EUVD-2026-70981

MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...

CVE-2026-85546

MISP is affected by a cross-site request forgery (CSRF) vulnerability in its sharing group quick-edit functionality. The root cause lies in the __initialiseSGQuickEdit() helper, where the allowMethod(['post']) call was commented out, allowing the addOrg, removeOrg, addServer, and removeServer act...

CVE-2026-85546 MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests

MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...

CVE-2026-85546 MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests

MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...

CVE-2026-85546 MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests

MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...

CVE-2026-85533

An authorization flaw in MISP allowed an authenticated user to submit a sharinggroupid without verifying that the user was authorized to use the referenced Sharing Group. In several attribute and Galaxy Cluster creation and editing workflows, validation of the submitted Sharing Group was performe...

CVE-2026-85533

CVE-2026-85533 is an authorization bypass in MISP (Malware Information Sharing Platform). In attribute attachment/editing and Galaxy Cluster creation/editing workflows, the Sharing Group authorization check was only executed when the distribution field was explicitly set to 4. By omitting or mani...

CVE-2026-85533 MISP Sharing Group Authorization Bypass via Omitted Distribution Parameter

An authorization flaw in MISP allowed an authenticated user to submit a sharinggroupid without verifying that the user was authorized to use the referenced Sharing Group. In several attribute and Galaxy Cluster creation and editing workflows, validation of the submitted Sharing Group was performe...

CVE-2026-85533 MISP Sharing Group Authorization Bypass via Omitted Distribution Parameter

An authorization flaw in MISP allowed an authenticated user to submit a sharinggroupid without verifying that the user was authorized to use the referenced Sharing Group. In several attribute and Galaxy Cluster creation and editing workflows, validation of the submitted Sharing Group was performe...

EUVD-2026-70976

An authorization flaw in MISP allowed an authenticated user to submit a sharinggroupid without verifying that the user was authorized to use the referenced Sharing Group. In several attribute and Galaxy Cluster creation and editing workflows, validation of the submitted Sharing Group was performe...

CVE-2026-85533 MISP Sharing Group Authorization Bypass via Omitted Distribution Parameter

An authorization flaw in MISP allowed an authenticated user to submit a sharinggroupid without verifying that the user was authorized to use the referenced Sharing Group. In several attribute and Galaxy Cluster creation and editing workflows, validation of the submitted Sharing Group was performe...

PT-2026-85443

An authorization flaw in MISP allowed an authenticated user to submit a sharing group id without verifying that the user was authorized to use the referenced Sharing Group. In several attribute and Galaxy Cluster creation and editing workflows, validation of the submitted Sharing Group was...

CVE-2026-85546: Cross-Site Request Forgery (CSRF)

MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...

PT-2026-85656

In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Use a private URB for the notification endpoint scarlett2 init notify used mixer-urb, which snd usb mixer status create allocates for the UAC2 status interrupt endpoint and mixer.c manages. On a device with that...

PT-2026-85455

MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...

CVE-2026-85224

A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/filesharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit ha...

WordPress Social Media Share Buttons & Social Sharing Icons plugin < 3.0.1 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Social Media & Share Icons versions 3.0.1...

PT-2026-85265

A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/file sharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit h...

CVE-2026-85224: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/filesharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit ha...

HTTP/2 server push UAF

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...