EUVD-2026-104128

In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report. As a result: - All reports except the las...

CVE-2026-112179

The MISP event synchronization process contains a logic error in how event reports are prepared for remote push. Specifically, the filtering of non-exportable tags is applied only once after iterating over all reports, instead of being applied to each individual report. This flaw allows all repor...

CVE-2026-112179 MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances

In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report. As a result: - All reports except the las...

EUVD-2026-104098

The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before embedding them in a single-quoted HTML attribute in the rendered gallery markup, allowing users with the Contributor role and above to inject arbitrary event handlers that...

CVE-2026-112180: Incomplete Cleanup

MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph entries, proposal shadow attribute...

PT-2026-117634

Name of the Vulnerable Software and Affected Versions markdown-it versions prior to 14.3.3 markdown-it versions prior to 15.0.3 Description When the html option or commonmark preset is enabled, the parser can be forced into quadratic processing time when encountering repeated unterminated inline...

PT-2026-117387

Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1...

CVE-2026-111766: Uncontrolled Resource Consumption

markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA...

CVE-2026-112183: Improper Neutralization of Special Elements in Output Used by a Downstream Component

MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity...

Azure Event Grid Broker Spoofing

The vulnerability of Azure Event Grid brokers is related to deficiencies in the authentication process. Exploiting this vulnerability could allow attackers to carry out spoofing attacks remotely...

CVE-2026-110902: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1...

PT-2026-117273

In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report. As a result: - All reports except the las...

PT-2026-117306

MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity...

CVE-2026-112179: Exposure of Sensitive Information to an Unauthorized Actor

In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report. As a result: - All reports except the las...

PT-2026-117247

Name of the Vulnerable Software and Affected Versions Document Gallery WordPress plugin versions prior to 5.1.2 Description Insufficient sanitization and escaping of several gallery shortcode attributes occur before they are embedded in a single-quoted HTML attribute within the rendered gallery...

EUVD-2025-26393

A low-privileged attacker in bluetooth range may be able to access the password of a higher-privilege user Maintenance by viewing the device’s event log. This vulnerability could allow the Operator to authenticate as the Maintenance user, thereby gaining unauthorized access to sensitive...

MISP input validation error vulnerability

Versions of MISP 2.5.48 and earlier contain a vulnerability related to input validation errors. This vulnerability arises from the remote event preview feature improperly validating tag value colors before directly writing them into inline CSS style properties. This can lead to arbitrary CSS...

MISP information leakage vulnerability

Versions of MISP 2.5.48 and earlier have a vulnerability related to information leakage. This vulnerability arises from logical errors during the event synchronization process, where labels that cannot be exported are only filtered once after traversing all reports, rather than being filtered...

MISP Resource Management Error Vulnerability

MISP 2.5.48 and earlier versions have a resource management vulnerability. This vulnerability stems from a data integrity flaw in the event deletion logic. When events are deleted, related records such as event report labels, event graph entries, proposal associations, ssdeep-associated blocks, a...

Nexcess Event Tickets Authorization Vulnerability

Nexcess Event Tickets versions 5.30.1 and earlier have an authorization issue vulnerability. This vulnerability stems from unauthorized authorization through user-controlled keys. Improper configuration of access control levels may lead to exploitation of these vulnerabilities...