PT-2026-70099

Name of the Vulnerable Software and Affected Versions cti-transmute affected versions not specified Description An issue exists where a tag's icon value can be stored and subsequently interpolated into HTML using Vue's v-html directive. The mapIcon function previously constructed an HTML string...

PT-2026-70079

Name of the Vulnerable Software and Affected Versions cti-transmute affected versions not specified Description The software fails to apply comment-level access-control rules during the generation of evaluation report exports. While standard comment retrieval correctly filters based on conversion...

CVE-2026-73158: Improper Neutralization of Input During Web Page Generation

Affected versions of cti-transmute insufficiently validate saved graph configuration data. Graph configurations can contain style properties that are later consumed by Pivotick, and Pivotick interprets svgIcon as HTML. Because saved configurations may be created by one user and later displayed to...

PT-2026-70083

Name of the Vulnerable Software and Affected Versions cti-transmute affected versions not specified Description The software renders data from a remote MISP instance into the event-browser interface using HTML interpolation. A malicious or compromised remote server can control fields such as even...

PT-2026-70086

Name of the Vulnerable Software and Affected Versions cti-transmute affected versions not specified Description Insufficient validation of saved graph configuration data allows a malicious user to store a crafted svgIcon value. Since these configurations can be viewed by other users or...

PT-2026-70100

Affected versions of cti-transmute contain an SSRF vulnerability in the /fetch misp event and /misp search events endpoints. The URL validation routine checked whether a supplied hostname was itself an IP literal and rejected private, loopback, link-local, or reserved IPs. However, ordinary domai...

CVE-2026-73160: Server-Side Request Forgery (SSRF)

Affected versions of cti-transmute contain an SSRF vulnerability in the /fetchmispevent and /mispsearchevents endpoints. The URL validation routine checked whether a supplied hostname was itself an IP literal and rejected private, loopback, link-local, or reserved IPs. However, ordinary domain...

CVE-2026-73157: Improper Neutralization of Input During Web Page Generation

Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as event IDs, event information, organization names, tags, tag colors, TLP labels, distribution labels, and error/flash text may be...

CVE-2026-73161: Improper Neutralization of Input During Web Page Generation

Affected versions of cti-transmute improperly handle conversion-table values passed through the search highlighting feature. The highlight function previously returned the underlying text directly when no search query was supplied, or performed a regex replacement that inserted tags without first...

CVE-2026-72759

In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns None. The previous logic only denied access when the conversion object...

CVE-2026-72760

Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another account, getfollowing includes the followed user's email field in the API response alongside their name, user ID, and follow date. Becaus...

EUVD-2026-55636

Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another account, getfollowing includes the followed user's email field in the API response alongside their name, user ID, and follow date. Becaus...

CVE-2026-72760 cti-transmute Following List Exposes User Email Addresses to Authenticated Users

Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another account, getfollowing includes the followed user's email field in the API response alongside their name, user ID, and follow date. Becaus...

CVE-2026-72760 cti-transmute Following List Exposes User Email Addresses to Authenticated Users

Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another account, getfollowing includes the followed user's email field in the API response alongside their name, user ID, and follow date. Becaus...

CVE-2026-72760 cti-transmute Following List Exposes User Email Addresses to Authenticated Users

Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another account, getfollowing includes the followed user's email field in the API response alongside their name, user ID, and follow date. Becaus...

CVE-2026-72760

The CVE-2026-72760 issue affects MISP cti-transmute where the account following-list endpoint returns the followed user’s email field in get_following() in addition to name, user ID, and follow date. The root cause is that email is included in the API response despite not being required for follo...

CVE-2026-72759 cti-transmute Conversion History Authorization Bypass Leads to Sensitive Data Disclosure After Conversion Deletion

In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns None. The previous logic only denied access when the conversion object...

EUVD-2026-55635

In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns None. The previous logic only denied access when the conversion object...

CVE-2026-72759 cti-transmute Conversion History Authorization Bypass Leads to Sensitive Data Disclosure After Conversion Deletion

In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns None. The previous logic only denied access when the conversion object...

CVE-2026-72759

CVE-2026-72759 affects MISP cti-transmute. The vulnerability lies in the conversion-history details endpoint, where an incomplete authorization check allows disclosure when a history entry references a deleted conversion. If the conversion lookup returns None, access was not properly denied; as a...