CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,501 CVEs published, 360 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,501
Show in the list
Critical, last 7 days
360
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product misp:misp. Show all products

104 CVEs, showing 51 to 100PreviousPage 2 of 3Next
CVESeverityTitlePublished
CVE-2026-94404High 7.1MISP CSRF vulnerability allows unauthorized attribute modification
Assigned by CIRCL
Sep 21, 2026
CVE-2026-94401High 8.3MISP Arbitrary Local File Read and SSRF via MISP Export Upload
Assigned by CIRCL
Sep 21, 2026
CVE-2026-94394Medium 6.3MISP ObjectReferencesController: Granular Distribution and Sharing Group Restrictions Bypassed When Adding Object References
Assigned by CIRCL
Sep 21, 2026
CVE-2026-94393Medium 6.4MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport
Assigned by CIRCL
Sep 21, 2026
CVE-2026-94383High 8.6MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension
Assigned by CIRCL
Sep 21, 2026
CVE-2026-94381High 8.7MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTime
Assigned by CIRCL
Sep 21, 2026
CVE-2026-94379Medium 6.9MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP)
Assigned by CIRCL
Sep 21, 2026
CVE-2026-94374High 8.3MISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events' Reports
Assigned by CIRCL
Sep 21, 2026
CVE-2026-94373Medium 6.3MISP DOM-based Cross-Site Scripting via innerHTML in Contextual Menu
Assigned by CIRCL
Sep 21, 2026
CVE-2026-94372Medium 6.3Stored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies Index
Assigned by CIRCL
Sep 21, 2026
CVE-2026-94277Medium 6.3Stored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy Name
Assigned by CIRCL
Sep 21, 2026
CVE-2026-93296High 8.5MISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics Legends
Assigned by CIRCL
Sep 17, 2026
CVE-2026-93295High 8.7MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution
Assigned by CIRCL
Sep 17, 2026
CVE-2026-92003Medium 6.9MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion
Assigned by CIRCL
Sep 15, 2026
CVE-2026-92002Medium 5.1MISP: Authentication failure logging suppressed during Redis unavailability
Assigned by CIRCL
Sep 15, 2026
CVE-2026-91859Medium 5.3MISP Access Log Entry Overwritten by Error Controller's Second beforeFilter Pass
Assigned by CIRCL
Sep 15, 2026
CVE-2026-91857Medium 5.3MISP: State-changing actions accessible via GET request enabling CSRF
Assigned by CIRCL
Sep 15, 2026
CVE-2026-91851Medium 5.3MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag Comparison
Assigned by CIRCL
Sep 15, 2026
CVE-2026-91846High 7.1MISP Collection Element Add Missing Authorization on Referenced Object UUID
Assigned by CIRCL
Sep 15, 2026
CVE-2026-91825High 7.1MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit
Assigned by CIRCL
Sep 15, 2026
CVE-2026-91819Medium 6.9MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent
Assigned by CIRCL
Sep 15, 2026
CVE-2026-90961Critical 9.3MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentials
Assigned by CIRCL
Sep 14, 2026
CVE-2026-90957Medium 5.1MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures
Assigned by CIRCL
Sep 14, 2026
CVE-2026-90955Medium 4.6MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load
Assigned by CIRCL
Sep 14, 2026
CVE-2026-90895High 8.4MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection
Assigned by CIRCL
Sep 14, 2026
CVE-2026-90893Medium 5.1MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints
Assigned by CIRCL
Sep 14, 2026
CVE-2026-88921Medium 5.1MISP: Unescaped HTML Injection in PDF Report Element Rendering
Assigned by CIRCL
Sep 10, 2026
CVE-2026-88915High 7.1MISP Event Template Instantiation Bypasses Sharing Group and Tagging Authorization
Assigned by CIRCL
Sep 10, 2026
CVE-2026-86452High 8.7MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding
Assigned by CIRCL
Sep 7, 2026
CVE-2026-86451Medium 5.3MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects
Assigned by CIRCL
Sep 7, 2026
CVE-2026-86441Low 2.3MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data
Assigned by CIRCL
Sep 7, 2026
CVE-2026-86440Medium 5.1MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs
Assigned by CIRCL
Sep 7, 2026
CVE-2026-86419High 7.0MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII Discovery
Assigned by CIRCL
Sep 7, 2026
CVE-2026-86418Low 2.3MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users
Assigned by CIRCL
Sep 7, 2026
CVE-2026-86417Medium 5.3MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Users
Assigned by CIRCL
Sep 7, 2026
CVE-2026-86408High 7.1MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected Events
Assigned by CIRCL
Sep 7, 2026
CVE-2026-86351Medium 5.1MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL
Assigned by CIRCL
Sep 7, 2026
CVE-2026-86347High 7.1MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion
Assigned by CIRCL
Sep 7, 2026
CVE-2026-86342Medium 5.3MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Information
Assigned by CIRCL
Sep 7, 2026
CVE-2026-86283High 7.1MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data
Assigned by CIRCL
Sep 6, 2026
CVE-2026-85547Medium 6.2Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP
Assigned by CIRCL
Sep 4, 2026
CVE-2026-85546High 8.6MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests
Assigned by CIRCL
Sep 4, 2026
CVE-2026-85538High 8.3MISP Attribute Deletion Authorization Bypass Allows Users Without Modify Permissions to Delete Attributes
Assigned by CIRCL
Sep 4, 2026
CVE-2026-85533High 7.6MISP Sharing Group Authorization Bypass via Omitted Distribution Parameter
Assigned by CIRCL
Sep 4, 2026
CVE-2026-85239High 7.1MISP Event Template Definition Validation Bypass Allows Persistent Denial of Service
Assigned by CIRCL
Sep 3, 2026
CVE-2026-85238High 7.6Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking
Assigned by CIRCL
Sep 3, 2026
CVE-2026-85237High 8.6Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass
Assigned by CIRCL
Sep 3, 2026
CVE-2026-85236High 8.8MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request
Assigned by CIRCL
Sep 3, 2026
CVE-2026-85230Medium 5.3MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection
Assigned by CIRCL
Sep 3, 2026
CVE-2026-85227Medium 6.1Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters
Assigned by CIRCL
Sep 3, 2026
PreviousPage 2 of 3Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.