MISP has 88 CVEs on record. Disclosure cadence is accelerating: 88 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 57. The median CVSS is 6.3 (medium), with 2 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-79 (21) and CWE-20 (18). Most affected products: MISP (81), misp-guard (3), misp-modules (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.3
- Publish → KEV
- —
- Last 90 days
- 88 prev 0
Weakness classes
Products
- MISP 81
- misp-guard 3
- misp-modules 2
- sachertortephp 2
Worst active — by depth score
CVE-2026-103655Critical· 9.3MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow w…51CVE-2026-90961Critical· 9.3The LdapAuth and LinOTPAuth authentication plugins in MISP contain an authentication bypass vulnerability51CVE-2026-86283High· 7.1MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp) performed a secondary query of member events by UUID without applying the caller's access control list (ACL)51CVE-2026-103235High· 8.7MISP contains a mass assignment vulnerability in the event delegation feature48CVE-2026-94381High· 8.7MISP has a security issue that can let a user gain more access than their API key is supposed to allow. A read-only API key should only let someone view information48
MISP vulnerabilities
CVEs affecting MISP, newest first. Open any entry for full detail, references, and exploit status.
88 CVEsRSS
CVE-2026-118173Medium· 6.1MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy Tags to Bypass Feed Policy Enforcement
MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags. When a feed event or its attributes carried tags belonging to a required taxonomy (for example, T…
CVE-2026-116469High· 7.1MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding
MISP Guard, a proxy-based security filter for MISP feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions check_required_taxonomy_exists, check_required_taxonomy_tags_allowed, check_block…
CVE-2026-116372High· 7.7MISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rules
MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules. The process_feed_response method in src/mispguard.py was responsible for evaluating feed responses before they reached t…
CVE-2026-112991Medium· 6.3MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()
The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function. The BLOCKED_RANGES list used to reject unsafe destination addresses was incom…
CVE-2026-112192Medium· 5.3MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings
MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration meta…
CVE-2026-112188High· 7.1MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution
MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name…
CVE-2026-112184Medium· 4.8MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels
MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output enc…
CVE-2026-112183Medium· 4.8MISP CSS Injection via Remote Tag Colour in Event Preview
MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attri…
CVE-2026-112178High· 7.1MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control
MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and de…
CVE-2026-112179Medium· 5.3MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances
In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each …
CVE-2026-112180Medium· 5.1MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records
MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report…
CVE-2026-107278Medium· 5.3MISP contains a validation flaw in its object synchronization logic
MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instanc…
CVE-2026-107276Medium· 6.3MISP contains a race condition in the email-based one-time password (OTP) login flow
MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cau…
CVE-2026-107180High· 7.1On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests
On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in…
CVE-2026-107175Medium· 5.3MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified. When a user edits an existing event and changes its …
MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified. When a user edits an existing event and changes its …
CVE-2026-106512High· 8.4The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization
The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection…
CVE-2026-106513Medium· 6.9MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin—through its web UI and API to site-admin users
MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin—through its web UI and API to site-admin users. The background job w…
CVE-2026-104914Medium· 5.3MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints. When a user queries for soft-deleted attributes (e.g., via the deleted-attributes search or the paginated attribute l…
MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints. When a user queries for soft-deleted attributes (e.g., via the deleted-attributes search or the paginated attribute l…
CVE-2026-104912High· 7.1MISP contains an authorization flaw in its correlation handling during attribute searches
MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system authorized access to correlated attributes and events based…
CVE-2026-104910Medium· 5.3MISP contains an authorization bypass in the related events listing functionality
MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the system retrieved related event metadata directly from the correlation table witho…
CVE-2026-104908High· 7.1MISP contains an improper input validation vulnerability in the decaying model import functionality
MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying model belonging exclusively to the importing user's organisation, with the def…
CVE-2026-104907Medium· 4.8MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page
MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page. When a linked (remote) MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag…
CVE-2026-104906Medium· 6.2MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer
MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An atta…
CVE-2026-104901Medium· 5.1MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature
MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked (remote) MISP servers for corresponding event identifiers. The event ID retur…
CVE-2026-104900Medium· 5.3MISP contains a stored cross-site scripting (XSS) vulnerability in the index table rendering of the remote event preview
MISP contains a stored cross-site scripting (XSS) vulnerability in the index table rendering of the remote event preview. The count field template escaped the associated link URL but rendered the field value without HTML encoding. An att…
CVE-2026-103858Medium· 5.3MISP contains an incomplete authorization check in the discussion posting functionality
MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only verified whether the target thread was restricted to a s…
CVE-2026-103664Medium· 4.8MISP contains a reflected cross-site scripting (XSS) vulnerability in the analyst data notes panel
MISP contains a reflected cross-site scripting (XSS) vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response w…
CVE-2026-103662Medium· 5.1MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag). The affected forms echoed a user-supplied tag name value from the request unescaped i…
MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag). The affected forms echoed a user-supplied tag name value from the request unescaped i…
CVE-2026-103659High· 7.1MISP contains an authorization bypass in the event flattening feature
MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-leve…
CVE-2026-103655Critical· 9.3MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow w…
MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow w…