MI
Product
Misp
142
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 29High 26Medium 87Low 0
Watch
Add Misp to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-10611 | 10.0 | Jun 2 | OTP bypass via plugin-based LDAP authentication in MISP when LDAP mixed authentication is enabled Affected: before 2.5.39 |
| CVE-2026-85216 | 9.8 | Sep 3 | MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials Affected: before 2.5.46 |
| CVE-2024-29858 | 9.8 | Mar 21 | In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload Affected: before 2.4.187 |
| CVE-2024-29859 | 9.8 | Mar 21 | In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload Affected: before 2.4.187 |
| CVE-2024-25675 | 9.8 | Feb 9 | An issue was discovered in MISP before 2.4.184 Affected: before 2.4.184 |
| CVE-2024-25674 | 9.8 | Feb 9 | An issue was discovered in MISP before 2.4.184 Affected: before 2.4.184 |
| CVE-2023-50918 | 9.8 | Dec 15 | app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs Affected: before 2.4.182 |
| CVE-2023-48656 | 9.8 | Nov 17 | An issue was discovered in MISP before 2.4.176 Affected: before 2.4.176 |
| CVE-2023-48659 | 9.8 | Nov 17 | An issue was discovered in MISP before 2.4.176 Affected: before 2.4.176 |
| CVE-2023-48658 | 9.8 | Nov 17 | An issue was discovered in MISP before 2.4.176 Affected: before 2.4.176 |
| CVE-2023-48655 | 9.8 | Nov 17 | An issue was discovered in MISP before 2.4.176 Affected: before 2.4.176 |
| CVE-2023-48657 | 9.8 | Nov 17 | An issue was discovered in MISP before 2.4.176 Affected: before 2.4.176 |
| CVE-2022-48328 | 9.8 | Feb 20 | app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters Affected: before 2.4.167 |
| CVE-2022-48329 | 9.8 | Feb 20 | MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and… Affected: before 2.4.166 |
| CVE-2023-24028 | 9.8 | Jan 20 | In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function Affected: 2.4.167 |
| CVE-2022-29528 | 9.8 | Apr 20 | An issue was discovered in MISP before 2.4.158 Affected: before 2.4.158 |
| CVE-2021-41326 | 9.8 | Sep 17 | In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call Affected: before 2.4.148 |
| CVE-2021-39302 | 9.8 | Aug 19 | MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions['org'] value Affected: 2.4.148 |
| CVE-2021-35502 | 9.8 | Jun 25 | app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data related to generic-template:index Affected: 2.4.144 |
| CVE-2020-29006 | 9.8 | Nov 24 | MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyElement.php Affected: before 2.4.135 |
| CVE-2020-15411 | 9.8 | Jun 30 | An issue was discovered in MISP 2.4.128 Affected: 2.4.128 |
| CVE-2018-12649 | 9.8 | Jun 22 | An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92 Affected: 2.4.92 |
| CVE-2015-5721 | 9.8 | Sep 3 | Malware Information Sharing Platform (MISP) before 2.3.90 allows remote attackers to conduct PHP object injection attacks via crafted serialized data, related to… Affected: through 2.3.89 |
| CVE-2015-5719 | 9.8 | Sep 3 | app/Controller/TemplatesController.php in Malware Information Sharing Platform (MISP) before 2.3.92 does not properly restrict filenames under the tmp/files/ directory, which has… Affected: through 2.3.91 |
| CVE-2026-39962 | 9.6 | Apr 9 | LDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variable Affected: before 2.5.36 |
| CVE-2026-86419 | 9.1 | Sep 7 | MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII Discovery Affected: through 2.5.45 |
| CVE-2026-85221 | 9.1 | Sep 3 | MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacks Affected: before 2.5.46 |
| CVE-2021-25323 | 9.1 | Jan 19 | The default setting of MISP 2.4.136 did not enable the requirements (aka require_password_confirmation) to provide the previous password when changing a password Affected: 2.4.136 |
| CVE-2025-67906 | 9.0 | Dec 15 | In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path Affected: before 2.5.28 |
Showing 29