Technology · Misp
Misp vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 57 vulnerabilities in Misp: 0 in the last 7 days and 45 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-112183, was published on 19 October 2026. 2 vulnerabilities in the last four weeks, down 93% on the four before (28).
- Last 7 days
- 0
- Last 90 days
- 45
- Critical, all time
- 1
- Exploited in the wild
- 0
About Misp
Open-source platform for sharing threat intelligence and malware indicators.
Latest Misp vulnerabilities
- CVE-2026-112183: MISP CSS injection in remote event previewinfo
- CVE-2026-112178: MISP access control flaw in proposal visibility logicinfo
- CVE-2026-104912: MISP authorization flaw in correlation handlinginfoEPSS 0.2%
- CVE-2026-104908: MISP improper input validation in decaying model importinfoEPSS 0.3%
- CVE-2026-103662: MISP reflected XSS in taxonomy tag confirmation formsinfoEPSS 0.3%
- CVE-2026-103655: MISP TOTP verification code reuse vulnerabilityinfoEPSS 0.3%
- CVE-2026-103389: MISP stored cross-site scripting in galaxy icon handlinginfo
- CVE-2026-103321: MISP stored cross-site script in event graph previewinfo
- CVE-2026-103239: MISP privilege escalation in tag collection editinfo
- CVE-2026-103237: MISP improper input validation in ORM save pathinfo
- CVE-2026-95805: MISP ACL configuration typo in previewEventAttributesinfoEPSS 0.4%
- CVE-2026-95703: MISP OrganisationsController file-existence oracle in logo uploadinfoEPSS 0.5%
- CVE-2026-95698: MISP OrgImgHelper path traversal in findOrgImageinfoEPSS 0.7%
- CVE-2026-95697: MISP authorization flaw in captureOrg methodinfoEPSS 0.4%
- CVE-2026-95682: MISP stored XSS in admin email composition screeninfoEPSS 0.4%
- CVE-2026-95659: MISP reflected XSS in AnalystDataController viewForObjectinfoEPSS 0.4%
- CVE-2026-95658: MISP WorkflowsController CSRF vulnerability in moduleStatelessExecutioninfoEPSS 0.3%
- CVE-2026-94393: MISP event report access control bypass via UUIDinfoEPSS 0.4%
- CVE-2026-94379: MISP HTTP method validation bypass in login functioninfoEPSS 0.6%
- CVE-2026-94373: MISP DOM-based XSS in contextual menu componentinfoEPSS 0.4%
- CVE-2026-93296: MISP Overmind stored cross-site scripting in statistics viewsinfoEPSS 0.4%
- CVE-2026-92003: MISP authentication-failure logging bypassinfoEPSS 0.6%
- CVE-2026-92002: MISP Redis unavailability silences authentication failure logginginfoEPSS 0.5%
- CVE-2026-91859: MISP access log corruption on request exceptionsinfoEPSS 0.5%
- CVE-2026-91857: MISP state-changing actions missing POST requirementinfoCVSS 4.3EPSS 0.2%
Most severe Misp vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-86419: MISP SSRF and credential exposure in feed retrieval and TAXII discoverycriticalCVSS 9.1EPSS 0.4%
- CVE-2026-85237: MISP email OTP brute-force attack in authenticationhighCVSS 8.1EPSS 0.5%
- CVE-2026-86452: MISP denial-of-service via unbounded email input on unauthenticated endpointshighCVSS 7.5EPSS 0.5%
- CVE-2026-44380: MISP improper access control in authentication key resethighCVSS 7.2EPSS 0.4%
- CVE-2026-85238: MISP session fixation vulnerability in CustomAuthmediumCVSS 6.8EPSS 0.3%
- CVE-2026-86347: MISP ACL bypass in TemplatesController uploadFilemediumCVSS 6.5EPSS 0.4%
- CVE-2026-86351: MISP open redirect via insufficient homepage validationmediumCVSS 6.1EPSS 0.3%
- CVE-2026-8080: MISP Stored XSS in template element attribute handlingmediumCVSS 5.4EPSS 0.1%
- CVE-2026-44381: MISP SQL injection in event and shadow attribute listing endpointsmediumCVSS 5.3EPSS 0.2%
- CVE-2026-44379: MISP improper UUID validation in CollectionsmediumCVSS 5.3EPSS 0.2%
Vulnerabilities per week
2 vulnerabilities in the last four weeks, down 93% on the four before (28). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 8 | 0 | |
| 7 Sep 2026 | 7 | 1 | |
| 14 Sep 2026 | 10 | 0 | |
| 21 Sep 2026 | 10 | 0 | |
| 28 Sep 2026 | 8 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 2 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Misp vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/misp)<a href="https://junglewise.ai/threats/technologies/misp"><img src="https://junglewise.ai/threats/technologies/misp/badge.svg" alt="Misp vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/misp.json, and this page as text at https://junglewise.ai/threats/technologies/misp.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Misp vulnerabilities", https://junglewise.ai/threats/technologies/misp, 13 November 2026.