MISP vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-116469 MISP Guard, a proxy-based security filter for MISP feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks.High 7.1 · Oct 26, 2026
• CVE-2026-116372 MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules.High 7.7 · Oct 26, 2026
• CVE-2026-112188 MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should havHigh 7.1 · Oct 19, 2026
• CVE-2026-112178 MISP contains an access control flaw in the proposal (shadow attribute) visibility logic.High 7.1 · Oct 19, 2026
• CVE-2026-107180 On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication setup applied only toHigh 7.1 · Oct 7, 2026
• CVE-2026-106512 The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filHigh 8.4 · Oct 6, 2026
• CVE-2026-104912 MISP contains an authorization flaw in its correlation handling during attribute searches.High 7.1 · Oct 2, 2026
• CVE-2026-104908 MISP contains an improper input validation vulnerability in the decaying model import functionality.High 7.1 · Oct 2, 2026
• CVE-2026-103659 MISP contains an authorization bypass in the event flattening feature.High 7.1 · Oct 1, 2026
• CVE-2026-103655 MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once withCritical 9.3 · Oct 1, 2026
• CVE-2026-103651 MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (paper) token and rewinding of the token High 7.6 · Oct 1, 2026
• CVE-2026-103321 MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature.High 8.3 · Sep 30, 2026
• CVE-2026-103239 MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality.High 8.6 · Sep 30, 2026
• CVE-2026-103237 MISP contains an improper input validation vulnerability in its ORM save path.High 8.3 · Sep 30, 2026
• CVE-2026-103235 MISP contains a mass assignment vulnerability in the event delegation feature.High 8.7 · Sep 30, 2026
• CVE-2026-95806 MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point.High 7.7 · Sep 22, 2026
• CVE-2026-94404 MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’s browser without that user knowingly approving thHigh 7.1 · Sep 21, 2026
• CVE-2026-94401 MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services.High 8.3 · Sep 21, 2026
• CVE-2026-94383 The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension.High 8.6 · Sep 21, 2026
• CVE-2026-94381 MISP has a security issue that can let a user gain more access than their API key is supposed to allow.High 8.7 · Sep 21, 2026
• CVE-2026-94374 MISP contains an insecure direct object reference vulnerability in the processModuleResultsData method of the Event model.High 8.3 · Sep 21, 2026
• CVE-2026-93296 MISP contains a stored cross-site scripting (XSS) vulnerability in the Overmind theme's statistics views.High 8.5 · Sep 17, 2026
• CVE-2026-93295 MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user.High 8.7 · Sep 17, 2026
• CVE-2026-91846 Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access tHigh 7.1 · Sep 15, 2026
• CVE-2026-91825 Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path.High 7.1 · Sep 15, 2026