` · CVE record: misp misp · CVSS 8.6 High · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site request forgery (CSRF) - [MISP Attribute Deletion Authorization Bypass Allows Users Without Modify Permissions to Delete Attributes](https://agentprime.io/advisories/CVE-2026-85538.md) `CVE-2026-85538` · CVE record: misp misp · CVSS 8.3 High · Not analysed yet · Published 4 Sept 2026 · Tags: Broken access control - [MISP Sharing Group Authorization Bypass via Omitted Distribution Parameter](https://agentprime.io/advisories/CVE-2026-85533.md) `CVE-2026-85533` · CVE record: misp misp · CVSS 7.6 High · Not analysed yet · Published 4 Sept 2026 · Tags: Broken access control - [MISP Event Template Definition Validation Bypass Allows Persistent Denial of Service](https://agentprime.io/advisories/CVE-2026-85239.md) `CVE-2026-85239` · CVE record: misp misp · CVSS 7.1 High · Not analysed yet · Published 3 Sept 2026 · Tags: CWE-20 - [Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking](https://agentprime.io/advisories/CVE-2026-85238.md) `CVE-2026-85238` · CVE record: misp misp · CVSS 7.6 High · Not analysed yet · Published 3 Sept 2026 · Tags: Authentication bypass - [Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass](https://agentprime.io/advisories/CVE-2026-85237.md) `CVE-2026-85237` · CVE record: misp misp · CVSS 8.6 High · Not analysed yet · Published 3 Sept 2026 · Tags: Authentication bypass - [MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request](https://agentprime.io/advisories/CVE-2026-85236.md) `CVE-2026-85236` · CVE record: misp misp · CVSS 8.8 High · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site request forgery (CSRF) - [MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection](https://agentprime.io/advisories/CVE-2026-85230.md) `CVE-2026-85230` · CVE record: misp misp · CVSS 5.3 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-20 - [Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters](https://agentprime.io/advisories/CVE-2026-85227.md) `CVE-2026-85227` · CVE record: misp misp · CVSS 6.1 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations](https://agentprime.io/advisories/CVE-2026-85226.md) `CVE-2026-85226` · CVE record: misp misp · CVSS 5.3 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Broken access control - [MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacks](https://agentprime.io/advisories/CVE-2026-85221.md) `CVE-2026-85221` · CVE record: misp misp · CVSS 7.6 High · Not analysed yet · Published 3 Sept 2026 · Tags: Weak cryptography or TLS - [MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials](https://agentprime.io/advisories/CVE-2026-85216.md) `CVE-2026-85216` · CVE record: misp misp · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Hard-coded credentials - [Open Redirect in MISP Installer-Generated Apache Configuration](https://agentprime.io/advisories/CVE-2026-67178.md) `CVE-2026-67178` · CVE record: misp misp · CVSS 7.8 High · Not analysed yet · Published 28 Jul 2026 · Tags: Open redirect - [MISP: Improper sharing group authorization check when adding attributes](https://agentprime.io/advisories/CVE-2026-61474.md) `CVE-2026-61474` · CVE record: misp misp · CVSS 5.3 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Broken access control - [importModule function in MISP ignores per-organisation import module restrictions](https://agentprime.io/advisories/CVE-2026-60125.md) `CVE-2026-60125` · CVE record: misp misp · CVSS 5.3 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: Broken access control - [MISP importModule missing authorization allows read-only users to modify events via misp_standard imports](https://agentprime.io/advisories/CVE-2026-60124.md) `CVE-2026-60124` · CVE record: misp misp · CVSS 5.3 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: Broken access control - [MISP remote code execution via arbitrary rdkafka configuration path](https://agentprime.io/advisories/CVE-2026-56447.md) `CVE-2026-56447` · CVE record: misp misp · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jun 2026 · Tags: CWE-829 - [Authenticated Remote Code Execution via Arbitrary NDJSON Error Log Path in MISP](https://agentprime.io/advisories/CVE-2026-56446.md) `CVE-2026-56446` · CVE record: misp misp · CVSS 8.7 High · Not analysed yet · Published 22 Jun 2026 · Tags: Code injection - [MISP AAD authentication plugin - Improper OAuth State Handling, Missing Session Rotation, Insecure Redirect URI Validation, and Log Injection](https://agentprime.io/advisories/CVE-2026-56425.md) `CVE-2026-56425` · CVE record: misp misp · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jun 2026 · Tags: Authentication bypass - [Broken access control in MISP core allows cross-organization unauthorized modification or deletion of analyst data, event reports, collections, templates, and decaying models](https://agentprime.io/advisories/CVE-2026-56424.md) `CVE-2026-56424` · CVE record: misp misp · CVSS 7.1 High · Not analysed yet · Published 22 Jun 2026 · Tags: Broken access control - [MISP Core: Broken access control allows instance-wide unauthorized deletion of event reports and sharing groups via bulk deletion endpoints](https://agentprime.io/advisories/CVE-2026-56423.md) `CVE-2026-56423` · CVE record: misp misp · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jun 2026 · Tags: Broken access control - [MISP Core: Mass Assignment and Object Re-ownership via Unvalidated Request Fields](https://agentprime.io/advisories/CVE-2026-56422.md) `CVE-2026-56422` · CVE record: misp misp · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jun 2026 · Tags: Broken access control - [MISP object edit authorization bypass allows unauthorized sharing group assignment](https://agentprime.io/advisories/CVE-2026-54398.md) `CVE-2026-54398` · CVE record: misp misp · CVSS 5.3 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Broken access control - [MISP event editing allows unauthorized assignment to undisclosed sharing groups](https://agentprime.io/advisories/CVE-2026-54397.md) `CVE-2026-54397` · CVE record: misp misp · CVSS 6.1 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Broken access control - [MISP AuthKey edit endpoint allows authenticated user email enumeration](https://agentprime.io/advisories/CVE-2026-54396.md) `CVE-2026-54396` · CVE record: misp misp · CVSS 5.3 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Information disclosure - [MISP UiBeta event index reflected XSS in advanced filter popup](https://agentprime.io/advisories/CVE-2026-54395.md) `CVE-2026-54395` · CVE record: misp misp · CVSS 5.3 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Cross-site scripting (XSS) - [MISP organisation logo path traversal allows retrieval of arbitrary PNG/SVG files](https://agentprime.io/advisories/CVE-2026-54394.md) `CVE-2026-54394` · CVE record: misp misp · CVSS 5.3 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Path traversal - [MISP Overmind theme stored XSS via unvalidated homepage setting](https://agentprime.io/advisories/CVE-2026-54393.md) `CVE-2026-54393` · CVE record: misp misp · CVSS 5.1 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Cross-site scripting (XSS) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .