MI
Product
Misp
142
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 29High 26Medium 87Low 0
Watch
Add Misp to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-85236 | 8.8 | Sep 3 | MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request Affected: through 2.5.45 |
| CVE-2026-56425 | 8.8 | Jun 22 | MISP AAD authentication plugin - Improper OAuth State Handling, Missing Session Rotation, Insecure Redirect URI Validation, and Log Injection Affected: before 2.5.42 |
| CVE-2026-56424 | 8.8 | Jun 22 | Broken access control in MISP core allows cross-organization unauthorized modification or deletion of analyst data, event reports, collections, templates, and decaying models Affected: before 2.5.42 |
| CVE-2026-56423 | 8.8 | Jun 22 | MISP Core: Broken access control allows instance-wide unauthorized deletion of event reports and sharing groups via bulk deletion endpoints Affected: before 2.5.42 |
| CVE-2022-27245 | 8.8 | Mar 18 | An issue was discovered in MISP before 2.4.156 Affected: before 2.4.156 |
| CVE-2020-15711 | 8.8 | Jul 14 | In MISP before 2.4.129, setting a favourite homepage was not CSRF protected Affected: before 2.4.129 |
| CVE-2018-19908 | 8.8 | Dec 6 | An issue was discovered in MISP 2.4.9x before 2.4.99 Affected: 2.4.90 before 2.4.99 |
| CVE-2026-85237 | 8.1 | Sep 3 | Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass Affected: through 2.5.45 |
| CVE-2026-10863 | 8.1 | Jun 4 | MISP User-controlled order parameter in correlations over-correlation endpoint Affected: before 2.5.39 |
| CVE-2020-8892 | 8.1 | Feb 12 | An issue was discovered in MISP before 2.4.121 Affected: before 2.4.121 |
| CVE-2017-14337 | 8.1 | Sep 12 | When MISP before 2.4.80 is configured with X.509 certificate authentication (CertAuth) in conjunction with a non-MISP external user management ReST API, if an external user… Affected: through 2.4.79 |
| CVE-2022-27243 | 7.8 | Mar 18 | An issue was discovered in MISP before 2.4.156 Affected: before 2.4.156 |
| CVE-2026-86452 | 7.5 | Sep 7 | MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding Affected: through 2.5.45 |
| CVE-2026-9137 | 7.5 | May 20 | CSP Report Endpoint Log Flooding in MISP via Incorrect Size Limit Affected: 2.5.0 before 2.5.38 |
| CVE-2023-37306 | 7.5 | Jun 30 | MISP 2.4.172 mishandles different certificate file extensions in server sync Affected: 2.4.172 |
| CVE-2022-29534 | 7.5 | Apr 20 | An issue was discovered in MISP before 2.4.158 Affected: before 2.4.158 |
| CVE-2021-31780 | 7.5 | Apr 23 | In app/Model/MispObject.php in MISP 2.4.141, an incorrect sharing group association could lead to information disclosure on an event edit Affected: 2.4.141 |
| CVE-2020-28043 | 7.5 | Nov 2 | MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL Affected: through 2.4.133 |
| CVE-2020-25766 | 7.5 | Sep 18 | An issue was discovered in MISP before 2.4.132 Affected: before 2.4.132 |
| CVE-2020-14969 | 7.5 | Jun 22 | app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations Affected: 2.4.127 |
| CVE-2020-8893 | 7.5 | Feb 12 | An issue was discovered in MISP before 2.4.121 Affected: before 2.4.121 |
| CVE-2026-56447 | 7.2 | Jun 22 | MISP remote code execution via arbitrary rdkafka configuration path Affected: before 2.5.42 |
| CVE-2026-56446 | 7.2 | Jun 22 | Authenticated Remote Code Execution via Arbitrary NDJSON Error Log Path in MISP Affected: before 2.5.42 |
| CVE-2026-44380 | 7.2 | May 13 | MISP: Improper access control in auth key reset allows privilege escalation to site administrator Affected: before 2.5.37 |
| CVE-2019-12868 | 7.2 | Jun 18 | app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP file_exists function is used with user-controlled entries, and… Affected: 2.4.109 |
| CVE-2018-6926 | 7.2 | Feb 12 | In app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override of a path variable on certain Red Hed Enterprise Linux and CentOS systems (where… Affected: 2.4.87 |
Showing 26