CVE-2026-86417: Exposure of Sensitive Information to an Unauthorized Actor

Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates. The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal...

CVE-2025-59041: Improper Control of Generation of Code

Claude Code is an agentic coding tool. At startup, Claude Code executed a command templated in with git config user.email. Prior to version 1.0.105, a maliciously configured user email in git could be used to trigger arbitrary code execution before a user accepted the workspace trust dialog. User...

CVE-2014-7264: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in admin/themes/default/pages/manageusers.twig in the Users Management feature in the admin component in Chyrp before 2.5.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 user.email or 2 user.website field in a...