PatchTheCVE: misp

CVE-2026-85239: A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or m

Fri, 11 Sep 2026 14:18:55 +0000

MEDIUM 6.5: A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field. The EventTemplate::beforeValidate() method only performed semantic validation when the supplied definition was a

CVE-2026-85238: MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow

Fri, 11 Sep 2026 14:17:04 +0000

MEDIUM 6.8: MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier. As a resu

CVE-2026-85237: A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perfo

Fri, 11 Sep 2026 14:15:51 +0000

HIGH 8.1: A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts. The email_otp() endpoint did not apply brute-force protection when validating submitted OTP values. An attacker who had reached the

CVE-2026-85236: A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP

Fri, 11 Sep 2026 14:14:30 +0000

HIGH 8.8: A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible operation while accepting HTTP GET requests. Because bodyless GET requests are not subject to CakePHP's CSRF validation, an attacker could cause

CVE-2026-85230: A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration

Thu, 10 Sep 2026 19:37:59 +0000

MEDIUM 5.4: A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered and were not validated when the configuration was saved. As a result, an authenticated user able to modify dashboard widget

CVE-2026-85227: MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query buil

Thu, 10 Sep 2026 19:38:21 +0000

MEDIUM 6.1: MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML escaping before being serialized as JSON and embedded inside a <

CVE-2026-85226: MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated sole

Thu, 10 Sep 2026 19:39:34 +0000

MEDIUM 4.3: MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distribution, sharing group, organization, or other access-control restrictions associated with the correlated attributes and events. A

CVE-2026-85221: MISP contains an improper TLS certificate validation vulnerability in CurlClient

Thu, 10 Sep 2026 19:40:05 +0000

CRITICAL 9.1: MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and therefore defaulted to null. When passed to cURL, this value effectively disabled TLS peer verification unless the calling code explicitly enabled

CVE-2026-85216: MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to i

Thu, 10 Sep 2026 19:42:07 +0000

CRITICAL 9.8: MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. The custom LdapAuthenticate and LinOTPAuthenticate components replace CakePHP's FormAuthenticate implementation but did not replicate it

CVE-2026-56447: MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config setting to an arbitrary files

Tue, 23 Jun 2026 14:16:17 +0000

HIGH 7.2: MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config setting to an arbitrary filesystem path. MISP subsequently parsed the referenced INI file and passed its options to rdkafka. A crafted attacker-controlled configuration file could use rdkafka options such as plugin.libr

CVE-2026-56446: MISP allowed a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by J

Tue, 23 Jun 2026 16:17:05 +0000

HIGH 7.2: MISP allowed a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool. Because log entries can include attacker-controlled content, an authenticated attacker with site administrator privileges could direct log output to a PHP file in a web-accessibl

CVE-2026-56425: The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its OAuth 2.0

Fri, 26 Jun 2026 20:33:09 +0000

HIGH 8.8: The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its OAuth 2.0 authorization flow that could allow attackers to bypass important security guarantees provided by the protocol. The application used the PHP session identifier (session_id()) as the OAuth

CVE-2026-56424: MISP core contained multiple broken access-control flaws where authorization checks were performed against the

Tue, 23 Jun 2026 15:16:39 +0000

HIGH 8.8: MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong entity, or where ownership/editability checks were missing on write paths. In affected subsystems, a lower-privileged authenticated user with the relevant feature permission could cau

CVE-2026-56423: MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Grou

Tue, 23 Jun 2026 15:16:39 +0000

HIGH 8.8: MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The affected deleteSelection handlers authorized deletion using broad role-level permissions instead of validating authorization for each selected object. For Event Reports, EventReport