CVE-2026-73156

Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names may originate directly from STIX or MISP data, including STIX types, relationshiptype, pattern prefixes, and MISP category/type values. Since...

CVE-2026-19418

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 CVE-2020-11069 became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated fro...

Server-Side Request Forgery (SSRF)

Apache Camel is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper filtering of inbound WebSocket query and path parameters, allowing an attacker to inject Camel control headers such as CamelHttpUri, which can redirect server-side HTTP requests to...

CVE-2026-73157 cti-transmute Remote MISP Event Browser Allows Cross-Site Scripting via Malicious Event Metadata

Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as event IDs, event information, organization names, tags, tag colors, TLP labels, distribution labels, and error/flash text may be...

CVE-2026-73157

Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as event IDs, event information, organization names, tags, tag colors, TLP labels, distribution labels, and error/flash text may be...

CVE-2026-73157 cti-transmute Remote MISP Event Browser Allows Cross-Site Scripting via Malicious Event Metadata

Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as event IDs, event information, organization names, tags, tag colors, TLP labels, distribution labels, and error/flash text may be...

CVE-2026-73157

Vulnerability overview: CVE-2026-73157 affects the cti-transmute remote MISP event browser. The exploit stems from HTML interpolation of remote MISP fields (event IDs, info, organization names, tags, TLP, etc.), enabling injection of HTML/script content into the event-browser UI when a malicious/...

CVE-2026-73157 cti-transmute Remote MISP Event Browser Allows Cross-Site Scripting via Malicious Event Metadata

Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as event IDs, event information, organization names, tags, tag colors, TLP labels, distribution labels, and error/flash text may be...

EUVD-2026-55975

Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as event IDs, event information, organization names, tags, tag colors, TLP labels, distribution labels, and error/flash text may be...

Improper Input Validation

Apache Camel is vulnerable to Improper Input Validation. The vulnerability is due to the Dapr Pub/Sub consumer copying attacker-controlled CloudEvent fields into producer routing headers, which allows an attacker with permission to publish to the subscribed topic to manipulate the destination and...

CVE-2026-73156

CVE-2026-73156 affects ct i-transmute: HTML-escaping is missing in ECharts Sunburst/Treemap tooltip formatters, allowing injected content via STIX/MISP-derived slice names. The fix adds formatter functions that call escapeHtml() on p.name, p.data.value, and p.value to prevent HTML/script executio...

CVE-2026-73156

Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names may originate directly from STIX or MISP data, including STIX types, relationshiptype, pattern prefixes, and MISP category/type values. Since...

CVE-2026-73156 cti-transmute Sunburst and Treemap Tooltips Allow Cross-Site Scripting via Crafted Conversion Data

Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names may originate directly from STIX or MISP data, including STIX types, relationshiptype, pattern prefixes, and MISP category/type values. Since...

EUVD-2026-55973

Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names may originate directly from STIX or MISP data, including STIX types, relationshiptype, pattern prefixes, and MISP category/type values. Since...

CVE-2026-73156 cti-transmute Sunburst and Treemap Tooltips Allow Cross-Site Scripting via Crafted Conversion Data

Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names may originate directly from STIX or MISP data, including STIX types, relationshiptype, pattern prefixes, and MISP category/type values. Since...

CVE-2026-73156 cti-transmute Sunburst and Treemap Tooltips Allow Cross-Site Scripting via Crafted Conversion Data

Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names may originate directly from STIX or MISP data, including STIX types, relationshiptype, pattern prefixes, and MISP category/type values. Since...

Improper Input Validation

Apache Camel is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of user-supplied input, allowing specially crafted input to bypass expected processing logic and potentially affect application behavior or security...

EUVD-2026-55972

Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether those users are authorized to view the target comment. The vulnerable react handler passed an attacker-controlled commentid directly to...

CVE-2026-73155

The CVE concerns cti-transmute: affected versions allow authenticated users to add or remove emoji reactions on private/inaccessible comments without checking visibility. Root cause: react() forwarded an attacker-controlled comment_id to comments_repo.toggle_reaction() after only syntactic existe...

CVE-2026-73155 cti-transmute Missing Authorization Allows Reactions to Private Comments

Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether those users are authorized to view the target comment. The vulnerable react handler passed an attacker-controlled commentid directly to...