Vendor
MISP
183 known vulnerabilities.
MISP at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 1 | 0 |
| Oct 2026 | 31 | 1 |
| Sep 2026 | 80 | 2 |
| Aug 2026 | 20 | 0 |
| Jul 2026 | 5 | 0 |
| Jun 2026 | 28 | 5 |
| May 2026 | 10 | 2 |
| Apr 2026 | 1 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 1 | 0 |
| Nov 2025 | 2 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 3 | 0 |
| Feb 2025 | 1 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Most common weaknesses
Products
Latest advisories
-
High max 9.4NCSC-2026-0213 6 CVEs
Kwetsbaarheden verholpen in MISP platform
MISP heeft meerdere kwetsbaarheden verholpen in het MISP platform.
183 results · Feed
-
Medium 6.3
MISP sourcecache module SSRF allows fetching arbitrary internal URLs via attribute enrichment
The sourcecache expansion module in MISP Modules (misp-modules) contains a Server-Side Request Forgery (SSRF) vulnerability. When a user with permission to create or modify attributes of type 'link' or 'url' submits an attribute value, the module passes the U…
-
Medium 6.1
MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy Tags to Bypass Feed Policy Enforcement
MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags. When a feed event or its attributes carried tags belonging to a required taxonomy (for example, TLP), the guard only ve…
-
High 7.1
MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding
MISP Guard, a proxy-based security filter for MISP feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions check_required_taxonomy_exists, check_required_taxonomy_tags_allowed, check_blocked_attribute_categorie…
-
High 7.7
MISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rules
MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules. The process_feed_response method in src/mispguard.py was responsible for evaluating feed responses before they reached the MISP instance. The …
-
Medium 6.3
MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()
The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function. The BLOCKED_RANGES list used to reject unsafe destination addresses was incomplete, omitting severa…
-
Medium 5.3
MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings
MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata. As a result: - A…
-
High 7.1
MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution
MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name to a node in the confi…
-
Medium 4.8
MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels
MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who…
-
Medium 4.8
MISP CSS Injection via Remote Tag Colour in Event Preview
MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficien…
-
Medium 5.1
MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records
MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph ent…
-
Medium 5.3
MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances
In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report. As …
-
High 7.1
MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control
MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organi…
-
Medium 5.3
MISP Object Sync Drops Objects and Attributes When Description Is Empty
MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechani…
-
Medium 6.3
MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests
MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP val…
-
High 7.1
MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances
On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the…
-
Medium 5.3
MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes
MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified. When a user edits an existing event and changes its distribution or sharing…
-
Medium 6.9
MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change
MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin—through its web UI and API to site-admin users. The background job workers trust raw Redis…
-
High 8.4
MISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSS
The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist in the …
-
Medium 5.3
MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View
MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints. When a user queries for soft-deleted attributes (e.g., via the deleted-attributes search or the paginated attribute listing), the applicatio…
-
High 7.1
MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data
MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system authorized access to correlated attributes and events based on a stale distributi…
-
Medium 5.3
MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization
MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the system retrieved related event metadata directly from the correlation table without re-validating the c…
-
High 7.1
MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging
MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying model belonging exclusively to the importing user's organisation, with the default flag forced to of…
-
Medium 4.8
MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler
MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page. When a linked (remote) MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-esc…
-
Medium 6.2
MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output
MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control o…
-
Medium 5.1
MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server
MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked (remote) MISP servers for corresponding event identifiers. The event ID returned by the remote serv…
-
Medium 5.3
MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview Index
MISP contains a stored cross-site scripting (XSS) vulnerability in the index table rendering of the remote event preview. The count field template escaped the associated link URL but rendered the field value without HTML encoding. An attacker with the ability…
-
Medium 5.3
MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions
MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only verified whether the target thread was restricted to a single organization (or…
-
Medium 4.8
MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter
MISP contains a reflected cross-site scripting (XSS) vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitizatio…
-
Medium 5.1
MISP Reflected XSS in Taxonomy Tag Confirmation Forms
MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag). The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML o…
-
High 7.1
MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes
MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In…
-
Critical 9.3
MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period
MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow where a TOTP code is ver…
-
High 7.6
MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypass
MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (paper) token and rewinding of the token counter. The HOTP verification logic compared the submitted token against a counter value that was …
-
Medium 6.2
MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation Graph
MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any server-side validation through the galaxy add, edit, and sync/import capture endpoints. The stored va…
-
Medium 6.2
MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field
MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local…
-
High 8.3
MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image
MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img ele…
-
High 8.6
MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection
MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag…
-
High 8.3
MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows
MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints (attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object ref…
-
High 8.7
MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Events
MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application authorized the user against the event identified in the URL but then persisted the entire submi…
-
Medium 6.3
misp-modules: Shell Command Injection in MISP cisco_firesight_manager_ACL_rule_export Module via Unescaped Attribute Values
The cisco_firesight_manager_ACL_rule_export module in misp-modules generates a shell script (.sh) that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration values (IP address, login, password, domain ID, policy ID)…
-
High 7.7
MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths
MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point. The phar stream wrapper causes PHP to treat a phar archive as a directory, which has two security consequences: - any filesystem operation on a c…