Most recent entries from all

EUVD-2026-368470

2026-10-02T18:58:03.483970+00:00

EUVD-2026-368470

fkie_cve-2026-92003

2026-10-02T18:58:03.484000+00:00

Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle.

Two API authentication failure branches wrote directly to the Log model:

- API requests with no authentication key; - requests supplying an API key with an incorrect length

Unlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry.

Version affected: ≤2.5.45

GHSA-rr6q-fmv4-p23m

2026-10-02T18:58:03.484038+00:00

Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle.

Two API authentication failure branches wrote directly to the Log model:

- API requests with no authentication key; - requests supplying an API key with an incorrect length

Unlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry.

Version affected: ≤2.5.45

WID-SEC-W-2026-3411 — MISP: Mehrere Schwachstellen

2026-10-02T18:58:03.484061+00:00

Ein Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um Dateien zu manipulieren, Sicherheitsmaßnahmen zu umgehen oder einen Denial-of-Service-Zustand auszulösen.