Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 7.1, CVEs: CVE-2026-112178, Summary: MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 7.1, CVEs: CVE-2026-112188, Summary: MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 5.3, CVEs: CVE-2026-112192, Summary: MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata.
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.4, CVEs: CVE-2026-103655, Summary: MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow where a TOTP code is verified as a second authentication factor. Because the system did not record whether a given TOTP period had…
Serial number: AV26-986 Date: October 1, 2026 As of October 1, 2026, MISP is affected by vulnerabilities in the following product: MISP Prior to 2.5.48 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Delegation requests stay bound to the event they were authorised for A nested model alias key no longer selects the row a save targets Tag collection saves no longer write sibling user/org rows Refuse a…
Aggiornamenti di sicurezza risolvono molteplici vulnerabilità, di cui 4 con gravità "alta", in MISP, nota piattaforma collaborativa open source per la condivisione e l'analisi di informazioni sulle minacce informatiche.
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 6.2, CVEs: CVE-2026-103388, CVE-2026-103389, CVE-2026-103321, Summary: CVE-2026-103388 (CVSS: 6.2): MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a…
Aggiornamenti di sicurezza MISP risolvono molteplici vulnerabilità, tra cui sei con gravità "alta", in MISP, nota piattaforma collaborativa open source per la condivisione e l'analisi di informazioni sulle minacce informatiche. Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un utente malintenzionato remoto di elevare i propri privilegi, di eseguire codice arbitrario, l'accesso ad informazioni sensibili e la modifica non autorizzata di dati o codice sui sistemi interessati.
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 8.7, CVEs: CVE-2026-94277, CVE-2026-94372, CVE-2026-94373, CVE-2026-94374, CVE-2026-94379, CVE-2026-94381, CVE-2026-94383, CVE-2026-94393, CVE-2026-94394, CVE-2026-94401, CVE-2026-94404, Summary: MISP has released version 2.5.47 following an extensive security review. More than 30 security findings were reviewed, with 27 confirmed vulnerabilities fixed and retested. The issues include remote code execution…
Serial number: AV26-946Date: September 21, 2026 As of September 21, 2026, MISP is affected by vulnerabilities in the following product: MISP Prior to 2.5.47 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Strip the client id from module-result event reports Read only api keys can regain full role powers Refuse a MISP export upload whose content is a path or URL
Aggiornamenti di sicurezza MISP risolvono molteplici vulnerabilità, tra cui una con gravità "critica" e due con gravità "alta", in MISP, nota piattaforma collaborativa open source per la condivisione e l'analisi di informazioni sulle minacce informatiche. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente malintenzionato di eludere i meccanismi di autenticazione e sicurezza ed accedere a informazioni sensibili sui sistemi target.
Risolta una vulnerabilità con gravità "alta" in MISP, piattaforma open source per la condivisione e l'analisi di informazioni sulle minacce informatiche
De multiples vulnérabilités ont été découvertes dans MISP. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
Aggiornamenti di sicurezza sanano due vulnerabilità, di cui una con gravità "alta", in MISP Project, nota piattaforma collaborativa di cyber threat intelligence.
Serial Number: AV26-901Date: September 9, 2026 As of September 4, 2026, misp is affected by vulnerabilities in the following product: misp Prior to or equal to 2.5.45 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Authorise the sharing group whenever one is submitted