CVE-2026-104907 MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler

MISP contains a cross-site scripting XSS vulnerability in the remote event preview page. When a linked remote MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript...