CVE-2026-112184 MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels

MISP contains a reflected cross-site scripting XSS vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names...

CVE-2026-112184

The MISP workflow module is vulnerable to reflected cross-site scripting (XSS) in versions prior to 2.5.48 . The root cause is the lack of output encoding when rendering parameter names from the misp-modules service as HTML form labels. An attacker capable of influencing these parameter names can...

CVE-2026-112184 MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels

MISP contains a reflected cross-site scripting XSS vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names...

EUVD-2026-104142

MISP contains a reflected cross-site scripting XSS vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names...

CVE-2026-112184 MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels

MISP contains a reflected cross-site scripting XSS vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names...

CVE-2026-112179

In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report. As a result: - All reports except the las...

CVE-2026-112178

MISP contains an access control flaw in the proposal shadow attribute visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own...

CVE-2026-112180

MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph entries, proposal shadow attribute...

CVE-2026-112183 MISP CSS Injection via Remote Tag Colour in Event Preview

MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity...

CVE-2026-112183 MISP CSS Injection via Remote Tag Colour in Event Preview

MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity...

EUVD-2026-104139

MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity...

CVE-2026-112183 MISP CSS Injection via Remote Tag Colour in Event Preview

MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity...

CVE-2026-112183

The MISP application is vulnerable to CSS injection in its remote event preview feature (versions

CVE-2026-112180 MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records

MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph entries, proposal shadow attribute...

CVE-2026-112180 MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records

MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph entries, proposal shadow attribute...

EUVD-2026-104129

MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph entries, proposal shadow attribute...

CVE-2026-112180

MISP versions prior to 2.5.48 are vulnerable to a data integrity flaw in the event deletion logic. When an authenticated user deletes an event, the system fails to remove associated records, including event report tags , graph entries , correlations , and attachment scan results . These orphaned ...

CVE-2026-112180 MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records

MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph entries, proposal shadow attribute...

EUVD-2026-104128

In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report. As a result: - All reports except the las...

CVE-2026-112179

The MISP event synchronization process contains a logic error in how event reports are prepared for remote push. Specifically, the filtering of non-exportable tags is applied only once after iterating over all reports, instead of being applied to each individual report. This flaw allows all repor...