Pwdlyser

Pwdlyser New repo for Public release Pwdlyser P assw ord -Analyser is a multi-functional analysis tool created to provide security professionals and organisations aiming to improve their security posture with the ability to easily review and analyse passwords from Active Directory domain accounts...

CVE-2026-110621 Swetrix Cloud before 5.1.0 Missing Authorization via POST /project/organisation/:orgId

Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking I...

CVE-2026-110621

Swetrix Cloud versions prior to 5.1.0 are affected by a missing authorization vulnerability in the ProjectController.addProject function. This flaw allows authenticated users to hijack arbitrary projects by moving them into their own organization using a public tracking ID. Successful exploitatio...

CVE-2026-110621 Swetrix Cloud before 5.1.0 Missing Authorization via POST /project/organisation/:orgId

Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking I...

CVE-2026-89112 Broken Access Control in CLA-Assistant � CLA Signature PII Disclosure

The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is specified using an organisation ID.An authenticated user with limited privileges could potentially access CLA signature records containing...

CVE-2026-56423-MISP-deleteSelection-BrokenAccessControl

CVE-2026-56423 — MISP deleteSelection Broken Access Control Proof of concept for a missing-authorization flaw in MISP's bulk deletion flows for Event Reports and Sharing Groups. The deleteSelection handlers authorize each selected item with a callback that ignores the item and returns the caller'...

CVE-2026-103239

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any...

CVE-2026-103239

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any...

EUVD-2026-89761

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any...

CVE-2026-103239

The MISP platform is vulnerable to a privilege escalation flaw in the tag collection creation and editing functionality (versions

CVE-2026-103239 MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any...

CVE-2026-103239 MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any...

PT-2026-103117

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any...

CVE-2026-103239: Improper Access Control

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any...

Dual-Fit Imperative in Security Leadership: A Grounded Theory Investigation of CISO Role Enactment in Modern Organisations

The Chief Information Security Officer CISO has emerged as a strategically prominent executive role, confronting an adversarial environment, irreconcilable accountability tensions between security and business enablement, and a prevention paradox in which success remains invisible to resource...

PT-2026-96768

MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group SG edit...

PT-2026-96831

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The...

CVE-2026-90957 MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures

Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. The commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal , they can execute when the S...

EUVD-2026-77467

Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. The commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal , they can execute when the S...

CVE-2026-90957 MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures

Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. The commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal , they can execute when the S...