Security releases
Researcher credits in vendor advisories
Vendors name researchers in their own advisories. Find your line and claim it. It counts on your profile right away and gets a BugRater ID you can quote.
Vendor
-
MISP CVE-2026-118173
MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags. When a feed event or
0 CVEs and 0 credit lines.
-
MISP CVE-2026-116469
MISP Guard, a proxy-based security filter for MISP (Malware Information Sharing Platform) feed distribution, contains a case-sensitivity flaw in multiple policy
0 CVEs and 0 credit lines.
-
MISP CVE-2026-116372
MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules. The process_feed_response method in src/mis
0 CVEs and 0 credit lines.
-
MISP CVE-2026-112991
The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function.
0 CVEs and 0 credit lines.
-
MISP CVE-2026-112192
MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the red
0 CVEs and 0 credit lines.
-
MISP CVE-2026-112188
MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should hav
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
MISP CVE-2026-112184
MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are re
3 CVEs and 3 credit lines. None claimed yet.
0 of 3 credit lines claimed Claim credit -
MISP CVE-2026-112183
MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value assoc
0 CVEs and 0 credit lines.
-
MISP CVE-2026-112180
MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, lea
0 CVEs and 0 credit lines.
-
MISP CVE-2026-112179
In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
MISP CVE-2026-112178
MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit
-
MISP misp-2026-10
MISP Security Releases - October 2026
4 CVEs and 4 credit lines. None claimed yet.
0 of 4 credit lines claimed Claim credit