# Misp vulnerabilities Source: https://junglewise.ai/threats/technologies/misp Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/misp.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 57 vulnerabilities in Misp: 0 in the last 7 days and 45 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-112183, was published on 19 October 2026. 2 vulnerabilities in the last four weeks, down 93% on the four before (28). ## Counts - Last 7 days: 0 - Last 30 days: 2 - Last 90 days: 45 - All time: 57 (1 critical, 0 exploited in the wild) ## About Misp Open-source platform for sharing threat intelligence and malware indicators. ## Latest Misp vulnerabilities - [CVE-2026-112183: MISP CSS injection in remote event preview](https://junglewise.ai/threats/cve-2026-112183-misp-contains-a-css-injection-vulnerability-in-the-remote-event) (info, published 19 Oct 2026) - [CVE-2026-112178: MISP access control flaw in proposal visibility logic](https://junglewise.ai/threats/cve-2026-112178-misp-contains-an-access-control-flaw-in-the-proposal-shadow) (info, published 19 Oct 2026) - [CVE-2026-104912: MISP authorization flaw in correlation handling](https://junglewise.ai/threats/cve-2026-104912-misp-contains-an-authorization-flaw-in-its-correlation-handling) (info, published 2 Oct 2026) - [CVE-2026-104908: MISP improper input validation in decaying model import](https://junglewise.ai/threats/cve-2026-104908-misp-contains-an-improper-input-validation-vulnerability-in-the) (info, published 2 Oct 2026) - [CVE-2026-103662: MISP reflected XSS in taxonomy tag confirmation forms](https://junglewise.ai/threats/cve-2026-103662-misp-contains-a-reflected-cross-site-scripting-xss-vulnerability) (info, published 1 Oct 2026) - [CVE-2026-103655: MISP TOTP verification code reuse vulnerability](https://junglewise.ai/threats/cve-2026-103655-misp-contains-a-vulnerability-in-its-two-factor-authentication) (info, published 1 Oct 2026) - [CVE-2026-103389: MISP stored cross-site scripting in galaxy icon handling](https://junglewise.ai/threats/cve-2026-103389-misp-contains-a-stored-cross-site-scripting-xss-vulnerability-in) (info, published 30 Sep 2026) - [CVE-2026-103321: MISP stored cross-site script in event graph preview](https://junglewise.ai/threats/cve-2026-103321-misp-contains-a-stored-cross-site-script-xss-vulnerability-in) (info, published 30 Sep 2026) - [CVE-2026-103239: MISP privilege escalation in tag collection edit](https://junglewise.ai/threats/cve-2026-103239-misp-contains-a-privilege-escalation-vulnerability-in-the-tag) (info, published 30 Sep 2026) - [CVE-2026-103237: MISP improper input validation in ORM save path](https://junglewise.ai/threats/cve-2026-103237-misp-contains-an-improper-input-validation-vulnerability-in-its) (info, published 30 Sep 2026) - [CVE-2026-95805: MISP ACL configuration typo in previewEventAttributes](https://junglewise.ai/threats/cve-2026-95805-a-typo-in-the-misp-aclcomponent-access-control-configuration) (info, published 22 Sep 2026) - [CVE-2026-95703: MISP OrganisationsController file-existence oracle in logo upload](https://junglewise.ai/threats/cve-2026-95703-in-misp-the-organisationscontroller-uploadlogo-method-processed-a) (info, published 22 Sep 2026) - [CVE-2026-95698: MISP OrgImgHelper path traversal in findOrgImage](https://junglewise.ai/threats/cve-2026-95698-the-findorgimage-method-in-misp-s-orgimghelper-constructs-a) (info, published 22 Sep 2026) - [CVE-2026-95697: MISP authorization flaw in captureOrg method](https://junglewise.ai/threats/cve-2026-95697-misp-contains-an-authorization-flaw-in-the-organisation-model-s) (info, published 22 Sep 2026) - [CVE-2026-95682: MISP stored XSS in admin email composition screen](https://junglewise.ai/threats/cve-2026-95682-misp-contains-a-stored-cross-site-scripting-xss-vulnerability-in) (info, published 22 Sep 2026) - [CVE-2026-95659: MISP reflected XSS in AnalystDataController viewForObject](https://junglewise.ai/threats/cve-2026-95659-misp-contains-a-reflected-cross-site-scripting-xss-vulnerability) (info, published 22 Sep 2026) - [CVE-2026-95658: MISP WorkflowsController CSRF vulnerability in moduleStatelessExecution](https://junglewise.ai/threats/cve-2026-95658-misp-s-workflowscontroller-exposed-the-modulestatelessexecution) (info, published 22 Sep 2026) - [CVE-2026-94393: MISP event report access control bypass via UUID](https://junglewise.ai/threats/cve-2026-94393-when-a-user-creates-or-edits-a-report-inside-an-event-misp-can) (info, published 21 Sep 2026) - [CVE-2026-94379: MISP HTTP method validation bypass in login function](https://junglewise.ai/threats/cve-2026-94379-the-login-function-in-misp-s-userscontroller-php-contained) (info, published 21 Sep 2026) - [CVE-2026-94373: MISP DOM-based XSS in contextual menu component](https://junglewise.ai/threats/cve-2026-94373-misp-contains-a-dom-based-cross-site-scripting-xss-vulnerability) (info, published 21 Sep 2026) - [CVE-2026-93296: MISP Overmind stored cross-site scripting in statistics views](https://junglewise.ai/threats/cve-2026-93296-misp-overmind-stored-cross-site-scripting-in-statistics-views) (info, published 17 Sep 2026) - [CVE-2026-92003: MISP authentication-failure logging bypass](https://junglewise.ai/threats/cve-2026-92003-misp-authentication-failure-logging-bypass) (info, published 15 Sep 2026) - [CVE-2026-92002: MISP Redis unavailability silences authentication failure logging](https://junglewise.ai/threats/cve-2026-92002-misp-redis-unavailability-silences-authentication-failure-logging) (info, published 15 Sep 2026) - [CVE-2026-91859: MISP access log corruption on request exceptions](https://junglewise.ai/threats/cve-2026-91859-misp-access-log-corruption-on-request-exceptions) (info, published 15 Sep 2026) - [CVE-2026-91857: MISP state-changing actions missing POST requirement](https://junglewise.ai/threats/cve-2026-91857-misp-state-changing-actions-missing-post-requirement) (info, CVSS 4.3, published 15 Sep 2026) ## Most severe Misp vulnerabilities - [CVE-2026-86419: MISP SSRF and credential exposure in feed retrieval and TAXII discovery](https://junglewise.ai/threats/cve-2026-86419-misp-ssrf-and-credential-exposure-in-feed-retrieval-and-taxii) (critical, CVSS 9.1, published 7 Sep 2026) - [CVE-2026-85237: MISP email OTP brute-force attack in authentication](https://junglewise.ai/threats/cve-2026-85237-misp-email-otp-brute-force-attack-in-authentication) (high, CVSS 8.1, published 3 Sep 2026) - [CVE-2026-86452: MISP denial-of-service via unbounded email input on unauthenticated endpoints](https://junglewise.ai/threats/cve-2026-86452-misp-denial-of-service-via-unbounded-email-input-on) (high, CVSS 7.5, published 7 Sep 2026) - [CVE-2026-44380: MISP improper access control in authentication key reset](https://junglewise.ai/threats/cve-2026-44380-misp-improper-access-control-in-authentication-key-reset) (high, CVSS 7.2, published 13 May 2026) - [CVE-2026-85238: MISP session fixation vulnerability in CustomAuth](https://junglewise.ai/threats/cve-2026-85238-misp-session-fixation-vulnerability-in-customauth) (medium, CVSS 6.8, published 3 Sep 2026) - [CVE-2026-86347: MISP ACL bypass in TemplatesController uploadFile](https://junglewise.ai/threats/cve-2026-86347-misp-acl-bypass-in-templatescontroller-uploadfile) (medium, CVSS 6.5, published 7 Sep 2026) - [CVE-2026-86351: MISP open redirect via insufficient homepage validation](https://junglewise.ai/threats/cve-2026-86351-misp-open-redirect-via-insufficient-homepage-validation) (medium, CVSS 6.1, published 7 Sep 2026) - [CVE-2026-8080: MISP Stored XSS in template element attribute handling](https://junglewise.ai/threats/cve-2026-8080-misp-stored-xss-in-template-element-attribute-handling) (medium, CVSS 5.4, published 7 May 2026) - [CVE-2026-44381: MISP SQL injection in event and shadow attribute listing endpoints](https://junglewise.ai/threats/cve-2026-44381-misp-sql-injection-in-event-and-shadow-attribute-listing) (medium, CVSS 5.3, published 13 May 2026) - [CVE-2026-44379: MISP improper UUID validation in Collections](https://junglewise.ai/threats/cve-2026-44379-misp-improper-uuid-validation-in-collections) (medium, CVSS 5.3, published 13 May 2026) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, down 93% on the four before (28). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 8 | 0 | 0 | | 7 Sep 2026 | 7 | 1 | 0 | | 14 Sep 2026 | 10 | 0 | 0 | | 21 Sep 2026 | 10 | 0 | 0 | | 28 Sep 2026 | 8 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 2 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Misp technologies - [Misp-Modules](https://junglewise.ai/threats/technologies/misp-misp-modules): 5 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Misp vulnerabilities", https://junglewise.ai/threats/technologies/misp, 13 November 2026.