misp vulnerabilities

Products

• misp 154
• cti-transmute 17
• misp-modules 7
• misp-stix 4
• misp-guard 3
• bsimvis 1
• misp malware information sharing platform 1
• misp modules 1
• misp modules html to markdown expansion module 1
• misp-maltego 1
• sachertortephp 1
• sachertortephp cakephp-based misp application 1

Latest misp CVEs

Newest publication first · page 1 of 8

1. CVE-2026-127046 MISP Modules Website Exposes External Tool API Keys in /external_tools/list Response

   Published 2026-11-12

   Critical·CVSS 9.2

   The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /external_tools/list endpoint returned stored API keys (the api_key field) in its JSON response via the ExternalTools model serializer. Additionally...

2. CVE-2026-127016 MISP Modules Website: Missing Authorization on External Tool Management Endpoints

   Published 2026-11-12

   Critical·CVSS 9.2 EPSS 0.60%

   The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that did not enforce the optional administrator authentication policy. When ADMIN_PASSWORD was configured in the application environment, the modul...

3. CVE-2026-126991 SPARQL Injection in MISP Wikidata Lookup Module via Unescaped User Input

   Published 2026-11-12

   Medium·CVSS 5.3 EPSS 0.28%

   The Wikidata Lookup expansion module (wiki.py) in MISP misp-modules contained a SPARQL injection vulnerability. The handler function constructed a SPARQL query by directly concatenating the user-supplied text value into the query string without any escaping or parameterization: '...

4. CVE-2026-125871 MISP sourcecache module SSRF allows fetching arbitrary internal URLs via attribute enrichment

   Published 2026-11-10

   Medium·CVSS 6.3 EPSS 0.27%

   The sourcecache expansion module in MISP Modules (misp-modules) contains a Server-Side Request Forgery (SSRF) vulnerability. When a user with permission to create or modify attributes of type 'link' or 'url' submits an attribute value, the module passes the URL directly to its in...

5. CVE-2026-118173 MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy Tags to Bypass Feed Policy Enforcement

   Published 2026-10-27

   Medium·CVSS 6.1 EPSS 0.30%

   MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags. When a feed event or its attributes carried tags belonging to a required taxonomy (for example, TLP), the guard only verified that at least...

6. CVE-2026-116469 MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding

   Published 2026-10-26

   High·CVSS 7.1 EPSS 0.37%

   MISP Guard, a proxy-based security filter for MISP feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions check_required_taxonomy_exists, check_required_taxonomy_tags_allowed, check_blocked_attribute_categories, and check_blocked_...

7. CVE-2026-116372 MISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rules

   Published 2026-10-26

   High·CVSS 7.7 EPSS 0.36%

   MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules. The process_feed_response method in src/mispguard.py was responsible for evaluating feed responses before they reached the MISP instance. The original logic only e...

8. CVE-2026-112991 MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()

   Published 2026-10-19

   Medium·CVSS 6.3 EPSS 0.32%

   The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function. The BLOCKED_RANGES list used to reject unsafe destination addresses was incomplete, omitting several critical IP address...

9. CVE-2026-112192 MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings

   Published 2026-10-19

   Medium·CVSS 5.3 EPSS 0.37%

   MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata. As a result: A module that marks a se...

10. CVE-2026-112188 MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution

    Published 2026-10-19

    High·CVSS 7.1 EPSS 0.27%

    MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a...

11. CVE-2026-112184 MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels

    Published 2026-10-19

    Medium·CVSS 4.8 EPSS 0.35%

    MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the pa...

12. CVE-2026-112183 MISP CSS Injection via Remote Tag Colour in Event Preview

    Published 2026-10-19

    Medium·CVSS 4.8 EPSS 0.29%

    MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Althoug...

13. CVE-2026-112180 MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records

    Published 2026-10-19

    Medium·CVSS 5.1 EPSS 0.33%

    MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph entries, proposal (shado...

14. CVE-2026-112179 MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances

    Published 2026-10-19

    Medium·CVSS 5.3 EPSS 0.31%

    In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report. As a result: All reports...

15. CVE-2026-112178 MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control

    Published 2026-10-19

    High·CVSS 7.1 EPSS 0.23%

    MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to prop...

16. CVE-2026-107278 MISP Object Sync Drops Objects and Attributes When Description Is Empty

    Published 2026-10-07

    Medium·CVSS 5.3 EPSS 0.25%

    MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving ins...

17. CVE-2026-107276 MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests

    Published 2026-10-07

    Medium·CVSS 6.3 EPSS 0.21%

    MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the s...

18. CVE-2026-107180 MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances

    Published 2026-10-07

    High·CVSS 7.1 EPSS 0.32%

    On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issu...

19. CVE-2026-107175 MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes

    Published 2026-10-07

    Medium·CVSS 5.3 EPSS 0.21%

    MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified. When a user edits an existing event and changes its distribution or sharing_group_id, the intern...

20. CVE-2026-106513 MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change

    Published 2026-10-06

    Medium·CVSS 6.9 EPSS 0.64%

    MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin—through its web UI and API to site-admin users. The background job workers trust raw Redis job payloads without...

21. CVE-2026-106512 MISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSS

    Published 2026-10-06

    High·CVSS 8.4 EPSS 0.33%

    The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist in the unpatched code. First...

22. CVE-2026-104914 MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View

    Published 2026-10-02

    Medium·CVSS 5.3 EPSS 0.22%

    MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints. When a user queries for soft-deleted attributes (e.g., via the deleted-attributes search or the paginated attribute listing), the application returned soft-delet...

23. CVE-2026-104912 MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data

    Published 2026-10-02

    High·CVSS 7.1 EPSS 0.21%

    MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system authorized access to correlated attributes and events based on a stale distribution snapshot stored on...

24. CVE-2026-104910 MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization

    Published 2026-10-02

    Medium·CVSS 5.3 EPSS 0.28%

    MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the system retrieved related event metadata directly from the correlation table without re-validating the caller's access rights...

25. CVE-2026-104908 MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging

    Published 2026-10-02

    High·CVSS 7.1 EPSS 0.29%

    MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying model belonging exclusively to the importing user's organisation, with the default flag forced to off. However, the appli...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.