# Recent vulnerabilities from GNA-1 (CIRCL) ## [gcve-1-2026-0020](https://vulnerability.circl.lu/vuln/gcve-1-2026-0020) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "D1000", "vendor": "Eir", "versions": [ { "lessThanOrEqual": "2.00", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "datePublic": "2016-12-09T23:00:00.000Z", "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Improper Input Validation vulnerability in Eir D1000 allows Input Data Manipulation.

This issue affects D1000: through  2.00(AADU.5)_20150909

" } ], "value": "Improper Input Validation vulnerability in Eir D1000 allows Input Data Manipulation.This issue affects D1000: through  2.00(AADU.5)_20150909" } ], "impacts": [ { "capecId": "CAPEC-153", "descriptions": [ { "lang": "en", "value": "CAPEC-153 Input Data Manipulation" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 10, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "media-coverage" ], "url": "https://threatprotect.qualys.com/2016/12/14/remote-code-execution-attack-against-eircom-d1000-router/" } ], "source": { "discovery": "UNKNOWN" }, "title": "Remote Code Execution Attack Against Eircom D1000 Router", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-0020", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2026-03-11T14:12:00.000Z", "dateUpdated": "2026-03-11T14:23:24.609831Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2026-0020", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2026-03-11T14:12:30.597173Z" ], [ "alexandre.dulaunoy@circl.lu", "2026-03-11T14:21:34.097103Z" ], [ "cedric.bonhomme@circl.lu", "2026-03-11T14:23:24.609831Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-0021](https://vulnerability.circl.lu/vuln/gcve-1-2026-0021) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "FlexPLM", "vendor": "windchill", "versions": [ { "lessThanOrEqual": "13.0.3.0", "status": "affected", "version": "0", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "product": "PDMLink", "vendor": "Windchill", "versions": [ { "lessThanOrEqual": "13.0.3.0", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Improper Control of Generation of Code ('Code Injection') vulnerability in windchill FlexPLM, Windchill PDMLink.

This issue affects FlexPLM: through 13.0.3.0; PDMLink: through 13.0.3.0.

" } ], "value": "Improper Control of Generation of Code ('Code Injection') vulnerability in windchill FlexPLM, Windchill PDMLink.This issue affects FlexPLM: through 13.0.3.0; PDMLink: through 13.0.3.0." } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 10, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "vendor-advisory" ], "url": "https://support.eacpds.com/hc/en-us/article_attachments/47430019070996" }, { "tags": [ "vendor-advisory" ], "url": "https://www.ptc.com/en/support/article/CS466318?_gl=1*196gmri*_gcl_au*Njc4ODc0NTE4LjE3NzQxNzI5NTc.*_ga*MTY0OTgyOTM1NC4xNzc0MTcyOTU2*_ga_7NMP2MSYPM*czE3NzQxNzI5NTYkbzEkZzAkdDE3NzQxNzI5ODQkajMyJGwwJGgw&as=0" } ], "source": { "discovery": "UNKNOWN" }, "title": "Critical RCE Vulnerability reported in Windchill", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-0021", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2026-0021", "datePublished": "2026-03-23T12:30:40.249187Z", "dateUpdated": "2026-03-23T12:30:40.249187Z", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2026-03-23T12:30:40.249187Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-0022](https://vulnerability.circl.lu/vuln/gcve-1-2026-0022) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThanOrEqual": "2.5.35", "status": "affected", "version": "2.5.30", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Bilal Teke" }, { "lang": "en", "type": "remediation developer", "value": "Thomas Lacroix" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\nStored XSS in the Overmind UI (not enabled by default) due to missing output escaping of galaxy cluster values and attribute comments, allowing malicious JavaScript execution when crafted content is viewed.

This issue affects misp: from 2.5.30 through 2.5.35 in the beta UI.

" } ], "value": "Stored XSS in the Overmind UI (not enabled by default) due to missing output escaping of galaxy cluster values and attribute comments, allowing malicious JavaScript execution when crafted content is viewed.\nThis issue affects misp: from 2.5.30 through 2.5.35 in the beta UI." } ], "impacts": [ { "capecId": "CAPEC-63", "descriptions": [ { "lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.4, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/b9bc50c715a1e886889f063f14dec1a26e442227" } ], "source": { "discovery": "UNKNOWN" }, "title": "MISP - Beta Overmind UI Stored Cross-Site Scripting in Galaxy and Comment Fields", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-0022", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2026-0022", "datePublished": "2026-03-30T09:48:36.968649Z", "dateUpdated": "2026-03-30T09:48:36.968649Z", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2026-03-30T09:48:36.968649Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-0023](https://vulnerability.circl.lu/vuln/gcve-1-2026-0023) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "ail-framework", "vendor": "ail-project", "versions": [ { "lessThanOrEqual": "6.7", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Jeroen Gui" }, { "lang": "en", "type": "remediation developer", "value": "Aurélien Thirion" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "A stored cross-site scripting (XSS) vulnerability was identified in the modal item preview functionality. When item content longer than 800 characters was processed, attacker-controlled content was returned without an explicit text/plain content type, allowing the browser to interpret the response as active HTML. This could result in execution of arbitrary JavaScript in the context of an authenticated user viewing a crafted item." } ], "value": "A stored cross-site scripting (XSS) vulnerability was identified in the modal item preview functionality. When item content longer than 800 characters was processed, attacker-controlled content was returned without an explicit text/plain content type, allowing the browser to interpret the response as active HTML. This could result in execution of arbitrary JavaScript in the context of an authenticated user viewing a crafted item." } ], "impacts": [ { "capecId": "CAPEC-592", "descriptions": [ { "lang": "en", "value": "CAPEC-592 Stored XSS" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.5, "baseSeverity": "HIGH", "privilegesRequired": "HIGH", "providerUrgency": "AMBER", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/ail-project/ail-framework/commit/f2799b48732f97d0a0c7ea188b55116d2d0242f5" } ], "source": { "discovery": "EXTERNAL" }, "title": "Stored XSS in modal item preview for long item content in AIL Framework", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-0023", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-39416", "datePublished": "2026-04-07T06:29:00.000Z", "dateUpdated": "2026-04-08T04:22:15.084342Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2026-0023", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2026-04-07T06:29:37.404767Z" ], [ "alexandre.dulaunoy@circl.lu", "2026-04-08T04:22:15.084342Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-0024](https://vulnerability.circl.lu/vuln/gcve-1-2026-0024) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.36", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Ayush Parkara" }, { "lang": "en", "type": "remediation developer", "value": "Luciano Righetti" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "
Improper neutralization of special elements in an LDAP query in ApacheAuthenticate.php allows LDAP injection via an unsanitized username value when ApacheAuthenticate.apacheEnv is configured to use a user-controlled server variable instead of REMOTE_USER (such as in certain proxy setups). An attacker able to control that value can manipulate the LDAP search filter and potentially bypass authentication constraints or cause unauthorized LDAP queries.


" } ], "value": "Improper neutralization of special elements in an LDAP query in ApacheAuthenticate.php allows LDAP injection via an unsanitized username value when ApacheAuthenticate.apacheEnv is configured to use a user-controlled server variable instead of REMOTE_USER (such as in certain proxy setups). An attacker able to control that value can manipulate the LDAP search filter and potentially bypass authentication constraints or cause unauthorized LDAP queries." } ], "impacts": [ { "capecId": "CAPEC-153", "descriptions": [ { "lang": "en", "value": "CAPEC-153 Input Data Manipulation" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 8.8, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/d7d671ea8f5822e91207dcad2003c35c30092a32" } ], "source": { "discovery": "UNKNOWN" }, "title": "LDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variable", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-0024", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-39962", "datePublished": "2026-04-08T08:28:00.000Z", "dateUpdated": "2026-04-09T04:44:04.936665Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2026-0024", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2026-04-08T08:28:26.044700Z" ], [ "alexandre.dulaunoy@circl.lu", "2026-04-09T04:44:04.936665Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-0025](https://vulnerability.circl.lu/vuln/gcve-1-2026-0025) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "ransomlook", "vendor": "ransomlook", "versions": [ { "lessThan": "<1.9.0", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Jeroen Pinoy" }, { "lang": "en", "type": "remediation developer", "value": "Jeroen Pinoy" }, { "lang": "en", "type": "remediation verifier", "value": "Fafner [_KeyZee_]" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "
The API in the affected application improperly filters private location entries in `website/web/api/genericapi.py`. 

Because the code removes elements from a list while iterating over it, entries marked as private may be unintentionally retained in API responses, allowing unauthorized disclosure of non-public location information.
" } ], "value": "The API in the affected application improperly filters private location entries in `website/web/api/genericapi.py`. \n\n\n\n\nBecause the code removes elements from a list while iterating over it, entries marked as private may be unintentionally retained in API responses, allowing unauthorized disclosure of non-public location information." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "AMBER", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/RansomLook/RansomLook/commit/80cdfb51a2ac225a2af370e2d7c346734daaee83" } ], "source": { "discovery": "UNKNOWN" }, "title": "RansomLook - Improper Filtering of Private Location Entries in API Endpoints Leads to Information Exposure", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-0025", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-40584", "datePublished": "2026-04-12T15:22:00.000Z", "dateUpdated": "2026-04-15T20:29:51.794609Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2026-0025", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2026-04-12T15:22:08.657778Z" ], [ "alexandre.dulaunoy@circl.lu", "2026-04-12T15:27:31.523942Z" ], [ "alexandre.dulaunoy@circl.lu", "2026-04-15T20:29:51.794609Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-0026](https://vulnerability.circl.lu/vuln/gcve-1-2026-0026) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp-modules", "vendor": "misp", "versions": [ { "lessThanOrEqual": "3.0.7", "status": "affected", "version": "3.0.0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Bilal Teke" }, { "lang": "en", "type": "remediation developer", "value": "David Cruciani" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "A Cross-Site Request Forgery vulnerability in the MISP Modules website allowed an attacker to cause an authenticated user to submit unintended requests to the home endpoint. The vulnerability was due to the home blueprint being exempted from CSRF protection. This could allow modification of session query data in the context of the authenticated user. The issue was fixed by enabling CSRF protection for the affected blueprint and hardening query parsing." } ], "value": "A Cross-Site Request Forgery vulnerability in the MISP Modules website allowed an attacker to cause an authenticated user to submit unintended requests to the home endpoint. The vulnerability was due to the home blueprint being exempted from CSRF protection. This could allow modification of session query data in the context of the authenticated user. The issue was fixed by enabling CSRF protection for the affected blueprint and hardening query parsing." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/MISP/misp-modules/commit/52cda9caa003cafe87e14ae3721db5e16f6f111a" } ], "source": { "discovery": "UNKNOWN" }, "title": "misp-modules website - Missing CSRF protection in the website home blueprint", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-0026", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-44364", "datePublished": "2026-04-29T09:24:00.000Z", "dateUpdated": "2026-05-06T16:04:44.788582Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2026-0026", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2026-04-29T09:24:35.531890Z" ], [ "alexandre.dulaunoy@circl.lu", "2026-05-06T16:04:44.788582Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-0027](https://vulnerability.circl.lu/vuln/gcve-1-2026-0027) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp-modules", "vendor": "misp", "versions": [ { "lessThanOrEqual": "3.0.7", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Bilal Teke" }, { "lang": "en", "type": "remediation developer", "value": "David Cruciani" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "An unsafe remote resource fetching vulnerability existed in MISP Modules expansion modules. The html_to_markdown module accepted arbitrary HTTP(S) URLs without sufficient validation, which could allow Server-Side Request Forgery against loopback, private, or link-local network resources. Additionally, the qrcode module disabled TLS certificate verification when retrieving remote images, exposing requests to potential man-in-the-middle interception or response tampering. The issue was fixed by validating URL schemes, blocking local and private address ranges, resolving hostnames before fetching, enforcing request timeouts, and re-enabling TLS certificate verification." } ], "value": "An unsafe remote resource fetching vulnerability existed in MISP Modules expansion modules. The html_to_markdown module accepted arbitrary HTTP(S) URLs without sufficient validation, which could allow Server-Side Request Forgery against loopback, private, or link-local network resources. Additionally, the qrcode module disabled TLS certificate verification when retrieving remote images, exposing requests to potential man-in-the-middle interception or response tampering. The issue was fixed by validating URL schemes, blocking local and private address ranges, resolving hostnames before fetching, enforcing request timeouts, and re-enabling TLS certificate verification." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "baseScore": 5.8, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-610", "description": "CWE-610 Externally Controlled Reference to a Resource in Another Sphere", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/MISP/misp-modules/commit/52cda9caa003cafe87e14ae3721db5e16f6f111a" } ], "source": { "discovery": "UNKNOWN" }, "title": "Unsafe remote resource fetching in expansion misp-modules", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-0027", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-44363", "datePublished": "2026-04-29T12:05:00.000Z", "dateUpdated": "2026-05-06T16:03:40.556833Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2026-0027", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2026-04-29T12:05:45.275949Z" ], [ "alexandre.dulaunoy@circl.lu", "2026-05-06T16:03:40.556833Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-0028](https://vulnerability.circl.lu/vuln/gcve-1-2026-0028) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "PlaywrightCapture", "vendor": "LookyLoo", "versions": [ { "lessThan": "1.39.6", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "remediation developer", "value": "Raphael Vinot" }, { "lang": "en", "type": "finder", "value": "Jeroen Gui" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

PlaywrightCapture did not sufficiently restrict navigations and resource requests initiated by rendered pages. An attacker-controlled page could abuse browser-side redirection mechanisms, such as window.location.href, to make the capture process open file:// URLs or request resources hosted on private, loopback, link-local, or otherwise non-public IP addresses.

\n

In deployments where PlaywrightCapture processes untrusted URLs, this could allow a remote attacker to perform server-side request forgery against internal services or attempt to access local files from the capture environment. Depending on what capture artifacts are generated and exposed, responses from those resources could potentially be leaked through screenshots, saved page content, logs, or other capture outputs.

\n

The patch mitigates the issue by introducing request routing checks that block secondary requests to local files, non-global IP addresses, and .local domains when only_global_lookup is enabled, while still allowing the originally requested capture URL.


" } ], "value": "PlaywrightCapture did not sufficiently restrict navigations and resource requests initiated by rendered pages. An attacker-controlled page could abuse browser-side redirection mechanisms, such as window.location.href, to make the capture process open file:// URLs or request resources hosted on private, loopback, link-local, or otherwise non-public IP addresses.\n\n\nIn deployments where PlaywrightCapture processes untrusted URLs, this could allow a remote attacker to perform server-side request forgery against internal services or attempt to access local files from the capture environment. Depending on what capture artifacts are generated and exposed, responses from those resources could potentially be leaked through screenshots, saved page content, logs, or other capture outputs.\n\n\nThe patch mitigates the issue by introducing request routing checks that block secondary requests to local files, non-global IP addresses, and .local domains when only_global_lookup is enabled, while still allowing the originally requested capture URL." } ], "impacts": [ { "capecId": "CAPEC-664", "descriptions": [ { "lang": "en", "value": "CAPEC-664 Server Side Request Forgery" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "lang": "en", "type": "CWE" } ] }, { "descriptions": [ { "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/Lookyloo/PlaywrightCapture/commit/49e289eba756e4fbac1322c33cfd111411562405" } ], "source": { "discovery": "UNKNOWN" }, "title": "LookyLoo - PlaywrightCapture permits access to local files and internal network resources during page capture", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-0028", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2026-04-29T19:28:00.000Z", "dateUpdated": "2026-04-29T19:28:44.316023Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2026-0028", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2026-04-29T19:28:20.659212Z" ], [ "alexandre.dulaunoy@circl.lu", "2026-04-29T19:28:44.316023Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-0029](https://vulnerability.circl.lu/vuln/gcve-1-2026-0029) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.37", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Jeroen Pinoy" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "MISP Collections did not enforce RFC 4122 UUID validation on the `uuid` field. As a result, a user able to create or modify Collection records could submit malformed UUID values, potentially causing integrity issues or unexpected behaviour in code paths that assume Collection UUIDs are valid identifiers.

The issue has been fixed by adding model-level validation for the Collection `uuid` field. The field is now required to match a valid RFC 4122 UUID before being accepted. The fix was committed in `f8b20358c3cd8fd3d784452901876f2db0acbf05` and is included in MISP v2.5.37." } ], "value": "MISP Collections did not enforce RFC 4122 UUID validation on the `uuid` field. As a result, a user able to create or modify Collection records could submit malformed UUID values, potentially causing integrity issues or unexpected behaviour in code paths that assume Collection UUIDs are valid identifiers.\n\nThe issue has been fixed by adding model-level validation for the Collection `uuid` field. The field is now required to match a valid RFC 4122 UUID before being accepted. The fix was committed in `f8b20358c3cd8fd3d784452901876f2db0acbf05` and is included in MISP v2.5.37." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/f8b20358c3cd8fd3d784452901876f2db0acbf05" } ], "source": { "discovery": "UNKNOWN" }, "title": "Improper UUID validation in MISP Collections", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-0029", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-44379", "datePublished": "2026-04-29T20:03:00.000Z", "dateUpdated": "2026-05-06T16:01:52.283022Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2026-0029", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2026-04-29T20:03:59.892100Z" ], [ "alexandre.dulaunoy@circl.lu", "2026-05-06T16:01:52.283022Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-0030](https://vulnerability.circl.lu/vuln/gcve-1-2026-0030) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "<2.5.37", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "finder", "value": "Jeroen Gui" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "An improper access control vulnerability in the authentication key reset functionality allowed an authenticated organization administrator to reset authentication keys belonging to site administrator accounts within the same organization. Because non-site administrators were not explicitly prevented from accessing or resetting site administrator auth keys, an attacker with organization administrator privileges could potentially obtain a newly generated auth key for a higher-privileged account and use it to escalate privileges. The issue is fixed by preventing non-site administrators from viewing or resetting authentication keys associated with site administrator roles." } ], "value": "An improper access control vulnerability in the authentication key reset functionality allowed an authenticated organization administrator to reset authentication keys belonging to site administrator accounts within the same organization. Because non-site administrators were not explicitly prevented from accessing or resetting site administrator auth keys, an attacker with organization administrator privileges could potentially obtain a newly generated auth key for a higher-privileged account and use it to escalate privileges. The issue is fixed by preventing non-site administrators from viewing or resetting authentication keys associated with site administrator roles." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/cb4048873ca934855007406b87ae0d124f50224a" } ], "source": { "discovery": "UNKNOWN" }, "title": "MISP - Improper access control in auth key reset allows privilege escalation to site administrator", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-0030", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-44380", "datePublished": "2026-04-29T20:10:00.000Z", "dateUpdated": "2026-05-06T16:01:17.334511Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2026-0030", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2026-04-29T20:10:32.991353Z" ], [ "alexandre.dulaunoy@circl.lu", "2026-05-06T16:01:17.334511Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-0031](https://vulnerability.circl.lu/vuln/gcve-1-2026-0031) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.37", "status": "affected", "version": "0" } ] } ], "credits": [ { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "finder", "value": "Jeroen Gui" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

A SQL injection vulnerability existed in the handling of user-controlled ordering parameters in the event and shadow attribute listing endpoints. The affected code accepted order or sort values from request parameters and incorporated them into database query ordering clauses without sufficient validation of the requested field name.

\n

An attacker with access to the affected endpoints could craft a malicious ordering parameter to manipulate the generated SQL query. Depending on database permissions and query context, this could potentially allow unauthorized access to data, modification of query behavior, or other database-level impact.

\n

The issue was fixed by removing direct use of the user-supplied order parameter, validating requested ordering fields against allowed model fields or the model schema, and constructing the order clause using validated field names and normalized sort directions only.


" } ], "value": "A SQL injection vulnerability existed in the handling of user-controlled ordering parameters in the event and shadow attribute listing endpoints. The affected code accepted order or sort values from request parameters and incorporated them into database query ordering clauses without sufficient validation of the requested field name.\n\n\nAn attacker with access to the affected endpoints could craft a malicious ordering parameter to manipulate the generated SQL query. Depending on database permissions and query context, this could potentially allow unauthorized access to data, modification of query behavior, or other database-level impact.\n\n\nThe issue was fixed by removing direct use of the user-supplied order parameter, validating requested ordering fields against allowed model fields or the model schema, and constructing the order clause using validated field names and normalized sort directions only." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "lang": "en" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "pat" ], "url": "https://github.com/MISP/MISP/commit/53fc6be7da1c010ca4696a37c6e27bb699377efa" } ], "source": { "discovery": "UNKNOWN" }, "title": "MISP - SQL injection via unvalidated ordering parameters in event and shadow attribute listings", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-0031", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-44381", "datePublished": "2026-04-29T20:14:00.000Z", "dateUpdated": "2026-05-06T16:00:13.755114Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2026-0031", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2026-04-29T20:14:47.117221Z" ], [ "alexandre.dulaunoy@circl.lu", "2026-05-06T16:00:13.755114Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-0032](https://vulnerability.circl.lu/vuln/gcve-1-2026-0032) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.37", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "remediation developer", "value": "Luciano Righetti" }, { "lang": "en", "type": "finder", "value": "Bjørn Helseth (TV 2 Norway)" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in misp allows Stored XSS.

This issue affects MISP before 2.5.37.

A stored cross-site scripting vulnerability exists in the template element attribute handling logic. The application accepted arbitrary values for the TemplateElementAttribute type and category fields without validating them against the known MISP attribute type and category definitions. An attacker with permission to create or modify template element attributes could store a crafted type value.


This affects the old templating (not more accessible in 2.5.37) engine from MISP which will be removed in 2.5.38

" } ], "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in misp allows Stored XSS.This issue affects MISP before 2.5.37.\n\n\nA stored cross-site scripting vulnerability exists in the template element attribute handling logic. The application accepted arbitrary values for the TemplateElementAttribute type and category fields without validating them against the known MISP attribute type and category definitions. An attacker with permission to create or modify template element attributes could store a crafted type value.\n\n\nThis affects the old templating (not more accessible in 2.5.37) engine from MISP which will be removed in 2.5.38" } ], "impacts": [ { "capecId": "CAPEC-592", "descriptions": [ { "lang": "en", "value": "CAPEC-592 Stored XSS" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.8, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "GREEN", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Green", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch", "Luciano Righetti" ], "url": "https://github.com/MISP/MISP/commit/62824e5ca0056d01b195f70466ea0d382cca06d0" } ], "source": { "discovery": "UNKNOWN" }, "title": "MISP core - Stored XSS in MISP template (old engine) element attribute type", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-0032", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-8080", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2026-0032", "datePublished": "2026-05-07T12:09:04.093898Z", "dateUpdated": "2026-05-07T12:09:04.093898Z", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2026-05-07T12:09:04.093898Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-0033](https://vulnerability.circl.lu/vuln/gcve-1-2026-0033) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThanOrEqual": "2.5.37", "status": "affected", "version": "2.5.0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Ali Ganiyev" }, { "lang": "en", "type": "remediation developer", "value": "Luciano Righetti" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "MISP’s OIDC authentication plugin allowed automatic linking of an OIDC identity to an existing local user account based on the email claim when the local account had no stored sub value. Under insecure or untrusted IdP configurations where email ownership is not enforced, an attacker with a valid OIDC token could assert a victim’s email address and authenticate as that user, leading to account takeover.
" } ], "value": "MISP’s OIDC authentication plugin allowed automatic linking of an OIDC identity to an existing local user account based on the email claim when the local account had no stored sub value. Under insecure or untrusted IdP configurations where email ownership is not enforced, an attacker with a valid OIDC token could assert a victim’s email address and authenticate as that user, leading to account takeover." } ], "impacts": [ { "capecId": "CAPEC-115", "descriptions": [ { "lang": "en", "value": "CAPEC-115 Authentication Bypass" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "baseScore": 6, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-287", "description": "CWE-287 Improper Authentication", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/71f5662c1b5886613d2cd5c72fd93bb4ca6fa172" } ], "source": { "discovery": "EXTERNAL" }, "title": "MISP OIDC authentication bypass via automatic email-based account linking under insecure IdP configurations", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-0033", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-9084", "datePublished": "2026-05-20T14:22:00.000Z", "dateUpdated": "2026-05-20T15:11:36.782113Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2026-0033", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2026-05-20T14:22:36.885719Z" ], [ "cedric.bonhomme@circl.lu", "2026-05-20T14:46:10.350476Z" ], [ "alexandre.dulaunoy@circl.lu", "2026-05-20T15:11:36.782113Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-0034](https://vulnerability.circl.lu/vuln/gcve-1-2026-0034) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThanOrEqual": "2.5.37", "status": "affected", "version": "2.5.0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Seth Kraft" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "The CSP report endpoint intended to limit logged CSP reports to 1 KB but incorrectly allowed reports up to 1 MB before truncation. On deployments where the endpoint is reachable by untrusted clients, this could allow attackers to generate excessive log volume and contribute to resource exhaustion or log flooding." } ], "value": "The CSP report endpoint intended to limit logged CSP reports to 1 KB but incorrectly allowed reports up to 1 MB before truncation. On deployments where the endpoint is reachable by untrusted clients, this could allow attackers to generate excessive log volume and contribute to resource exhaustion or log flooding." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.1, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/02932cccab230b295afcaf5aa05e363d30db0ec9" } ], "source": { "discovery": "UNKNOWN" }, "title": "CSP Report Endpoint Log Flooding via Incorrect Size Limit", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-0034", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-9137", "datePublished": "2026-05-20T18:15:00.000Z", "dateUpdated": "2026-05-20T18:42:33.806971Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2026-0034", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2026-05-20T18:15:50.899393Z" ], [ "alexandre.dulaunoy@circl.lu", "2026-05-20T18:42:33.806971Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-0035](https://vulnerability.circl.lu/vuln/gcve-1-2026-0035) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThanOrEqual": "2.5.37", "status": "affected", "version": "2.5.0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Seth Kraft" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

A vulnerability was identified in the ShadowAttribute proposal creation workflow. The add action accepted user-controlled ShadowAttribute request data without removing the id field before saving the record. Because the underlying framework treats a supplied primary key as an instruction to update an existing record, an authenticated user able to submit shadow attribute proposals could provide the identifier of an existing ShadowAttribute and cause that record to be updated instead of creating a new proposal.

\n

This can result in unauthorized modification of existing shadow attributes, potentially affecting proposals associated with events the user should not be able to alter. Depending on deployment configuration and accessible API responses, the issue may also expose or move proposal data across event contexts.

\n

The vulnerability is caused by trusting a client-supplied primary key during object creation. The fix removes the id field from incoming ShadowAttribute data before processing, ensuring that the endpoint always creates a new proposal rather than updating an existing one. This has been fixed in MISP 2.5.38.


" } ], "value": "A vulnerability was identified in the ShadowAttribute proposal creation workflow. The add action accepted user-controlled ShadowAttribute request data without removing the id field before saving the record. Because the underlying framework treats a supplied primary key as an instruction to update an existing record, an authenticated user able to submit shadow attribute proposals could provide the identifier of an existing ShadowAttribute and cause that record to be updated instead of creating a new proposal.\n\n\nThis can result in unauthorized modification of existing shadow attributes, potentially affecting proposals associated with events the user should not be able to alter. Depending on deployment configuration and accessible API responses, the issue may also expose or move proposal data across event contexts.\n\n\nThe vulnerability is caused by trusting a client-supplied primary key during object creation. The fix removes the id field from incoming ShadowAttribute data before processing, ensuring that the endpoint always creates a new proposal rather than updating an existing one. This has been fixed in MISP 2.5.38." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.3, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/49911b1d4b6e4517d803e50e3d980aaa4d37c16d" } ], "source": { "discovery": "UNKNOWN" }, "title": "Unauthorized ShadowAttribute modification in MISP via client-supplied identifier", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-0035", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-9136", "datePublished": "2026-05-20T18:34:00.000Z", "dateUpdated": "2026-05-20T18:41:09.250167Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-0035", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2026-05-20T18:34:37.704452Z" ], [ "alexandre.dulaunoy@circl.lu", "2026-05-20T18:41:09.250167Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-0036](https://vulnerability.circl.lu/vuln/gcve-1-2026-0036) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "cti-transmute", "vendor": "misp", "versions": [ { "lessThan": "1.3", "status": "affected", "version": "1.2-dev", "versionType": "semver" }, { "lessThan": "1.3", "status": "unaffected", "version": "1.0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "remediation developer", "value": "ecrou-exact 🔩" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "A stored cross-site scripting (XSS) vulnerability exists in the notification panel of CTI Transmute in versions prior to the patched release. Notification messages containing user-controlled convert names were rendered in the notification bell dropdown using innerHTML without adequate sanitization. An attacker able to create or influence a convert name that is included in a notification could inject arbitrary JavaScript, which would execute in the browser of an authenticated user when they opened the notification panel. Successful exploitation could allow the attacker to perform actions in the victim's session or access information available to the application in the browser context. The issue was remediated by constructing notification elements through DOM methods and assigning notification message content via textContent instead of innerHTML. 

This vulnerability was only present on a development branch.
" } ], "value": "A stored cross-site scripting (XSS) vulnerability exists in the notification panel of CTI Transmute in versions prior to the patched release. Notification messages containing user-controlled convert names were rendered in the notification bell dropdown using innerHTML without adequate sanitization. An attacker able to create or influence a convert name that is included in a notification could inject arbitrary JavaScript, which would execute in the browser of an authenticated user when they opened the notification panel. Successful exploitation could allow the attacker to perform actions in the victim's session or access information available to the application in the browser context. The issue was remediated by constructing notification elements through DOM methods and assigning notification message content via textContent instead of innerHTML. \n\nThis vulnerability was only present on a development branch." } ], "impacts": [ { "capecId": "CAPEC-592", "descriptions": [ { "lang": "en", "value": "CAPEC-592 Stored XSS" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NEGLIGIBLE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "CLEAR", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/S:N/RE:L/U:Clear", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "LOW" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/MISP/cti-transmute/commit/cf42409badc27b13d9bb644b9175aa7f27e11259" } ], "source": { "discovery": "UNKNOWN" }, "title": "Stored Cross-Site Scripting (XSS) in CTI Transmute Notification Panel via Malicious Convert Names", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-0036", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-9806", "datePublished": "2026-05-27T15:06:00.000Z", "dateUpdated": "2026-05-28T06:42:02.283417Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-0036", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2026-05-27T15:06:55.641238Z" ], [ "theo.geffe@circl.lu", "2026-05-27T15:19:54.938350Z" ], [ "alexandre.dulaunoy@circl.lu", "2026-05-28T06:42:02.283417Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-20001](https://vulnerability.circl.lu/vuln/gcve-1-2026-20001) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "flowintel", "vendor": "flowintel", "versions": [ { "lessThan": "3.3.0", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Bilal Teke" }, { "lang": "en", "type": "remediation verifier", "value": "David Cruciani" }, { "lang": "en", "type": "remediation developer", "value": "Alexandre Dulaunoy" }, { "lang": "en", "type": "tool", "value": "Codex (GPT-5.5)" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "
FlowIntel up to version 3.3.0 contains a server-side request forgery (SSRF) vulnerability in the external reference URL probe functionality in app/case/task.py. An attacker who can submit an external reference URL can cause the application server to issue an HTTP HEAD request to an attacker-specified destination. Due to insufficient validation of the URL scheme and resolved destination address, affected versions may allow requests to loopback, link-local, private, reserved, or other restricted network resources, potentially enabling interaction with internal services or cloud metadata endpoints from the server's network context.


" } ], "value": "FlowIntel up to version 3.3.0 contains a server-side request forgery (SSRF) vulnerability in the external reference URL probe functionality in app/case/task.py. An attacker who can submit an external reference URL can cause the application server to issue an HTTP HEAD request to an attacker-specified destination. Due to insufficient validation of the URL scheme and resolved destination address, affected versions may allow requests to loopback, link-local, private, reserved, or other restricted network resources, potentially enabling interaction with internal services or cloud metadata endpoints from the server's network context." } ], "impacts": [ { "capecId": "CAPEC-664", "descriptions": [ { "lang": "en", "value": "CAPEC-664 Server Side Request Forgery" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NEGLIGIBLE", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.2, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "GREEN", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:H/SA:H/S:N/RE:L/U:Green", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "LOW" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/flowintel/flowintel/commit/68b523b47854c54bf36fd706c0fd5353063b5409" } ], "source": { "discovery": "UNKNOWN" }, "title": "FlowIntel external reference URL probe allows server-side request forgery", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-20001", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-9813", "datePublished": "2026-05-28T09:24:00.000Z", "dateUpdated": "2026-05-28T09:28:16.686697Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-20001" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-20081](https://vulnerability.circl.lu/vuln/gcve-1-2026-20081) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThanOrEqual": "2.5.38", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Andrea Capelli" }, { "lang": "en", "type": "remediation developer", "value": "Luciano Righetti" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement. In deployments configured with LdapAuth.mixedAuth=true and Security.require_otp=true, users authenticated through an authentication plugin, such as LDAP, may have their authenticated session established during the application beforeFilter phase before the normal login flow enforces the OTP challenge.

As a result, an attacker with valid primary authentication credentials could bypass the required OTP step by authenticating through the plugin-backed login flow and then directly accessing another application URL instead of completing the OTP verification page. This allows access to the application as the affected user without providing a valid TOTP, HOTP, or email OTP code.

The issue affects configurations where plugin-based authentication is enabled and OTP is expected to be mandatory. The fix ensures that OTP requirements are checked immediately after plugin authentication and before the user session is established, redirecting users to the appropriate OTP challenge when required.


" } ], "value": "An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement. In deployments configured with LdapAuth.mixedAuth=true and Security.require_otp=true, users authenticated through an authentication plugin, such as LDAP, may have their authenticated session established during the application beforeFilter phase before the normal login flow enforces the OTP challenge.\n\nAs a result, an attacker with valid primary authentication credentials could bypass the required OTP step by authenticating through the plugin-backed login flow and then directly accessing another application URL instead of completing the OTP verification page. This allows access to the application as the affected user without providing a valid TOTP, HOTP, or email OTP code.\n\nThe issue affects configurations where plugin-based authentication is enabled and OTP is expected to be mandatory. The fix ensures that OTP requirements are checked immediately after plugin authentication and before the user session is established, redirecting users to the appropriate OTP challenge when required." } ], "impacts": [ { "capecId": "CAPEC-115", "descriptions": [ { "lang": "en", "value": "CAPEC-115 Authentication Bypass" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 8.2, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-287", "description": "CWE-287 Improper Authentication", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/39b3cb15aac4318afdd2ab63b96c2eac12b271fe" } ], "source": { "discovery": "UNKNOWN" }, "title": "OTP bypass via plugin-based LDAP authentication in MISP when LDAP mixed authentication is enabled", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-20081", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-10611", "datePublished": "2026-06-02T12:44:00.000Z", "dateUpdated": "2026-06-02T12:49:10.965149Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-20081" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-20066](https://vulnerability.circl.lu/vuln/gcve-1-2026-20066) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThanOrEqual": "2.5.38", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

A visibility control issue in the event template creation workflow allowed non-site-admin users to access private galaxies belonging to other organisations. The event template builder loaded all enabled galaxies without applying organisation or distribution-based access restrictions, potentially exposing private galaxy metadata such as galaxy type and description to users who should not have visibility.

The issue has been fixed by restricting galaxy queries for non-site-admin users to galaxies owned by the user’s organisation or galaxies with a non-private distribution setting. Site administrators retain visibility of all enabled galaxies.


" } ], "value": "A visibility control issue in the event template creation workflow allowed non-site-admin users to access private galaxies belonging to other organisations. The event template builder loaded all enabled galaxies without applying organisation or distribution-based access restrictions, potentially exposing private galaxy metadata such as galaxy type and description to users who should not have visibility.\n\nThe issue has been fixed by restricting galaxy queries for non-site-admin users to galaxies owned by the user’s organisation or galaxies with a non-private distribution setting. Site administrators retain visibility of all enabled galaxies." } ], "impacts": [ { "capecId": "CAPEC-1", "descriptions": [ { "lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.3, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "GREEN", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/U:Green", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/d3adfe1a097dd4b403364e9af34e208660eeec1a" } ], "source": { "discovery": "UNKNOWN" }, "title": "Unauthorized exposure of private galaxies in MISP event template creation", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-20066", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-10854", "datePublished": "2026-06-04T12:50:00.000Z", "dateUpdated": "2026-06-04T12:55:19.417449Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-20066" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-20047](https://vulnerability.circl.lu/vuln/gcve-1-2026-20047) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "repo": "https://github.com/misp/misp", "vendor": "misp", "versions": [ { "lessThanOrEqual": "2.5.38", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "finder", "value": "Jeroen Pinoy" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

An authorization flaw existed in the MISP Event Template Importer overwrite workflow. When importing an event template in overwrite mode, the application checked whether a matching template already existed but did not verify that the importing user belonged to the organization that owned the existing template. As a result, an authenticated user with access to the template import functionality could forcibly overwrite an event template owned by another organization.

Successful exploitation could allow unauthorized modification of another organization’s event template, potentially altering template structure, attributes, or metadata used for subsequent event creation or sharing workflows. Site administrators are not affected by this restriction, as they are explicitly allowed to overwrite templates across organizations.

The issue was fixed by enforcing an ownership check before overwrite: non-site-admin users may only overwrite templates owned by their own organization.


" } ], "value": "An authorization flaw existed in the MISP Event Template Importer overwrite workflow. When importing an event template in overwrite mode, the application checked whether a matching template already existed but did not verify that the importing user belonged to the organization that owned the existing template. As a result, an authenticated user with access to the template import functionality could forcibly overwrite an event template owned by another organization.\n\nSuccessful exploitation could allow unauthorized modification of another organization’s event template, potentially altering template structure, attributes, or metadata used for subsequent event creation or sharing workflows. Site administrators are not affected by this restriction, as they are explicitly allowed to overwrite templates across organizations.\n\nThe issue was fixed by enforcing an ownership check before overwrite: non-site-admin users may only overwrite templates owned by their own organization." } ], "impacts": [ { "capecId": "CAPEC-1", "descriptions": [ { "lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.1, "baseSeverity": "MEDIUM", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/7c2200d143bef86aaf58d701b6968a843097db69" } ], "source": { "discovery": "UNKNOWN" }, "title": "MISP Event template importer authorization bypass", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-20047", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-10855", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-20047", "datePublished": "2026-06-04T13:03:38.630862Z", "dateUpdated": "2026-06-04T13:05:56.422493Z" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-20101](https://vulnerability.circl.lu/vuln/gcve-1-2026-20101) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThanOrEqual": "2.5.38", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "finder", "value": "Jeroen Pinoy" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

A URL validation flaw in the MISP dashboard button widget allowed a crafted relative-looking URL to be accepted as a local path while being interpreted by browsers as an external URL. The validation rejected URLs containing an explicit scheme, host, or user component, but did not reject paths beginning with a slash followed by a backslash, such as /\\example.com. Some browsers normalize backslashes in URLs as forward slashes, which can turn this into a scheme-relative external navigation target. In addition, the generated href concatenated the reconstructed URL with the original URL, increasing the possibility of unsafe or malformed link generation.

\n

An attacker able to configure or influence a dashboard button URL could craft a button that appears to point inside the application but redirects users to an attacker-controlled site when clicked. This could be used for phishing, credential theft, or social engineering. The patch fixes the issue by rejecting empty paths and paths starting with /\\, and by emitting only the reconstructed validated URL in the anchor href.


" } ], "value": "A URL validation flaw in the MISP dashboard button widget allowed a crafted relative-looking URL to be accepted as a local path while being interpreted by browsers as an external URL. The validation rejected URLs containing an explicit scheme, host, or user component, but did not reject paths beginning with a slash followed by a backslash, such as /\\example.com. Some browsers normalize backslashes in URLs as forward slashes, which can turn this into a scheme-relative external navigation target. In addition, the generated href concatenated the reconstructed URL with the original URL, increasing the possibility of unsafe or malformed link generation.\n\n\nAn attacker able to configure or influence a dashboard button URL could craft a button that appears to point inside the application but redirects users to an attacker-controlled site when clicked. This could be used for phishing, credential theft, or social engineering. The patch fixes the issue by rejecting empty paths and paths starting with /\\, and by emitting only the reconstructed validated URL in the anchor href." } ], "impacts": [ { "capecId": "CAPEC-194", "descriptions": [ { "lang": "en", "value": "CAPEC-194 Fake the Source of Data" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.1, "baseSeverity": "MEDIUM", "privilegesRequired": "HIGH", "providerUrgency": "GREEN", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/U:Green", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-601", "description": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/f879f16fb5db7a9aab0a70fdcafea12ce4847e9a" } ], "source": { "discovery": "UNKNOWN" }, "title": "Open redirect in MISP dashboard button widget URL handling", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-20101", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-10856", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-20101", "datePublished": "2026-06-04T13:15:07.059298Z", "dateUpdated": "2026-06-04T13:17:44.483681Z" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-20083](https://vulnerability.circl.lu/vuln/gcve-1-2026-20083) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThanOrEqual": "2.5.38", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "finder", "value": "Jeroen Pinoy" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

An open redirect vulnerability existed in MISP UsersController::routeafterlogin() because the value stored in the pre_login_requested_url session key was used as the post-login redirect destination without sufficiently enforcing that it was a local application path.

\n

An unauthenticated remote attacker could craft a link that causes a victim to visit a trusted MISP instance and, after successful authentication, be redirected to an attacker-controlled external URL. This could be abused to increase the credibility of phishing attacks, redirect users to counterfeit login pages, or deliver attacker-controlled content from an untrusted domain. CWE-601 describes this weakness as accepting user-controlled input that specifies an external link and using it in a redirect, with phishing as a common consequence.

\n

The patch mitigates the issue by decoding and parsing the URL, rejecting URLs with a scheme, host, user component, missing or non-local path, and protocol-relative forms such as //example.com and /\\example.com.


" } ], "value": "An open redirect vulnerability existed in MISP UsersController::routeafterlogin() because the value stored in the pre_login_requested_url session key was used as the post-login redirect destination without sufficiently enforcing that it was a local application path.\n\n\nAn unauthenticated remote attacker could craft a link that causes a victim to visit a trusted MISP instance and, after successful authentication, be redirected to an attacker-controlled external URL. This could be abused to increase the credibility of phishing attacks, redirect users to counterfeit login pages, or deliver attacker-controlled content from an untrusted domain. CWE-601 describes this weakness as accepting user-controlled input that specifies an external link and using it in a redirect, with phishing as a common consequence. \n\n\nThe patch mitigates the issue by decoding and parsing the URL, rejecting URLs with a scheme, host, user component, missing or non-local path, and protocol-relative forms such as //example.com and /\\example.com." } ], "impacts": [ { "capecId": "CAPEC-194", "descriptions": [ { "lang": "en", "value": "CAPEC-194 Fake the Source of Data" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.1, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "GREEN", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/U:Green", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-601", "description": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/ae760b7bf534f2798810d59a1f961b31adb3443e" } ], "source": { "discovery": "UNKNOWN" }, "tags": [ "x_open-source" ], "title": "MISP post-login open redirect via pre_login_requested_url", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-20083", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-10861", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-20083", "datePublished": "2026-06-04T13:24:46.311258Z", "dateUpdated": "2026-06-04T13:26:10.929321Z" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-20080](https://vulnerability.circl.lu/vuln/gcve-1-2026-20080) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThanOrEqual": "2.5.38", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Jeroen Pinoy" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "finder", "value": "Fase Rais Baradika" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "A logic error in the MISP CRUD component delete handler allowed validation failures to be bypassed when requests used the HTTP DELETE method. Due to missing parentheses in the delete condition, the expression was evaluated as ($validationError === null && POST) || DELETE, meaning a DELETE request could proceed even when the delete validation callback had rejected the operation. An authenticated attacker with access to an affected delete endpoint could abuse this flaw to delete records that should have been protected by application-level validation or authorization checks." } ], "value": "A logic error in the MISP CRUD component delete handler allowed validation failures to be bypassed when requests used the HTTP DELETE method. Due to missing parentheses in the delete condition, the expression was evaluated as ($validationError === null && POST) || DELETE, meaning a DELETE request could proceed even when the delete validation callback had rejected the operation. An authenticated attacker with access to an affected delete endpoint could abuse this flaw to delete records that should have been protected by application-level validation or authorization checks." } ], "impacts": [ { "capecId": "CAPEC-122", "descriptions": [ { "lang": "en", "value": "CAPEC-122 Privilege Abuse" } ] }, { "capecId": "CAPEC-87", "descriptions": [ { "lang": "en", "value": "CAPEC-87 Forceful Browsing" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 7.9, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/a5877559dc88ad7a0c935910a652c130489ae2bd" } ], "source": { "discovery": "UNKNOWN" }, "title": "MISP CRUDComponent delete validation bypass via operator precedence error", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-20080", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-10860", "datePublished": "2026-06-04T13:33:00.000Z", "dateUpdated": "2026-06-11T13:25:46.835801Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-20080" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-20059](https://vulnerability.circl.lu/vuln/gcve-1-2026-20059) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThanOrEqual": "2.5.38", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Jeroen Pinoy" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters. This allowed an authenticated user to override the server-defined ordering of over-correlating values. Depending on how the value was processed by the underlying data access layer, this could allow manipulation of database query ordering and potentially expose the application to unsafe query construction.

The patch removes order from the set of request-controlled parameters and instead sets the ordering server-side to occurrence desc after processing allowed user parameters.

Affected component:
app/Controller/CorrelationsController.php, overCorrelations()

Security impact:
An authenticated attacker could influence the ordering clause used by the over-correlations query. The direct impact appears limited to query manipulation unless further evidence confirms SQL injection or unauthorized data exposure through the manipulated ordering expression.


" } ], "value": "A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters. This allowed an authenticated user to override the server-defined ordering of over-correlating values. Depending on how the value was processed by the underlying data access layer, this could allow manipulation of database query ordering and potentially expose the application to unsafe query construction.\n\nThe patch removes order from the set of request-controlled parameters and instead sets the ordering server-side to occurrence desc after processing allowed user parameters.\n\nAffected component:\napp/Controller/CorrelationsController.php, overCorrelations()\n\nSecurity impact:\nAn authenticated attacker could influence the ordering clause used by the over-correlations query. The direct impact appears limited to query manipulation unless further evidence confirms SQL injection or unauthorized data exposure through the manipulated ordering expression." } ], "impacts": [ { "capecId": "CAPEC-108", "descriptions": [ { "lang": "en", "value": "CAPEC-108 Command Line Execution through SQL Injection" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.4, "baseSeverity": "MEDIUM", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/aa094a335ba2855f8a42a1dc44398f43560fe247" } ], "source": { "discovery": "UNKNOWN" }, "title": "MISP User-controlled order parameter in correlations over-correlation endpoint", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-20059", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-10863", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-20059", "datePublished": "2026-06-04T13:43:15.325491Z", "dateUpdated": "2026-06-04T13:43:53.201590Z" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-20069](https://vulnerability.circl.lu/vuln/gcve-1-2026-20069) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThanOrEqual": "2.5.38", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "finder", "value": "Jeroen Pinoy" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

A vulnerability in the MISP dashboard widgets allowed an authenticated user to manipulate the fields option and influence which fields were returned by the New Users and New Organisations widgets. In some cases, requesting a field set that became empty after validation or redaction could cause the underlying query to fall back to returning unintended model fields.

For the New Users widget, this could allow a non-site-admin user to obtain user e-mail addresses even when user e-mail disclosure was disabled by configuration. For the New Organisations widget, crafted field selection could similarly result in unintended organisation fields being included in the dashboard response.

The issue was caused by applying field filtering and redaction in a way that could leave the selected field list empty. The patch ensures that the allowed field list is built safely, that restricted fields such as user e-mail addresses are removed before user-supplied field selection is processed, and that an empty field selection falls back only to the permitted default fields.

Impact:
An authenticated low-privileged user with access to the affected dashboard widgets may be able to disclose restricted user or organisation metadata, including user e-mail addresses depending on configuration.


" } ], "value": "A vulnerability in the MISP dashboard widgets allowed an authenticated user to manipulate the fields option and influence which fields were returned by the New Users and New Organisations widgets. In some cases, requesting a field set that became empty after validation or redaction could cause the underlying query to fall back to returning unintended model fields.\n\nFor the New Users widget, this could allow a non-site-admin user to obtain user e-mail addresses even when user e-mail disclosure was disabled by configuration. For the New Organisations widget, crafted field selection could similarly result in unintended organisation fields being included in the dashboard response.\n\nThe issue was caused by applying field filtering and redaction in a way that could leave the selected field list empty. The patch ensures that the allowed field list is built safely, that restricted fields such as user e-mail addresses are removed before user-supplied field selection is processed, and that an empty field selection falls back only to the permitted default fields.\n\nImpact:\nAn authenticated low-privileged user with access to the affected dashboard widgets may be able to disclose restricted user or organisation metadata, including user e-mail addresses depending on configuration." } ], "impacts": [ { "capecId": "CAPEC-137", "descriptions": [ { "lang": "en", "value": "CAPEC-137 Parameter Injection" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.3, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/8722fda035b5b622de387ae1dd0159d71ff1e22e" } ], "source": { "discovery": "UNKNOWN" }, "title": "MISP Dashboard widget field selection may expose restricted user and organisation data", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-20069", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-10864", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-20069", "datePublished": "2026-06-04T13:52:44.451016Z", "dateUpdated": "2026-06-04T13:53:15.203048Z" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-20092](https://vulnerability.circl.lu/vuln/gcve-1-2026-20092) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThanOrEqual": "2.5.38", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "finder", "value": "Jeroen Pinoy" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

A mass assignment vulnerability exists in the MISP user edit functionality due to insufficient filtering of user-supplied fields in UsersController::edit(). When processing edit requests, the application accepted a user-controlled User.id value from request data. An authenticated attacker could craft a modified request containing another user identifier, potentially causing updates to be applied to an unintended user account. Depending on the editable fields and the attacker’s privileges, this could allow unauthorized modification of user account attributes and impact account integrity.

The issue was addressed by explicitly removing the User.id field from request data before processing the user edit operation.

\nIf MISP.disableUserSelfManagement is enabled on the instance, non-admin users can not use the vulnerable endpoint.


" } ], "value": "A mass assignment vulnerability exists in the MISP user edit functionality due to insufficient filtering of user-supplied fields in UsersController::edit(). When processing edit requests, the application accepted a user-controlled User.id value from request data. An authenticated attacker could craft a modified request containing another user identifier, potentially causing updates to be applied to an unintended user account. Depending on the editable fields and the attacker’s privileges, this could allow unauthorized modification of user account attributes and impact account integrity.\n\nThe issue was addressed by explicitly removing the User.id field from request data before processing the user edit operation.\n\n\nIf MISP.disableUserSelfManagement is enabled on the instance, non-admin users can not use the vulnerable endpoint." } ], "impacts": [ { "capecId": "CAPEC-233", "descriptions": [ { "lang": "en", "value": "CAPEC-233 Privilege Escalation" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 9, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:H/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/MISP/MISP/commit/1be8c413b7104a889dfd30c5b1986e3ab17238e8" } ], "source": { "discovery": "UNKNOWN" }, "title": "MISP user edit endpoint mass assignment vulnerability allows unauthorized user account modification", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-20092", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-10868", "datePublished": "2026-06-04T14:37:00.000Z", "dateUpdated": "2026-06-12T06:57:43.643196Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-20092" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-20021](https://vulnerability.circl.lu/vuln/gcve-1-2026-20021) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "bsimvis", "repo": "https://github.com/MISP/bsimvis", "vendor": "misp", "versions": [ { "lessThanOrEqual": "v0.2.0", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "remediation developer", "value": "Thomas Caillet" }, { "lang": "en", "type": "finder", "value": "Alexandre Dulaunoy" }, { "lang": "en", "type": "finder", "value": "Codex GPT-5.5" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

A stored cross-site scripting vulnerability existed in MISP BSimVis tag rendering code. Several client-side rendering paths interpolated tag names, collection names, entity identifiers, cluster names, and tag metadata directly into HTML, HTML attributes, inline JavaScript event handlers, and CSS style values without context-appropriate escaping. The patch adds shared escaping helpers for HTML, attributes, JavaScript strings, and CSS color validation, then applies them across tag badges, tooltips, context menus, cluster cards, autocomplete suggestions, and dynamically inserted tag cards.

An attacker able to create or influence stored tag or metadata values could inject a crafted payload that is later rendered in another user’s browser. Successful exploitation could execute arbitrary JavaScript in the victim’s session when they view affected BSimVis pages, potentially allowing the attacker to perform actions as the victim, read data available to the victim, or alter displayed application content.

This issue affects MISP bsimvis: through v0.2.0.

" } ], "value": "A stored cross-site scripting vulnerability existed in MISP BSimVis tag rendering code. Several client-side rendering paths interpolated tag names, collection names, entity identifiers, cluster names, and tag metadata directly into HTML, HTML attributes, inline JavaScript event handlers, and CSS style values without context-appropriate escaping. The patch adds shared escaping helpers for HTML, attributes, JavaScript strings, and CSS color validation, then applies them across tag badges, tooltips, context menus, cluster cards, autocomplete suggestions, and dynamically inserted tag cards.\n\nAn attacker able to create or influence stored tag or metadata values could inject a crafted payload that is later rendered in another user’s browser. Successful exploitation could execute arbitrary JavaScript in the victim’s session when they view affected BSimVis pages, potentially allowing the attacker to perform actions as the victim, read data available to the victim, or alter displayed application content.\n\n\n\nThis issue affects MISP bsimvis: through v0.2.0." } ], "impacts": [ { "capecId": "CAPEC-18", "descriptions": [ { "lang": "en", "value": "CAPEC-18 XSS Targeting Non-Script Elements" } ] }, { "capecId": "CAPEC-243", "descriptions": [ { "lang": "en", "value": "CAPEC-243 XSS Targeting HTML Attributes" } ] }, { "capecId": "CAPEC-63", "descriptions": [ { "lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)" } ] }, { "capecId": "CAPEC-592", "descriptions": [ { "lang": "en", "value": "CAPEC-592 Stored XSS" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE" } ] }, { "descriptions": [ { "cweId": "CWE-116", "description": "CWE-116 Improper Encoding or Escaping of Output", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/MISP/bsimvis/commit/7bcd2c2e27647dccdfb71877e905fbb032124a63" } ], "source": { "discovery": "UNKNOWN" }, "title": "MISP BSimVis stored cross-site scripting in tag and cluster rendering paths via unescaped tag metadata and UI labels", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-20021", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-53693", "datePublished": "2026-06-10T14:32:00.000Z", "dateReserved": "2026-06-10T14:33:00.000Z", "dateUpdated": "2026-06-10T14:34:44.233807Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-20021" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-20015](https://vulnerability.circl.lu/vuln/gcve-1-2026-20015) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "platforms": [ "Windows", "Linux", "MacOS", "x86", "ARM", "64 bit", "32 bit" ], "product": "NoMachine", "vendor": "NoMachine", "versions": [ { "lessThan": "9.5.7", "status": "affected", "version": "7.0.0", "versionType": "semver" }, { "lessThan": "8.23.2", "status": "affected", "version": "7.0.0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Vonmetz Tobias" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Nomachine allows Argument Injection.

This issue affects Nomachine: before 9.5.7, before 8.23.2.



" } ], "value": "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Nomachine allows Argument Injection.This issue affects Nomachine: before 9.5.7, before 8.23.2." } ], "impacts": [ { "capecId": "CAPEC-6", "descriptions": [ { "lang": "en", "value": "CAPEC-6 Argument Injection" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "baseScore": 7.3, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-88", "description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "release-notes" ], "url": "https://kb.nomachine.com/SU05X00274" }, { "tags": [ "release-notes" ], "url": "https://kb.nomachine.com/SU05X00275" } ], "source": { "discovery": "UNKNOWN" }, "title": "Potential local privileges escalation through argument injection in the nxchmod.sh script", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-20015", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-53694", "datePublished": "2026-06-10T14:56:00.000Z", "dateReserved": "2026-06-10T14:57:00.000Z", "dateUpdated": "2026-07-07T15:04:35.841800Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-20015" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-20016](https://vulnerability.circl.lu/vuln/gcve-1-2026-20016) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "cerebrate", "vendor": "cerebrate", "versions": [ { "lessThan": "1.37", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Jeroen Pinoy" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

Cerebrate before version 1.37 contains a mass-assignment vulnerability in the generic CRUD add path. The add() handler attempted to remove an attacker-supplied id from $params before normalizing the request through __massageInput(). Because the normalized $input could still contain an id field, a user able to reach an affected add endpoint could supply an identifier that should have been server-controlled.

\n

Successful exploitation could allow creation of objects with attacker-chosen identifiers, potentially causing unauthorized data manipulation, object spoofing, inconsistent references, or disruption through identifier collisions, depending on the affected model and endpoint permissions. The issue was fixed in v1.37 by removing id from the normalized input before entity patching.


" } ], "value": "Cerebrate before version 1.37 contains a mass-assignment vulnerability in the generic CRUD add path. The add() handler attempted to remove an attacker-supplied id from $params before normalizing the request through __massageInput(). Because the normalized $input could still contain an id field, a user able to reach an affected add endpoint could supply an identifier that should have been server-controlled.\n\n\nSuccessful exploitation could allow creation of objects with attacker-chosen identifiers, potentially causing unauthorized data manipulation, object spoofing, inconsistent references, or disruption through identifier collisions, depending on the affected model and endpoint permissions. The issue was fixed in v1.37 by removing id from the normalized input before entity patching." } ], "impacts": [ { "capecId": "CAPEC-77", "descriptions": [ { "lang": "en", "value": "CAPEC-77 Manipulating User-Controlled Variables" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "AMBER", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/cerebrate-project/cerebrate/commit/aff1ca707c8f926d00cda3deb39ff9bf59cdf18e" } ], "source": { "discovery": "UNKNOWN" }, "title": "Cerebrate before v1.37 allows mass assignment of record identifiers during object creation", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-20016", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-53901", "datePublished": "2026-06-11T07:29:00.000Z", "dateReserved": "2026-06-11T07:30:00.000Z", "dateUpdated": "2026-06-11T07:31:26.096364Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-20016" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ```