CVE-2026-93296

MISP's Overmind theme contains a stored XSS in its statistics views. The event General card (event_general.ctp) and server/feed preview card (preview_general.ctp) build donut chart legend labels by directly concatenating user-controllable object or category names into an innerHTML string without ...