PT-2026-70102

Name of the Vulnerable Software and Affected Versions MISP cti-transmute affected versions not specified Description Several state-changing account operations are exposed as GET requests, making them susceptible to cross-site request forgery CSRF. CSRF is a flaw where a third-party site induces a...

PT-2026-70086

Name of the Vulnerable Software and Affected Versions cti-transmute affected versions not specified Description Insufficient validation of saved graph configuration data allows a malicious user to store a crafted svgIcon value. Since these configurations can be viewed by other users or...

PT-2026-70083

Name of the Vulnerable Software and Affected Versions cti-transmute affected versions not specified Description The software renders data from a remote MISP instance into the event-browser interface using HTML interpolation. A malicious or compromised remote server can control fields such as even...

PT-2026-70100

Affected versions of cti-transmute contain an SSRF vulnerability in the /fetch misp event and /misp search events endpoints. The URL validation routine checked whether a supplied hostname was itself an IP literal and rejected private, loopback, link-local, or reserved IPs. However, ordinary domai...

PT-2026-70079

Name of the Vulnerable Software and Affected Versions cti-transmute affected versions not specified Description The software fails to apply comment-level access-control rules during the generation of evaluation report exports. While standard comment retrieval correctly filters based on conversion...

PT-2026-70082

Name of the Vulnerable Software and Affected Versions cti-transmute affected versions not specified Description The software fails to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names, which may originate from STIX or MISP data—including...

CVE-2026-72760

Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another account, getfollowing includes the followed user's email field in the API response alongside their name, user ID, and follow date. Becaus...

CVE-2026-72759

In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns None. The previous logic only denied access when the conversion object...

EUVD-2026-55636

Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another account, getfollowing includes the followed user's email field in the API response alongside their name, user ID, and follow date. Becaus...

CVE-2026-72760

The CVE-2026-72760 issue affects MISP cti-transmute where the account following-list endpoint returns the followed user’s email field in get_following() in addition to name, user ID, and follow date. The root cause is that email is included in the API response despite not being required for follo...

EUVD-2026-55635

In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns None. The previous logic only denied access when the conversion object...

CVE-2026-72759 cti-transmute Conversion History Authorization Bypass Leads to Sensitive Data Disclosure After Conversion Deletion

In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns None. The previous logic only denied access when the conversion object...

CVE-2026-72759

CVE-2026-72759 affects MISP cti-transmute. The vulnerability lies in the conversion-history details endpoint, where an incomplete authorization check allows disclosure when a history entry references a deleted conversion. If the conversion lookup returns None, access was not properly denied; as a...

CVE-2026-72751

CTI-Transmute’s conversion graph is affected by a stored XSS in the Pivotick-based UI. Attacker-controlled CTI data could inject HTML/JS into node labels, edge labels, node properties, edge properties, and node types, with HTML rendering paths and a vulnerable raw-JSON usage via document.write. T...

EUVD-2026-55633

CTI-Transmute is affected by a stored cross-site scripting XSS vulnerability in the conversion graph used to visualise converted MISP and STIX content. Attacker-controlled values originating from converted CTI data were passed to multiple HTML-parsing sinks in the graph user interface without...

CVE-2026-72751 Stored Cross-Site Scripting in CTI-Transmute Conversion Graph via Malicious STIX/MISP Content

CTI-Transmute is affected by a stored cross-site scripting XSS vulnerability in the conversion graph used to visualise converted MISP and STIX content. Attacker-controlled values originating from converted CTI data were passed to multiple HTML-parsing sinks in the graph user interface without...

CVE-2026-71502 Unauthenticated Stored Vue Template Injection Leads to Cross-Site Scripting in CTI-Transmute

CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue...

CVE-2026-71502 Unauthenticated Stored Vue Template Injection Leads to Cross-Site Scripting in CTI-Transmute

CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue...

CVE-2026-71502

CTI-Transmute is impacted by an unauthenticated stored XSS via Vue template expression injection. The vulnerability arises from insufficient neutralization of Vue {{…}} / [[…]] delimiters in server-rendered user-controlled data (e.g., public conversion names/descriptions; possible user profile na...

CVE-2026-69079 Unauthenticated Denial of Service via Unbounded Activity-Timeline Range in CTI-Transmute

CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activitytimeline endpoint. The endpoint accepts a user-controlled days query parameter that was not restricted to a reasonable range. A remote, unauthenticated attacker could submit an excessively...