MI
Product
Misp
142
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 29High 26Medium 87Low 0
Watch
Add Misp to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-15216 | 6.1 | Oct 10 | MISP before 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a sighting, related to app/View/Sightings/ajax/quickDeleteConfirmationForm.ctp and… Affected: through 2.4.80 |
| CVE-2017-13671 | 6.1 | Aug 24 | app/View/Helper/CommandHelper.php in MISP before 2.4.79 has persistent XSS via comments Affected: through 2.4.78 |
| CVE-2017-7215 | 6.1 | Mar 21 | Cross site scripting in some view elements in the index filter tool in app/webroot/js/misp2.4.68.js and the organisation landing page in… Affected: through 2.4.68 |
| CVE-2015-5720 | 6.1 | Sep 3 | Multiple cross-site scripting (XSS) vulnerabilities in the template-creation feature in Malware Information Sharing Platform (MISP) before 2.3.90 allow remote attackers to inject… Affected: through 2.3.89 |
| CVE-2020-8891 | 5.9 | Feb 12 | An issue was discovered in MISP before 2.4.121 Affected: before 2.4.121 |
| CVE-2020-8890 | 5.9 | Feb 12 | An issue was discovered in MISP before 2.4.121 Affected: before 2.4.121 |
| CVE-2021-27904 | 5.5 | Mar 2 | An issue was discovered in app/Model/SharingGroupServer.php in MISP 2.4.139 Affected: through 2.4.139 |
| CVE-2026-86440 | 5.4 | Sep 7 | MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs Affected: through 2.5.45 |
| CVE-2026-85230 | 5.4 | Sep 3 | MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection Affected: before 2.5.46 |
| CVE-2026-8080 | 5.4 | May 7 | MISP core - Stored XSS in MISP template (old engine) element attribute type Affected: before 2.5.37 |
| CVE-2023-37307 | 5.4 | Jun 30 | In MISP before 2.4.172, title_for_layout is not properly sanitized in Correlations, CorrelationExclusions, and Layouts Affected: before 2.4.172 |
| CVE-2022-29531 | 5.4 | Apr 20 | An issue was discovered in MISP before 2.4.158 Affected: before 2.4.158 |
| CVE-2022-29530 | 5.4 | Apr 20 | An issue was discovered in MISP before 2.4.158 Affected: before 2.4.158 |
| CVE-2022-29529 | 5.4 | Apr 20 | An issue was discovered in MISP before 2.4.158 Affected: before 2.4.158 |
| CVE-2021-37743 | 5.4 | Jul 30 | app/View/GalaxyElements/ajax/index.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster elements in JSON format Affected: 2.4.147 |
| CVE-2021-37742 | 5.4 | Jul 30 | app/View/Elements/GalaxyClusters/view_relation_tree.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster relationships Affected: 2.4.147 |
| CVE-2021-37534 | 5.4 | Jul 26 | app/View/GalaxyClusters/add.ctp in MISP 2.4.146 allows Stored XSS when forking a galaxy cluster Affected: 2.4.146 |
| CVE-2017-16802 | 5.4 | Nov 13 | In the sharingGroupPopulateOrganisations function in app/webroot/js/misp.js in MISP 2.4.82, there is XSS via a crafted organisation name that is manually added Affected: 2.4.82 |
| CVE-2026-44379 | 5.3 | May 13 | MISP: Improper UUID validation in MISP Collections Affected: before 2.5.37 |
| CVE-2026-44381 | 5.3 | May 13 | MISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listings Affected: before 2.5.37 |
| CVE-2019-19379 | 5.3 | Nov 28 | In app/Controller/TagsController.php in MISP 2.4.118, users can bypass intended restrictions on tagging data Affected: 2.4.118 |
| CVE-2019-9482 | 5.3 | Mar 1 | In MISP 2.4.102, an authenticated user can view sightings that they should not be eligible for Affected: 2.4.102 |
| CVE-2024-46918 | 4.9 | Sep 15 | app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in the same org Affected: before 2.4.198 |
| CVE-2020-11458 | 4.9 | Apr 2 | app/Model/feed.php in MISP before 2.4.124 allows administrators to choose arbitrary files that should be ingested by MISP Affected: before 2.4.124 |
| CVE-2017-16946 | 4.9 | Nov 25 | The admin_edit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enable_password field, which allows admins to discover a hashed password by reading the… Affected: 2.4.82 |
| CVE-2024-58128 | 4.8 | Mar 28 | In MISP before 2.4.193, menu_custom_right_link parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can conduct XSS attacks via… Affected: before 2.4.193 |
| CVE-2024-58129 | 4.8 | Mar 28 | In MISP before 2.4.193, menu_custom_right_link_html parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can conduct XSS attacks… Affected: before 2.4.193 |
| CVE-2022-29532 | 4.8 | Apr 20 | An issue was discovered in MISP before 2.4.158 Affected: before 2.4.158 |
| CVE-2022-27244 | 4.8 | Mar 18 | An issue was discovered in MISP before 2.4.156 Affected: before 2.4.156 |
| CVE-2026-86451 | 4.3 | Sep 7 | MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects Affected: through 2.5.45 |
| CVE-2026-86441 | 4.3 | Sep 7 | MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data Affected: through 2.5.45 |
| CVE-2026-86418 | 4.3 | Sep 7 | MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users Affected: through 2.5.45 |
| CVE-2026-86417 | 4.3 | Sep 7 | MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Users Affected: through 2.5.45 |
| CVE-2026-86342 | 4.3 | Sep 7 | MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Information Affected: through 2.5.45 |
| CVE-2026-85226 | 4.3 | Sep 3 | MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations Affected: before 2.5.46 |
| CVE-2026-10864 | 4.3 | Jun 4 | MISP Dashboard widget field selection may expose restricted user and organisation data Affected: before 2.5.39 |
| CVE-2026-10855 | 4.3 | Jun 4 | MISP Event template importer authorization bypass Affected: before 2.5.39 |
| CVE-2026-10854 | 4.3 | Jun 4 | Unauthorized exposure of private galaxies in MISP event template creation Affected: before 2.5.39 |
| CVE-2024-57969 | 4.3 | Feb 14 | app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search Affected: before 2.4.198 |
| CVE-2022-42724 | 4.3 | Oct 10 | app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names (this is information that only the site admin should have) Affected: before 2.4.164 |
| CVE-2020-15412 | 4.3 | Jun 30 | An issue was discovered in MISP 2.4.128 Affected: 2.4.128 |
| CVE-2018-8949 | 4.3 | Mar 23 | An issue was discovered in app/Model/Attribute.php in MISP before 2.4.89 Affected: before 2.4.89 |