CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,501 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,501
Show in the list
Critical, last 7 days
358
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product misp-project:misp. Show all products

41 CVEs, showing 1 to 41
CVESeverityTitlePublished
CVE-2026-86452High 8.7MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding
Assigned by CIRCL
Sep 7, 2026
CVE-2026-86451Medium 5.3MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects
Assigned by CIRCL
Sep 7, 2026
CVE-2026-86441Low 2.3MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data
Assigned by CIRCL
Sep 7, 2026
CVE-2026-86440Medium 5.1MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs
Assigned by CIRCL
Sep 7, 2026
CVE-2026-86419High 7.0MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII Discovery
Assigned by CIRCL
Sep 7, 2026
CVE-2026-86418Low 2.3MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users
Assigned by CIRCL
Sep 7, 2026
CVE-2026-86417Medium 5.3MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Users
Assigned by CIRCL
Sep 7, 2026
CVE-2026-86408High 7.1MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected Events
Assigned by CIRCL
Sep 7, 2026
CVE-2026-86351Medium 5.1MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL
Assigned by CIRCL
Sep 7, 2026
CVE-2026-86347High 7.1MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion
Assigned by CIRCL
Sep 7, 2026
CVE-2026-86342Medium 5.3MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Information
Assigned by CIRCL
Sep 7, 2026
CVE-2026-85239High 7.1MISP Event Template Definition Validation Bypass Allows Persistent Denial of Service
Assigned by CIRCL
Sep 3, 2026
CVE-2026-85238High 7.6Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking
Assigned by CIRCL
Sep 3, 2026
CVE-2026-85237High 8.6Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass
Assigned by CIRCL
Sep 3, 2026
CVE-2026-85236High 8.8MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request
Assigned by CIRCL
Sep 3, 2026
CVE-2026-85230Medium 5.3MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection
Assigned by CIRCL
Sep 3, 2026
CVE-2026-85227Medium 6.1Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters
Assigned by CIRCL
Sep 3, 2026
CVE-2026-85226Medium 5.3MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations
Assigned by CIRCL
Sep 3, 2026
CVE-2026-85221High 7.6MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacks
Assigned by CIRCL
Sep 3, 2026
CVE-2026-85216Critical 9.5MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials
Assigned by CIRCL
Sep 3, 2026
CVE-2026-56447High 7.2MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config setting to an arbitrary filesystem path.Jun 22, 2026
CVE-2026-56446High 7.2MISP allowed a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool.Jun 22, 2026
CVE-2026-56425High 8.8The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its OAuth 2.0 authorization flow that could allow attackers to bypass important security guarantees pro…Jun 22, 2026
CVE-2026-56424High 8.8MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong entity, or where ownership/editability checks were missing on write paths.Jun 22, 2026
CVE-2026-56423High 8.8MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups.Jun 22, 2026
CVE-2026-10864Medium 4.3A vulnerability in the MISP dashboard widgets allowed an authenticated user to manipulate the fields option and influence which fields were returned by the New Users and New Organisations widgets.Jun 4, 2026
CVE-2026-10863High 8.1A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters.Jun 4, 2026
CVE-2026-10860Medium 6.5A logic error in the MISP CRUD component delete handler allowed validation failures to be bypassed when requests used the HTTP DELETE method.Jun 4, 2026
CVE-2026-10861Medium 6.1An open redirect vulnerability existed in MISP UsersController::routeafterlogin() because the value stored in the pre_login_requested_url session key was used as the post-login redirect destination w…Jun 4, 2026
CVE-2026-10856Medium 6.1A URL validation flaw in the MISP dashboard button widget allowed a crafted relative-looking URL to be accepted as a local path while being interpreted by browsers as an external URL.Jun 4, 2026
CVE-2026-10855Medium 4.3An authorization flaw existed in the MISP Event Template Importer overwrite workflow.Jun 4, 2026
CVE-2026-10854Medium 4.3A visibility control issue in the event template creation workflow allowed non-site-admin users to access private galaxies belonging to other organisations.Jun 4, 2026
CVE-2026-10611Critical 10.0An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement.Jun 2, 2026
CVE-2026-9137High 7.5The CSP report endpoint in MISP intended to limit logged CSP reports to 1 KB but incorrectly allowed reports up to 1 MB before truncation.May 20, 2026
CVE-2026-9136Medium 6.5A vulnerability was identified in the ShadowAttribute proposal creation workflow.May 20, 2026
CVE-2026-44381Medium 5.3MISP is an open source threat intelligence and sharing platform.May 13, 2026
CVE-2026-44380High 7.2MISP is an open source threat intelligence and sharing platform.May 13, 2026
CVE-2026-44379Medium 5.3MISP is an open source threat intelligence and sharing platform.May 13, 2026
CVE-2026-8080Medium 5.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in misp allows Stored XSS.May 7, 2026
CVE-2026-39962Critical 9.6MISP is an open source threat intelligence and sharing platform.Apr 9, 2026
CVE-2025-67906Critical 9.0In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path.Dec 15, 2025

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.