CVE-2026-91851

Affected versions of MISP incorrectly filter dashboard templates that are restricted to a specific permission flag. DashboardsController::listTemplates allowed a template when either: - its restricttopermissionflag matched one of the current user’s permission flags, or - restricttopermissionflag...

CVE-2026-78619

Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totpuserecovery compares user identifiers numerically. The helper searches the recovery model for the submitted code's digest alone, across every user's rows, so the ownersh...