WID-SEC-W-2026-3705

csafDEcert_bund

DeutschShown in its original language — a full translation is planned for a future version.

MISP: Mehrere Schwachstellen

view advisory published 2026-10-01

Ein Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um erweiterte Berechtigungen zu erlangen, beliebigen Code auszuführen, Daten offenzulegen und zu manipulieren oder Cross-Site-Scripting-Angriffe durchzuführen.

01

describes (6)

Related CVEs.

IDseverity exploitable
CVE-2026-103858US——
MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only…
CVE-2026-103664US——
MISP contains a reflected cross-site scripting (XSS) vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly i…
CVE-2026-103662US——
MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag). The affected forms echoed a…
CVE-2026-103659US—OT elevated—
MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment…
CVE-2026-103655US—OT elevated—
MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once within its time-based va…
CVE-2026-103651US——
MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (paper) token and rewinding of the token counter. The HOTP v…
02

references

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan