Pwdlyser

Pwdlyser New repo for Public release Pwdlyser P assw ord -Analyser is a multi-functional analysis tool created to provide security professionals and organisations aiming to improve their security posture with the ability to easily review and analyse passwords from Active Directory domain accounts...

CVE-2026-56423-MISP-deleteSelection-BrokenAccessControl

CVE-2026-56423 — MISP deleteSelection の不適切なアクセス制御 MISPの一括削除機能（Event Reports および Sharing Groups ）における認可欠落の欠陥に関する概念実証。 deleteSelection ハンドラは、選択された各アイテムをコールバックで認可しますが、そのコールバックはアイテムを無視し、呼び出し元の グローバルロール権限 （permadd / permsharinggroup）を返すため、オブジェクトごとの所有権チェックが行われません。その結果、低権限の contributor （デフォルトの "User"...

CVE-2026-103239

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any...

EUVD-2026-89761

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any...

CVE-2026-103239

The MISP platform is vulnerable to a privilege escalation flaw in the tag collection creation and editing functionality (versions

CVE-2026-103239 MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any...

CVE-2026-103239 MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any...

CVE-2026-103239: Improper Access Control

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any...

PT-2026-96768

MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group SG edit...

PT-2026-96831

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The...

CVE-2026-90957 MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures

Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. The commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal , they can execute when the S...

CVE-2026-90957

MISP versions ≤2.5.45 are affected by a stored XSS vulnerability in the serve path for uploaded SVG images , which are delivered inline without a restrictive browser sandbox. Because SVGs are XML documents rather than passive bitmaps, embedded [removed] elements, event handlers, or javascript: UR...

EUVD-2026-77467

Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. The commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal , they can execute when the S...

CVE-2026-90957 MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures

Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. The commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal , they can execute when the S...

CVE-2026-90957 MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures

Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. The commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal , they can execute when the S...

CVE-2026-86441

Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-related widgets did not honor Security.hideorganisationindexfromusers. As a result, authenticated users without the permsharinggroup permission...

CVE-2026-86418

Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint returned fields including: - organisation ID; - UUID;...

CVE-2026-86441 MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data

Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-related widgets did not honor Security.hideorganisationindexfromusers. As a result, authenticated users without the permsharinggroup permission...

EUVD-2026-72374

Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-related widgets did not honor Security.hideorganisationindexfromusers. As a result, authenticated users without the permsharinggroup permission...

CVE-2026-86441 MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data

Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-related widgets did not honor Security.hideorganisationindexfromusers. As a result, authenticated users without the permsharinggroup permission...