https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T14:23:00.266358+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-351170 EUVD-2026-351170 2026-10-05T14:23:00.312354+00:00 EUVD-2026-351170 https://cve.radiocsirt.org/vuln/fkie_cve-2026-73162 fkie_cve-2026-73162 2026-10-05T14:23:00.312391+00:00

Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests:

* /account/follow

* /account/delete_notification

* /account/mark_notification_read

* /account/mark_all_read

These endpoints require authentication, but before the fix they could be invoked with simple GET requests. That makes them susceptible to cross-site request forgery because a third-party site can induce the victim’s browser to send authenticated GET requests automatically.

The patch converts the actions to POST or DELETE and updates the frontend to include an X-CSRFToken header, providing explicit CSRF protection for those state-changing operations.

 https://cve.radiocsirt.org/vuln/ghsa-75j5-9v4m-c666 GHSA-75j5-9v4m-c666 2026-10-05T14:23:00.312436+00:00

Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests:

* /account/follow

* /account/delete_notification

* /account/mark_notification_read

* /account/mark_all_read

These endpoints require authentication, but before the fix they could be invoked with simple GET requests. That makes them susceptible to cross-site request forgery because a third-party site can induce the victim’s browser to send authenticated GET requests automatically.

The patch converts the actions to POST or DELETE and updates the frontend to include an X-CSRFToken header, providing explicit CSRF protection for those state-changing operations.