CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,477 CVEs published, 360 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,477
Show in the list
Critical, last 7 days
360
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product misp:misp. Show all products

104 CVEs, showing 1 to 50Page 1 of 3Next
CVESeverityTitlePublished
CVE-2026-112192Medium 5.3MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings
Assigned by CIRCL
Oct 19, 2026
CVE-2026-112188High 7.1MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution
Assigned by CIRCL
Oct 19, 2026
CVE-2026-112184Medium 4.8MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels
Assigned by CIRCL
Oct 19, 2026
CVE-2026-112183Medium 4.8MISP CSS Injection via Remote Tag Colour in Event Preview
Assigned by CIRCL
Oct 19, 2026
CVE-2026-112180Medium 5.1MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records
Assigned by CIRCL
Oct 19, 2026
CVE-2026-112179Medium 5.3MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances
Assigned by CIRCL
Oct 19, 2026
CVE-2026-112178High 7.1MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control
Assigned by CIRCL
Oct 19, 2026
CVE-2026-107278Medium 5.3MISP Object Sync Drops Objects and Attributes When Description Is Empty
Assigned by CIRCL
Oct 7, 2026
CVE-2026-107276Medium 6.3MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests
Assigned by CIRCL
Oct 7, 2026
CVE-2026-107180High 7.1MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances
Assigned by CIRCL
Oct 7, 2026
CVE-2026-107175Medium 5.3MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes
Assigned by CIRCL
Oct 7, 2026
CVE-2026-104914Medium 5.3MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View
Assigned by CIRCL
Oct 2, 2026
CVE-2026-104912High 7.1MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data
Assigned by CIRCL
Oct 2, 2026
CVE-2026-104910Medium 5.3MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization
Assigned by CIRCL
Oct 2, 2026
CVE-2026-104908High 7.1MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging
Assigned by CIRCL
Oct 2, 2026
CVE-2026-104907Medium 4.8MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler
Assigned by CIRCL
Oct 2, 2026
CVE-2026-104906Medium 6.2MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output
Assigned by CIRCL
Oct 2, 2026
CVE-2026-104901Medium 5.1MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server
Assigned by CIRCL
Oct 2, 2026
CVE-2026-104900Medium 5.3MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview Index
Assigned by CIRCL
Oct 2, 2026
CVE-2026-103858Medium 5.3MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions
Assigned by CIRCL
Oct 1, 2026
CVE-2026-103664Medium 4.8MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter
Assigned by CIRCL
Oct 1, 2026
CVE-2026-103662Medium 5.1MISP Reflected XSS in Taxonomy Tag Confirmation Forms
Assigned by CIRCL
Oct 1, 2026
CVE-2026-103659High 7.1MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes
Assigned by CIRCL
Oct 1, 2026
CVE-2026-103655Critical 9.3MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period
Assigned by CIRCL
Oct 1, 2026
CVE-2026-103651High 7.6MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypass
Assigned by CIRCL
Oct 1, 2026
CVE-2026-103389Medium 6.2MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation Graph
Assigned by CIRCL
Sep 30, 2026
CVE-2026-103388Medium 6.2MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field
Assigned by CIRCL
Sep 30, 2026
CVE-2026-103321High 8.3MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image
Assigned by CIRCL
Sep 30, 2026
CVE-2026-103239High 8.6MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection
Assigned by CIRCL
Sep 30, 2026
CVE-2026-103237High 8.3MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows
Assigned by CIRCL
Sep 30, 2026
CVE-2026-103235High 8.7MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Events
Assigned by CIRCL
Sep 30, 2026
CVE-2026-95806High 7.7MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths
Assigned by CIRCL
Sep 22, 2026
CVE-2026-95805Medium 5.3MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restriction
Assigned by CIRCL
Sep 22, 2026
CVE-2026-95754Medium 6.9MISP: Disabled-user check ineffective in pre-authentication TOTP login branch
Assigned by CIRCL
Sep 22, 2026
CVE-2026-95703Medium 5.1MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_name
Assigned by CIRCL
Sep 22, 2026
CVE-2026-95701Medium 5.1MISP Path Traversal via Organization Name in Org-Statistics Logo Check
Assigned by CIRCL
Sep 22, 2026
CVE-2026-95698Medium 5.3MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name
Assigned by CIRCL
Sep 22, 2026
CVE-2026-95697Medium 5.3MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Metadata
Assigned by CIRCL
Sep 22, 2026
CVE-2026-95693Medium 5.3MISP Information Disclosure via Forged Upload Path
Assigned by CIRCL
Sep 22, 2026
CVE-2026-95685Medium 5.3MISP Missing Authorization on replaceSuggestionInReport Event Report Action
Assigned by CIRCL
Sep 22, 2026
CVE-2026-95683Medium 5.3MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL
Assigned by CIRCL
Sep 22, 2026
CVE-2026-95682Medium 4.8MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View
Assigned by CIRCL
Sep 22, 2026
CVE-2026-95679Medium 6.9MISP Unauthenticated Blind SSRF via XML Body Processing
Assigned by CIRCL
Sep 22, 2026
CVE-2026-95674Medium 5.3MISP EventsController queryEnrichment allows querying unavailable or legacy modules without validation
Assigned by CIRCL
Sep 22, 2026
CVE-2026-95671Medium 5.3MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add
Assigned by CIRCL
Sep 22, 2026
CVE-2026-95667Medium 6.9MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials
Assigned by CIRCL
Sep 22, 2026
CVE-2026-95665Medium 5.1MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON
Assigned by CIRCL
Sep 22, 2026
CVE-2026-95661Medium 5.1MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type List
Assigned by CIRCL
Sep 22, 2026
CVE-2026-95659Medium 4.8MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread
Assigned by CIRCL
Sep 22, 2026
CVE-2026-95658Medium 6.9MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution of workflow modules
Assigned by CIRCL
Sep 22, 2026
Page 1 of 3Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.