# MISP Project vulnerabilities Source: https://junglewise.ai/threats/vendors/misp-project Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/misp-project.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 44 vulnerabilities in MISP Project: 0 in the last 7 days and 39 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-112991, was published on 19 October 2026. 6 vulnerabilities in the last four weeks, down 82% on the four before (33). 2 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 6 - Last 90 days: 39 - All time: 44 (1 critical, 0 exploited in the wild) ## About MISP Project An open-source project developing a threat intelligence platform for sharing, storing, and correlating indicators of compromise. ## Latest MISP Project vulnerabilities - [CVE-2026-112991: MISP Modules html_to_markdown server-side request forgery](https://junglewise.ai/threats/cve-2026-112991-the-html-to-markdown-expansion-module-in-misp-modules-contains-a) (info, published 19 Oct 2026) - [CVE-2026-112192: MISP module plugin settings flags not preserved](https://junglewise.ai/threats/cve-2026-112192-misp-contains-a-vulnerability-in-the-handling-of-module-plugin) (info, published 19 Oct 2026) - [CVE-2026-112188: MISP server settings information disclosure](https://junglewise.ai/threats/cve-2026-112188-misp-contains-a-vulnerability-in-its-server-settings-lookup) (info, published 19 Oct 2026) - [CVE-2026-112184: MISP reflected XSS in workflow module interface](https://junglewise.ai/threats/cve-2026-112184-misp-contains-a-reflected-cross-site-scripting-xss-vulnerability) (info, published 19 Oct 2026) - [CVE-2026-112180: MISP data integrity flaw in event deletion logic](https://junglewise.ai/threats/cve-2026-112180-misp-contains-a-data-integrity-flaw-in-its-event-deletion-logic) (info, published 19 Oct 2026) - [CVE-2026-112179: MISP event synchronization information disclosure via tag filtering](https://junglewise.ai/threats/cve-2026-112179-in-misp-the-event-synchronization-process-contained-a-logic) (info, published 19 Oct 2026) - [CVE-2026-106513: MISP Redis host configuration exposure to site-admin users](https://junglewise.ai/threats/cve-2026-106513-misp-malware-information-sharing-platform-exposes-critical) (info, published 6 Oct 2026) - [CVE-2026-104914: MISP improper access control in attribute search endpoints](https://junglewise.ai/threats/cve-2026-104914-misp-contains-an-improper-access-control-vulnerability-in-its) (info, published 2 Oct 2026) - [CVE-2026-104910: MISP authorization bypass in related events listing](https://junglewise.ai/threats/cve-2026-104910-misp-contains-an-authorization-bypass-in-the-related-events) (info, published 2 Oct 2026) - [CVE-2026-104907: MISP cross-site scripting in remote event preview](https://junglewise.ai/threats/cve-2026-104907-misp-contains-a-cross-site-scripting-xss-vulnerability-in-the) (info, published 2 Oct 2026) - [CVE-2026-104906: MISP cross-site scripting in TAXII object viewer](https://junglewise.ai/threats/cve-2026-104906-misp-contains-a-cross-site-scripting-xss-vulnerability-in-the) (info, published 2 Oct 2026) - [CVE-2026-104901: MISP cross-site scripting in ID Translator](https://junglewise.ai/threats/cve-2026-104901-misp-contains-a-cross-site-scripting-xss-vulnerability-in-the-id) (info, published 2 Oct 2026) - [CVE-2026-104900: MISP stored XSS in remote event preview index](https://junglewise.ai/threats/cve-2026-104900-misp-contains-a-stored-cross-site-scripting-xss-vulnerability-in) (info, published 2 Oct 2026) - [CVE-2026-103858: MISP incomplete authorization check in discussion posting](https://junglewise.ai/threats/cve-2026-103858-misp-contains-an-incomplete-authorization-check-in-the) (info, published 1 Oct 2026) - [CVE-2026-103664: MISP reflected XSS in analyst data notes panel](https://junglewise.ai/threats/cve-2026-103664-misp-contains-a-reflected-cross-site-scripting-xss-vulnerability) (info, published 1 Oct 2026) - [CVE-2026-103659: MISP authorization bypass in event flattening](https://junglewise.ai/threats/cve-2026-103659-misp-contains-an-authorization-bypass-in-the-event-flattening) (info, published 1 Oct 2026) - [CVE-2026-103651: MISP HOTP token replay via cached counter](https://junglewise.ai/threats/cve-2026-103651-misp-contains-a-vulnerability-in-its-one-time-password-otp) (info, published 1 Oct 2026) - [CVE-2026-103388: MISP stored XSS in Galaxy Cluster source field](https://junglewise.ai/threats/cve-2026-103388-misp-renders-the-source-field-of-a-galaxy-cluster-as-a-clickable) (info, published 30 Sep 2026) - [CVE-2026-103235: MISP mass assignment vulnerability in event delegation](https://junglewise.ai/threats/cve-2026-103235-misp-contains-a-mass-assignment-vulnerability-in-the-event) (info, published 30 Sep 2026) - [CVE-2026-95806: MISP remote code execution via unregistered phar stream wrapper](https://junglewise.ai/threats/cve-2026-95806-misp-ships-with-php-s-phar-stream-wrapper-registered-in-both-its) (info, published 22 Sep 2026) - [CVE-2026-95754: MISP UsersController auth bypass via missing disabled-user check in TOTP branch](https://junglewise.ai/threats/cve-2026-95754-in-misp-s-userscontroller-login-method-the-pre-authentication) (info, published 22 Sep 2026) - [CVE-2026-95701: MISP path traversal in organization logo check](https://junglewise.ai/threats/cve-2026-95701-in-misp-the-statisticsorgs-method-in-userscontroller-php-used-the) (info, published 22 Sep 2026) - [CVE-2026-95693: MISP EventReport path traversal information disclosure](https://junglewise.ai/threats/cve-2026-95693-in-misp-the-eventreport-uploadpicture-method-in-processed-a) (info, published 22 Sep 2026) - [CVE-2026-95685: MISP access control flaw in EventReports replaceSuggestionInReport](https://junglewise.ai/threats/cve-2026-95685-misp-contains-an-access-control-flaw-in-the-eventreports) (info, published 22 Sep 2026) - [CVE-2026-95683: MISP Overmind event view unauthorized report disclosure via insufficient ACL checks](https://junglewise.ai/threats/cve-2026-95683-in-misp-the-overmind-event-view-enriches-an-event-with-its-most) (info, published 22 Sep 2026) ## Most severe MISP Project vulnerabilities - [CVE-2026-44364: MISP misp-modules CSRF in website home blueprint](https://junglewise.ai/threats/cve-2026-44364-misp-misp-modules-csrf-in-website-home-blueprint) (critical, CVSS 4, published 13 May 2026) - [CVE-2026-44363: MISP misp-modules SSRF and improper TLS validation in expansion modules](https://junglewise.ai/threats/cve-2026-44363-misp-misp-modules-ssrf-and-improper-tls-validation-in-expansion) (medium, CVSS 4, published 13 May 2026) - [CVE-2026-62143: MISP misp-modules SSRF bypass in html_to_markdown module](https://junglewise.ai/threats/cve-2026-62143-misp-misp-modules-ssrf-bypass-in-html-to-markdown-module) (info, CVSS 8.3, published 13 Jul 2026) - [CVE-2026-53693: MISP BSimVis stored XSS in tag rendering code](https://junglewise.ai/threats/cve-2026-53693-misp-bsimvis-stored-xss-in-tag-rendering-code) (info, CVSS 6.9, published 10 Jun 2026) - [CVE-2026-9806: MISP CTI Transmute stored XSS in notification panel](https://junglewise.ai/threats/cve-2026-9806-misp-cti-transmute-stored-xss-in-notification-panel) (info, CVSS 6.3, published 28 May 2026) - [CVE-2026-95701: MISP path traversal in organization logo check](https://junglewise.ai/threats/cve-2026-95701-in-misp-the-statisticsorgs-method-in-userscontroller-php-used-the) (info, published 22 Sep 2026) - [CVE-2026-95679: MISP RequestHandlerComponent SSRF in cspReport endpoint](https://junglewise.ai/threats/cve-2026-95679-misp-s-requesthandlercomponent-automatically-decodes-xml-request) (info, published 22 Sep 2026) - [CVE-2026-95754: MISP UsersController auth bypass via missing disabled-user check in TOTP branch](https://junglewise.ai/threats/cve-2026-95754-in-misp-s-userscontroller-login-method-the-pre-authentication) (info, published 22 Sep 2026) - [CVE-2026-95665: MISP reflected XSS in event REST search export confirmation form](https://junglewise.ai/threats/cve-2026-95665-misp-contains-a-reflected-cross-site-scripting-xss-vulnerability) (info, published 22 Sep 2026) - [CVE-2026-95693: MISP EventReport path traversal information disclosure](https://junglewise.ai/threats/cve-2026-95693-in-misp-the-eventreport-uploadpicture-method-in-processed-a) (info, published 22 Sep 2026) ## Vulnerabilities per week 6 vulnerabilities in the last four weeks, down 82% on the four before (33). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 20 | 0 | 0 | | 28 Sep 2026 | 12 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 6 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## MISP Project technologies - [MISP Project MISP](https://junglewise.ai/threats/technologies/misp-project-misp): 38 vulnerabilities - [MISP Project Misp-Modules](https://junglewise.ai/threats/technologies/misp-modules): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "MISP Project vulnerabilities", https://junglewise.ai/threats/vendors/misp-project, 9 November 2026.