misp-project has 113 CVEs on record between 2016 and 2026. Disclosure cadence is accelerating: 20 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 20. The median CVSS is 6.1 (medium), with 25 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-79 (45) and CWE-862 (12).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.1
- Publish → KEV
- —
- Last 90 days
- 20 prev 0
Weakness classes
Products
- misp 113
Worst active — by depth score
CVE-2018-19908High· 8.8An issue was discovered in MISP 2.4.9x before 2.4.9964CVE-2026-85216Critical· 9.8MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. The custom LdapAuthenticate and LinOTPAuthenticate components replace Cak…54CVE-2024-29859Critical· 9.8In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload.54CVE-2024-29858Critical· 9.8In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload.54CVE-2024-25675Critical· 9.8An issue was discovered in MISP before 2.4.18454
misp-project vulnerabilities
CVEs affecting misp-project, newest first. Open any entry for full detail, references, and exploit status.
113 CVEsRSS
CVE-2020-8893High· 7.5An issue was discovered in MISP before 2.4.121
An issue was discovered in MISP before 2.4.121. The Galaxy view contained an incorrectly sanitized search string in app/View/Galaxies/view.ctp.
CVE-2020-8892High· 8.1An issue was discovered in MISP before 2.4.121
An issue was discovered in MISP before 2.4.121. It did not consider the HTTP PUT method when trying to block a brute-force series of invalid requests.
CVE-2020-8891Medium· 5.9An issue was discovered in MISP before 2.4.121
An issue was discovered in MISP before 2.4.121. It did not canonicalize usernames when trying to block a brute-force series of invalid requests.
CVE-2020-8890Medium· 5.9An issue was discovered in MISP before 2.4.121
An issue was discovered in MISP before 2.4.121. It mishandled time skew (between the machine hosting the web server and the machine hosting the database) when trying to block a brute-force series of invalid requests.
CVE-2019-19379Medium· 5.3In app/Controller/TagsController.php in MISP 2.4.118, users can bypass intended restrictions on tagging data.
In app/Controller/TagsController.php in MISP 2.4.118, users can bypass intended restrictions on tagging data.
CVE-2019-16202Medium· 6.5MISP before 2.4.115 allows privilege escalation in certain situations
MISP before 2.4.115 allows privilege escalation in certain situations. After updating to 2.4.115, escalation attempts are blocked by the __checkLoggedActions function with a "This could be an indication of an attempted privilege escalati…
CVE-2019-14286Medium· 6.1In app/webroot/js/event-graph.js in MISP 2.4.111, a stored XSS vulnerability exists in the event-graph view when a user toggles the event graph view
In app/webroot/js/event-graph.js in MISP 2.4.111, a stored XSS vulnerability exists in the event-graph view when a user toggles the event graph view. A malicious MISP event must be crafted in order to trigger the vulnerability.
CVE-2019-12868High· 7.2app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP file_exists function is used with user-controlled entries, and phar:// URLs trigger deserialization.
app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP file_exists function is used with user-controlled entries, and phar:// URLs trigger deserialization.
CVE-2019-12794Medium· 6.6An issue was discovered in MISP 2.4.108
An issue was discovered in MISP 2.4.108. Organization admins could reset credentials for site admins (organization admins have the inherent ability to reset passwords for all of their organization's users). This, however, could be abused…
CVE-2019-11814Medium· 6.1An issue was discovered in app/webroot/js/misp.js in MISP before 2.4.107
An issue was discovered in app/webroot/js/misp.js in MISP before 2.4.107. There is persistent XSS via image names in titles, as demonstrated by a screenshot.
CVE-2019-11813Medium· 6.1An issue was discovered in app/View/Elements/Events/View/value_field.ctp in MISP before 2.4.107
An issue was discovered in app/View/Elements/Events/View/value_field.ctp in MISP before 2.4.107. There is persistent XSS via link type attributes with javascript:// links.
CVE-2019-11812Medium· 6.1A persistent XSS issue was discovered in app/View/Helper/CommandHelper.php in MISP before 2.4.107
A persistent XSS issue was discovered in app/View/Helper/CommandHelper.php in MISP before 2.4.107. JavaScript can be included in the discussion interface, and can be triggered by clicking on the link.
CVE-2019-10254Medium· 6.1In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS vulnerability.
In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS vulnerability.
CVE-2019-9482Medium· 5.3In MISP 2.4.102, an authenticated user can view sightings that they should not be eligible for
In MISP 2.4.102, an authenticated user can view sightings that they should not be eligible for. Exploiting this requires access to the event that has received the sighting. The issue affects instances with restrictive sighting settings (…
CVE-2018-19908High· 8.8PoCAn issue was discovered in MISP 2.4.9x before 2.4.99
An issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php (the STIX 1 import code), an unescaped filename string is used to construct a shell command. This vulnerability can be abused by a malicious authenticated user …
CVE-2018-12649Critical· 9.8An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92
An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. An adversary can bypass the brute-force protection by using a PUT HTTP method instead of a POST HTTP method in the login part, because this protection was only…
CVE-2018-11562Medium· 6.1An issue was discovered in MISP 2.4.91
An issue was discovered in MISP 2.4.91. A vulnerability in app/View/Elements/eventattribute.ctp allows reflected XSS if a user clicks on a malicious link for an event view and then clicks on the deleted attributes quick filter.
CVE-2018-6926High· 7.2In app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override of a path variable on certain Red Hed Enterprise Linux and CentOS systems (where rh_shell_fix was enabled), and consequently allowed site adm…
In app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override of a path variable on certain Red Hed Enterprise Linux and CentOS systems (where rh_shell_fix was enabled), and consequently allowed site adm…
CVE-2017-16946Medium· 4.9The admin_edit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enable_password field, which allows admins to discover a hashed password by reading the audit log.
The admin_edit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enable_password field, which allows admins to discover a hashed password by reading the audit log.
CVE-2017-13671Medium· 6.1app/View/Helper/CommandHelper.php in MISP before 2.4.79 has persistent XSS via comments
app/View/Helper/CommandHelper.php in MISP before 2.4.79 has persistent XSS via comments. It only impacts the users of the same instance because the comment field is not part of the MISP synchronisation.
CVE-2015-5721Critical· 9.8Malware Information Sharing Platform (MISP) before 2.3.90 allows remote attackers to conduct PHP object injection attacks via crafted serialized data, related to TemplatesController.php and populate_event_from_template_attributes.ctp.
Malware Information Sharing Platform (MISP) before 2.3.90 allows remote attackers to conduct PHP object injection attacks via crafted serialized data, related to TemplatesController.php and populate_event_from_template_attributes.ctp.
CVE-2015-5720Medium· 6.1Multiple cross-site scripting (XSS) vulnerabilities in the template-creation feature in Malware Information Sharing Platform (MISP) before 2.3.90 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) add…
Multiple cross-site scripting (XSS) vulnerabilities in the template-creation feature in Malware Information Sharing Platform (MISP) before 2.3.90 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) add…
CVE-2015-5719Critical· 9.8app/Controller/TemplatesController.php in Malware Information Sharing Platform (MISP) before 2.3.92 does not properly restrict filenames under the tmp/files/ directory, which has unspecified impact and attack vectors.
app/Controller/TemplatesController.php in Malware Information Sharing Platform (MISP) before 2.3.92 does not properly restrict filenames under the tmp/files/ directory, which has unspecified impact and attack vectors.