MISP MISP vulnerabilities

CVEs per yearBy the year they were published

1. 20257
2. 2026143

Newest CVEs

• CVE-2026-112192

  MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings

  MISP · MISP

  Medium5.3
• CVE-2026-112188

  MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution

  MISP · MISP

  High7.1
• CVE-2026-112184

  MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels

  MISP · MISP

  Medium4.8
• CVE-2026-112183

  MISP CSS Injection via Remote Tag Colour in Event Preview

  MISP · MISP

  Medium4.8
• CVE-2026-112180

  MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records

  MISP · MISP

  Medium5.1
• CVE-2026-112179

  MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances

  MISP · MISP

  Medium5.3
• CVE-2026-112178

  MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control

  MISP · MISP

  High7.1
• CVE-2026-107278

  MISP Object Sync Drops Objects and Attributes When Description Is Empty

  MISP · MISP

  Medium5.3
• CVE-2026-107276

  MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests

  MISP · MISP

  Medium6.3
• CVE-2026-107180

  MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances

  MISP · MISP

  High7.1