Recent Items
(Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops of Shell/debian-minbase-install.sh. The installer invokes mkpasswd to generate yescrypt password hashes but does not check the command's return value and unconditionally accepts the result. If mkpasswd fails to generate a yescrypt hash, for example because an incompatible mkpasswd implementation or an environment without yescrypt support i…
Published on Fri, 04 Sep 2026 12:59:59 +0000
Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP
Published on Fri, 04 Sep 2026 09:40:54 +0000
MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests
Published on Fri, 04 Sep 2026 09:27:36 +0000
MISP Attribute Deletion Authorization Bypass Allows Users Without Modify Permissions to Delete Attributes
Published on Fri, 04 Sep 2026 09:05:41 +0000
MISP Sharing Group Authorization Bypass via Omitted Distribution Parameter
Published on Fri, 04 Sep 2026 08:53:46 +0000
Server-Side Request Forgery via Favicon Redirect to Local Network Resources in PlaywrightCapture
Published on Thu, 03 Sep 2026 16:17:20 +0000
MISP Event Template Definition Validation Bypass Allows Persistent Denial of Service
Published on Thu, 03 Sep 2026 15:37:47 +0000
Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking
Published on Thu, 03 Sep 2026 15:30:42 +0000
Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass
Published on Thu, 03 Sep 2026 15:22:59 +0000
MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request
Published on Thu, 03 Sep 2026 15:13:00 +0000