CVE-2026-85236

MISP is a threat intelligence platform. This CSRF vulnerability affected the cullEmptyEvents endpoint, which performed a state-changing, irreversible operation while accepting HTTP GET requests. Because bodyless GET requests bypass CakePHP's CSRF validation , an attacker could force an authentica...

CVE-2026-85236 MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request

A cross-site request forgery CSRF vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible operation while accepting HTTP GET requests. Because bodyless GET requests are not subject to CakePHP's CSRF validation, an attacker could cause ...

CVE-2026-85236 MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request

A cross-site request forgery CSRF vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible operation while accepting HTTP GET requests. Because bodyless GET requests are not subject to CakePHP's CSRF validation, an attacker could cause ...

EUVD-2026-70503

A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered and were not validated when the configuration was saved. As a result, an authenticated user able to modify dashboard widg...

CVE-2026-85230

CVE-2026-85230 is a persistent unsafe URL injection vulnerability in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only at render time, not when saved, allowing an authenticated user to persist arbitrary URLs—including javascript: scheme values—through either...

CVE-2026-85230 MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection

A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered and were not validated when the configuration was saved. As a result, an authenticated user able to modify dashboard widg...

CVE-2026-85227

MISP (threat intelligence platform) contains a reflected XSS in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into query-builder rules without HTML escaping before being serialized as JSON and embedded inside a sequenc...

CVE-2026-85227 Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters

MISP contains a reflected Cross-Site Scripting XSS vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML escaping before being serialized as JSON and embedded inside a...

EUVD-2026-70500

MISP contains a reflected Cross-Site Scripting XSS vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML escaping before being serialized as JSON and embedded inside a...

EUVD-2026-70499

MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distribution, sharing group, organization, or other access-control restrictions associated with the correlated attributes and events...

CVE-2026-85226

CVE-2026-85226 affects the OnDemand correlation engine in MISP , a threat intelligence platform. Correlations were computed solely from matching attribute values without applying distribution, sharing-group, or organization-level access controls , allowing an authenticated low-privileged user to ...

CVE-2026-85226 MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations

MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distribution, sharing group, organization, or other access-control restrictions associated with the correlated attributes and events...

EUVD-2026-70494

MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and therefore defaulted to null. When passed to cURL, this value effectively disabled TLS peer verification unless the calling code explicitly...

CVE-2026-85221

MISP 's CurlClient class contains an improper TLS certificate validation flaw. The CurlClient::$verifyPeer property was not explicitly initialized and defaulted to null, which effectively disabled TLS peer verification when passed to cURL. As a result, HTTPS connections made through affected inst...

CVE-2026-85221 MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacks

MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and therefore defaulted to null. When passed to cURL, this value effectively disabled TLS peer verification unless the calling code explicitly...

EUVD-2026-70510

MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. The custom LdapAuthenticate and LinOTPAuthenticate components replace CakePHP's FormAuthenticate implementation but did not replicate...

CVE-2026-85216

MISP contains an authentication bypass in its LDAP and LinOTP components. The custom LdapAuthenticate and LinOTPAuthenticate components replaced CakePHP's FormAuthenticate but failed to replicate its credential validation, allowing empty or non-string values to reach underlying mechanisms. In the...

CVE-2026-85216 MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials

MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. The custom LdapAuthenticate and LinOTPAuthenticate components replace CakePHP's FormAuthenticate implementation but did not replicate...

CVE-2026-56423-MISP-deleteSelection-BrokenAccessControl

CVE-2026-56423 — MISP deleteSelection Нарушенный контроль доступа Доказательство концепции для уязвимости отсутствия авторизации в механизмах массового удаления MISP для Event Reports и Sharing Groups. Обработчики deleteSelection авторизуют каждый выбранный элемент с помощью обратного вызова,...

CVE-2026-81820

Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: object UUID; object name; attribute value; attribute type; comment; first/last seen values; IDS flag. Those values were concatenated directly into HTML strings before rendering. The...