misp-modules vulnerabilities

Latest misp-modules CVEs

Newest publication first

1. CVE-2026-127016 MISP Modules Website: Missing Authorization on External Tool Management Endpoints

   Published 2026-11-12

   Critical·CVSS 9.2 EPSS 0.60%

   The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that did not enforce the optional administrator authentication policy. When ADMIN_PASSWORD was configured in the application environment, the modul...

2. CVE-2026-126991 SPARQL Injection in MISP Wikidata Lookup Module via Unescaped User Input

   Published 2026-11-12

   Medium·CVSS 5.3 EPSS 0.28%

   The Wikidata Lookup expansion module (wiki.py) in MISP misp-modules contained a SPARQL injection vulnerability. The handler function constructed a SPARQL query by directly concatenating the user-supplied text value into the query string without any escaping or parameterization: '...

3. CVE-2026-125871 MISP sourcecache module SSRF allows fetching arbitrary internal URLs via attribute enrichment

   Published 2026-11-10

   Medium·CVSS 6.3 EPSS 0.27%

   The sourcecache expansion module in MISP Modules (misp-modules) contains a Server-Side Request Forgery (SSRF) vulnerability. When a user with permission to create or modify attributes of type 'link' or 'url' submits an attribute value, the module passes the URL directly to its in...

4. CVE-2026-97863 misp-modules: Shell Command Injection in MISP cisco_firesight_manager_ACL_rule_export Module via Unescaped Attribute Values

   Published 2026-09-25

   Medium·CVSS 6.3 EPSS 0.32%

   The cisco_firesight_manager_ACL_rule_export module in misp-modules generates a shell script (.sh) that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration values (IP address, login, password, domain ID, policy ID) and MISP attribute v...

5. CVE-2026-62143 Server-Side Request Forgery protection bypass in misp-modules html_to_markdown via IPv4-mapped IPv6 addresses

   Published 2026-07-13

   High·CVSS 8.3 EPSS 0.40%

   A Server-Side Request Forgery (SSRF) protection bypass existed in the html_to_markdown expansion module of misp-modules. The module attempts to prevent requests to loopback, private, link-local, and other restricted IP address ranges. However, IP addresses were compared against t...

6. CVE-2026-44363 Unsafe remote resource fetching in expansion misp-modules

   Published 2026-05-13

   Medium·CVSS 5.8 EPSS 0.10%

   MISP modules are autonomous modules that can be used to extend MISP for new services. Prior to 3.0.7, an unsafe remote resource fetching vulnerability existed in MISP Modules expansion modules. The html_to_markdown module accepted arbitrary HTTP(S) URLs without sufficient validat...

7. CVE-2026-44364 misp-modules website - Missing CSRF protection in the website home blueprint

   Published 2026-05-13

   Critical·CVSS 9.3 EPSS 0.19%

   MISP modules are autonomous modules that can be used to extend MISP for new services. In 3.0.7 and earlier, a Cross-Site Request Forgery vulnerability in the MISP Modules website allowed an attacker to cause an authenticated user to submit unintended requests to the home endpoint...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.