Vulnerabilities

TI-2026-65680 CVE-2026-103389 · GHSA-58w8-2929-fqhf

MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation Graph

LOW 27

MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path.

CVSS 4.0MEDIUM 6.2 Network Low privileges User interaction EPSS 0.00302 Published 2026-09-30 Fixed in 2.5.48 CWE-20

TI-2026-65679 CVE-2026-103388 · GHSA-ccjm-jpcq-p5hf

LOW 27

MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER_VALIDATE_URL validation.

CVSS 4.0MEDIUM 6.2 Network Low privileges User interaction EPSS 0.00243 Published 2026-09-30 Fixed in 2.5.48 CWE-79

TI-2026-65668 CVE-2026-103321 · GHSA-w4mv-4x7w-vpvv

LOW 36

MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature.

CVSS 4.0HIGH 8.3 Network Low privileges User interaction EPSS 0.0036 Published 2026-09-30 Fixed in 2.5.48 CWE-20

TI-2026-65615 CVE-2026-103239 · GHSA-vpmp-h7jx-6gfx

LOW 39

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00255 Published 2026-09-30 Fixed in 2.5.48 CWE-284

TI-2026-65614 CVE-2026-103237 · GHSA-52c6-qg88-jh84

LOW 36

MISP contains an improper input validation vulnerability in its ORM save path.

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.0023 Published 2026-09-30 Fixed in 2.5.48 CWE-20

TI-2026-65613 CVE-2026-103235 · GHSA-j2mf-q9c3-gwxw

LOW 39

MISP contains a mass assignment vulnerability in the event delegation feature.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00276 Published 2026-09-30 Fixed in 2.5.48 CWE-639