https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-85239.htmlhttps://patchthecve.com/cve/CVE-2026-85239.htmlFri, 11 Sep 2026 14:18:55 +0000MEDIUM 6.5: A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field. The EventTemplate::beforeValidate() method only performed semantic validation when the supplied definition was ahttps://patchthecve.com/cve/CVE-2026-85238.htmlhttps://patchthecve.com/cve/CVE-2026-85238.htmlFri, 11 Sep 2026 14:17:04 +0000MEDIUM 6.8: MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier. As a resuhttps://patchthecve.com/cve/CVE-2026-85237.htmlhttps://patchthecve.com/cve/CVE-2026-85237.htmlFri, 11 Sep 2026 14:15:51 +0000HIGH 8.1: A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts. The email_otp() endpoint did not apply brute-force protection when validating submitted OTP values. An attacker who had reached the https://patchthecve.com/cve/CVE-2026-85236.htmlhttps://patchthecve.com/cve/CVE-2026-85236.htmlFri, 11 Sep 2026 14:14:30 +0000HIGH 8.8: A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible operation while accepting HTTP GET requests. Because bodyless GET requests are not subject to CakePHP's CSRF validation, an attacker could causehttps://patchthecve.com/cve/CVE-2026-85230.htmlhttps://patchthecve.com/cve/CVE-2026-85230.htmlThu, 10 Sep 2026 19:37:59 +0000MEDIUM 5.4: A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered and were not validated when the configuration was saved. As a result, an authenticated user able to modify dashboard widget https://patchthecve.com/cve/CVE-2026-85227.htmlhttps://patchthecve.com/cve/CVE-2026-85227.htmlThu, 10 Sep 2026 19:38:21 +0000MEDIUM 6.1: MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML escaping before being serialized as JSON and embedded inside a <https://patchthecve.com/cve/CVE-2026-85226.htmlhttps://patchthecve.com/cve/CVE-2026-85226.htmlThu, 10 Sep 2026 19:39:34 +0000MEDIUM 4.3: MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distribution, sharing group, organization, or other access-control restrictions associated with the correlated attributes and events. Ahttps://patchthecve.com/cve/CVE-2026-85221.htmlhttps://patchthecve.com/cve/CVE-2026-85221.htmlThu, 10 Sep 2026 19:40:05 +0000CRITICAL 9.1: MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and therefore defaulted to null. When passed to cURL, this value effectively disabled TLS peer verification unless the calling code explicitly enabledhttps://patchthecve.com/cve/CVE-2026-85216.htmlhttps://patchthecve.com/cve/CVE-2026-85216.htmlThu, 10 Sep 2026 19:42:07 +0000CRITICAL 9.8: MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. The custom LdapAuthenticate and LinOTPAuthenticate components replace CakePHP's FormAuthenticate implementation but did not replicate it