MISP EUVD-2026-34257

SQL injection in MISP threat intelligence platform versions prior to 2.5.37 allows remote unauthenticated attackers to m

Broken access control in MISP Core's bulk deletion handlers lets any authenticated user holding the broad perm_add or pe

Insecure direct object reference flaws in MISP threat-intelligence platform allow an authenticated user with access to a

Multiple OAuth 2.0 flow weaknesses in the MISP AAD (Azure Active Directory) authentication plugin allow session hijackin

Authenticated arbitrary code execution in MISP allows a site administrator to abuse the Kafka_rdkafka_config setting to

Privilege escalation in MISP threat intelligence platform versions through 2.5.38 allows authenticated users to modify o

Stored cross-site scripting in MISP (Malware Information Sharing Platform) versions before 2.5.28 allows authenticated u

LDAP injection in MISP (Malware Information Sharing Platform) versions prior to 2.5.36 enables unauthenticated attackers

Remote code execution in MISP allows authenticated site administrators to abuse the JsonLogTool NDJSON error log configu

Privilege escalation in MISP threat intelligence platform versions prior to 2.5.37 allows organization administrators to

Insecure Direct Object Reference in MISP 2.5.0 through 2.5.37 allows authenticated users with shadow attribute submissio

OTP authentication bypass in MISP affects deployments where LdapAuth.mixedAuth=true is combined with Security.require_ot