misp vulnerabilities

CVEs per yearBy the year they were published

1. 20257
2. 2026175

Newest CVEs

• CVE-2026-118173

  MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy Tags to Bypass Feed Policy Enforcement

  MISP · misp-guard

  Medium6.1
• CVE-2026-116469

  MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding

  MISP · misp-guard

  High7.1
• CVE-2026-116372

  MISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rules

  MISP · misp-guard

  High7.7
• CVE-2026-112991

  MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()

  MISP · misp-modules

  Medium6.3
• CVE-2026-112192

  MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings

  MISP · MISP

  Medium5.3
• CVE-2026-112188

  MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution

  MISP · MISP

  High7.1
• CVE-2026-112184

  MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels

  MISP · MISP

  Medium4.8
• CVE-2026-112183

  MISP CSS Injection via Remote Tag Colour in Event Preview

  MISP · MISP

  Medium4.8
• CVE-2026-112180

  MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records

  MISP · MISP

  Medium5.1
• CVE-2026-112179

  MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances

  MISP · MISP

  Medium5.3