CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 28/03/2025 |
| CVE-2024-57969 | 中危4.3 | app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search. | 14/02/2025 |
| CVE-2024-46918 | 中危4.9 | app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in the same org. | 15/09/2024 |
| CVE-2024-45509 | 中危6.5 | In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org admin. | 01/09/2024 |
| CVE-2024-29859 | 严重9.8 | In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload. | 21/03/2024 |
| CVE-2024-29858 | 严重9.8 | In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload. | 21/03/2024 |
| CVE-2024-25675 | 严重9.8 | An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to app/Controller/JobsController.php and app/View/Events/export.ctp. | 09/02/2024 |
| CVE-2024-25674 | 严重9.8 | An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and MIME type. | 09/02/2024 |
| CVE-2023-50918 | 严重9.8 | app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs. | 15/12/2023 |
| CVE-2023-49926 | 中危6.1 | app/Lib/Tools/EventTimelineTool.php in MISP before 2.4.179 allows XSS in the event timeline widget. | 03/12/2023 |
| CVE-2023-48659 | 严重9.8 | An issue was discovered in MISP before 2.4.176. app/Controller/AppController.php mishandles parameter parsing. | 17/11/2023 |
| CVE-2023-48658 | 严重9.8 | An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php lacks a checkParam function for alphanumerics, underscore, dash, period, and space. | 17/11/2023 |
| CVE-2023-48657 | 严重9.8 | An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles filters. | 17/11/2023 |
| CVE-2023-48656 | 严重9.8 | An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles order clauses. | 17/11/2023 |
| CVE-2023-48655 | 严重9.8 | An issue was discovered in MISP before 2.4.176. app/Controller/Component/IndexFilterComponent.php does not properly filter out query parameters. | 17/11/2023 |
| CVE-2023-41098 | 中危6.1 | An issue was discovered in MISP 2.4.174. In app/Controller/DashboardsController.php, a reflected XSS issue exists via the id parameter upon a dashboard edit. | 23/08/2023 |
| CVE-2023-40224 | 中危6.1 | MISP 2.4.174 allows XSS in app/View/Events/index.ctp. | 10/08/2023 |