Skip to content
OpenAdvisories

Vendor

MISP

183 known vulnerabilities.

Products

MISP 150 cti-transmute 17 misp-modules 6 misp-stix 4 misp-guard 3 sachertortephp 2 bsimvis 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.1
    CVE-2026-86283 Public exploit

    MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data

    MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp) performed a secondary query of member events by UUID without applying the caller's access control list (ACL). The CollectionsController::view() action correctly resolved collect…

    MISP MISP
  • Critical 9.4
    CVE-2026-56423 Public exploit

    MISP Core: Broken access control allows instance-wide unauthorized deletion of event reports and sharing groups via bulk deletion endpoints

    MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The affected deleteSelection handlers authorized deletion using broad role-level permissions instead of validating authorization for each selecte…

    MISP MISP
  • Medium 6.3
    CVE-2026-9806 Public exploit

    Stored Cross-Site Scripting (XSS) in CTI Transmute Notification Panel via Malicious Convert Names

    A stored cross-site scripting (XSS) vulnerability exists in the notification panel of CTI Transmute in versions prior to the patched release. Notification messages containing user-controlled convert names were rendered in the notification bell dropdown using …

    MISP cti-transmute
  • Medium 6.8
    CVE-2026-8080 Public exploit

    MISP core - Stored XSS in MISP template (old engine) element attribute type

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in misp allows Stored XSS. This issue affects MISP before 2.5.37. A stored cross-site scripting vulnerability exists in the template element attribute ha…

    MISP MISP