CVE-2026-94277

MISP's galaxy matrix statistics view app/View/Users/statisticsgalaxymatrix.ctp renders the galaxy name directly into HTML output via sprintf without any HTML encoding. An authenticated user holding the permgalaxyeditor permission can create or modify a galaxy whose name contains arbitrary HTML or...