CVE-2026-95671

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...

EUVD-2026-84380

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...

CVE-2026-95671 MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...

CVE-2026-95671

CVE-2026-95671 affects MISP (Malware Information Sharing Platform). The CollectionsController add() method only enforced the sharing-group authorization check for POST requests, while the underlying CRUDComponent::add() persists data on both POST and PUT requests. An authenticated user could ther...

CVE-2026-95671 MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...

CVE-2026-95671 MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...

CVE-2026-95671: Missing Authorization

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...

PT-2026-96726

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description An authenticated user can bypass sharing-group authorization checks by sending a PUT request instead of a POST request to the 'collections/add' endpoint. This occurs because the add method in th...

EUVD-2026-80933

SIMAC MyPHR 1.1 contains an insecure direct object reference IDOR vulnerability that allows authenticated attackers to access and modify arbitrary employee records due to missing server-side ownership validation. Attackers can send a PUT request to the employee update endpoint with an arbitrary...

CVE-2026-27564

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials allowing execution of commands with root privileges on the device...

CVE-2026-27562

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing execution of commands with root privileges on the device...

CVE-2026-27564

CVE-2026-27564 is a command injection vulnerability in the /api/datastorage/data endpoint, where a remote attacker holding admin credentials can send a PUT request to execute arbitrary commands with root privileges on the device. The specific affected product is not named in the provided document...

CVE-2026-27564 Command Injection via PUT in /api/datastorage/data

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials allowing execution of commands with root privileges on the device...

EUVD-2026-80247

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials allowing execution of commands with root privileges on the device...

CVE-2026-27564 Command Injection via PUT in /api/datastorage/data

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials allowing execution of commands with root privileges on the device...

CVE-2026-27562

CVE-2026-27562 is a command injection vulnerability in the /api/iodd/config endpoint. A remote attacker with admin-level credentials can send a crafted PUT request to execute arbitrary commands with root privileges on the affected device. The CVSS 3.1 score is 7.2 (HIGH) (AV:N/AC:L/PR:H/UI:N/S:U/...

CVE-2026-27562 Command Injection via PUT in /api/iodd/config

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing execution of commands with root privileges on the device...

PT-2026-93357

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials allowing execution of commands with root privileges on the device...

PT-2026-93355

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing execution of commands with root privileges on the device...

CVE-2026-55636

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures the validating webhook with namespace/finalize instead of the Kubernetes resource name namespaces/finalize. A user with namespaces/finalize RBAC c...