Vendor
MISP Project vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 44 vulnerabilities in MISP Project: 0 in the last 7 days and 39 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-112991, was published on 19 October 2026. 6 vulnerabilities in the last four weeks, down 82% on the four before (33). 2 technologies have a page of their own.
- Last 7 days
- 0
- Last 90 days
- 39
- Critical, all time
- 1
- Exploited in the wild
- 0
About MISP Project
An open-source project developing a threat intelligence platform for sharing, storing, and correlating indicators of compromise.
MISP Project technologies
Latest MISP Project vulnerabilities
- CVE-2026-112991: MISP Modules html_to_markdown server-side request forgeryinfo
- CVE-2026-112192: MISP module plugin settings flags not preservedinfo
- CVE-2026-112188: MISP server settings information disclosureinfo
- CVE-2026-112184: MISP reflected XSS in workflow module interfaceinfo
- CVE-2026-112180: MISP data integrity flaw in event deletion logicinfo
- CVE-2026-112179: MISP event synchronization information disclosure via tag filteringinfo
- CVE-2026-106513: MISP Redis host configuration exposure to site-admin usersinfo
- CVE-2026-104914: MISP improper access control in attribute search endpointsinfoEPSS 0.2%
- CVE-2026-104910: MISP authorization bypass in related events listinginfoEPSS 0.3%
- CVE-2026-104907: MISP cross-site scripting in remote event previewinfoEPSS 0.4%
- CVE-2026-104906: MISP cross-site scripting in TAXII object viewerinfoEPSS 0.4%
- CVE-2026-104901: MISP cross-site scripting in ID TranslatorinfoEPSS 0.3%
- CVE-2026-104900: MISP stored XSS in remote event preview indexinfoEPSS 0.4%
- CVE-2026-103858: MISP incomplete authorization check in discussion postinginfoEPSS 0.2%
- CVE-2026-103664: MISP reflected XSS in analyst data notes panelinfoEPSS 0.3%
- CVE-2026-103659: MISP authorization bypass in event flatteninginfoEPSS 0.2%
- CVE-2026-103651: MISP HOTP token replay via cached counterinfoEPSS 0.2%
- CVE-2026-103388: MISP stored XSS in Galaxy Cluster source fieldinfo
- CVE-2026-103235: MISP mass assignment vulnerability in event delegationinfo
- CVE-2026-95806: MISP remote code execution via unregistered phar stream wrapperinfoEPSS 0.4%
- CVE-2026-95754: MISP UsersController auth bypass via missing disabled-user check in TOTP branchinfoEPSS 0.5%
- CVE-2026-95701: MISP path traversal in organization logo checkinfoEPSS 0.8%
- CVE-2026-95693: MISP EventReport path traversal information disclosureinfoEPSS 0.5%
- CVE-2026-95685: MISP access control flaw in EventReports replaceSuggestionInReportinfoEPSS 0.4%
- CVE-2026-95683: MISP Overmind event view unauthorized report disclosure via insufficient ACL checksinfoEPSS 0.4%
Most severe MISP Project vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-44364: MISP misp-modules CSRF in website home blueprintcriticalCVSS 4EPSS 0.2%
- CVE-2026-44363: MISP misp-modules SSRF and improper TLS validation in expansion modulesmediumCVSS 4EPSS 0.1%
- CVE-2026-62143: MISP misp-modules SSRF bypass in html_to_markdown moduleinfoCVSS 8.3
- CVE-2026-53693: MISP BSimVis stored XSS in tag rendering codeinfoCVSS 6.9
- CVE-2026-9806: MISP CTI Transmute stored XSS in notification panelinfoCVSS 6.3
- CVE-2026-95701: MISP path traversal in organization logo checkinfoEPSS 0.8%
- CVE-2026-95679: MISP RequestHandlerComponent SSRF in cspReport endpointinfoEPSS 0.6%
- CVE-2026-95754: MISP UsersController auth bypass via missing disabled-user check in TOTP branchinfoEPSS 0.5%
- CVE-2026-95665: MISP reflected XSS in event REST search export confirmation forminfoEPSS 0.5%
- CVE-2026-95693: MISP EventReport path traversal information disclosureinfoEPSS 0.5%
Vulnerabilities per week
6 vulnerabilities in the last four weeks, down 82% on the four before (33). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 20 | 0 | |
| 28 Sep 2026 | 12 | 0 | |
| 5 Oct 2026 | 1 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 6 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many MISP Project vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/misp-project)<a href="https://junglewise.ai/threats/vendors/misp-project"><img src="https://junglewise.ai/threats/vendors/misp-project/badge.svg" alt="MISP Project vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/misp-project.json, and this page as text at https://junglewise.ai/threats/vendors/misp-project.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "MISP Project vulnerabilities", https://junglewise.ai/threats/vendors/misp-project, 9 November 2026.