https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 11:47:25 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-378977 EUVD-2026-378977 https://cve.radiocsirt.org/vuln/euvd-2026-378977 https://cve.radiocsirt.org/vuln/fkie_cve-2026-103321 <p>MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature.</p> <p>The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element&#39;s src attribute via string concatenation, allowing a crafted value to break out of the attribute context and inject arbitrary script.</p> <p>Preconditions:</p> <p>- An authenticated MISP user with the ability to create or modify an event graph entry.</p> <p>- A second user (the victim) who views the event graph and triggers the preview popover.</p> <p>Impact:</p> <p>- Execution of arbitrary JavaScript in the victim&#39;s browser within the MISP application context.</p> <p>- Potential theft of session tokens, cookies, or sensitive data accessible to the victim&#39;s browser.</p> <p>- Potential for performing actions on behalf of the victim within the MISP application.</p> <p>Affected: MISP versions prior to the fix (commit applied after v2.5.48).</p> <p>MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature.</p> <p>The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element&#39;s src attribute via string concatenation, allowing a crafted value to break out of the attribute context and inject arbitrary script.</p> <p>Preconditions:</p> <p>- An authenticated MISP user with the ability to create or modify an event graph entry.</p> <p>- A second user (the victim) who views the event graph and triggers the preview popover.</p> <p>Impact:</p> <p>- Execution of arbitrary JavaScript in the victim&#39;s browser within the MISP application context.</p> <p>- Potential theft of session tokens, cookies, or sensitive data accessible to the victim&#39;s browser.</p> <p>- Potential for performing actions on behalf of the victim within the MISP application.</p> <p>Affected: MISP versions prior to the fix (commit applied after v2.5.48).</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-103321 https://cve.radiocsirt.org/vuln/ghsa-w4mv-4x7w-vpvv <p>MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature.</p> <p>The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element&#39;s src attribute via string concatenation, allowing a crafted value to break out of the attribute context and inject arbitrary script.</p> <p>Preconditions:</p> <p>- An authenticated MISP user with the ability to create or modify an event graph entry.</p> <p>- A second user (the victim) who views the event graph and triggers the preview popover.</p> <p>Impact:</p> <p>- Execution of arbitrary JavaScript in the victim&#39;s browser within the MISP application context.</p> <p>- Potential theft of session tokens, cookies, or sensitive data accessible to the victim&#39;s browser.</p> <p>- Potential for performing actions on behalf of the victim within the MISP application.</p> <p>Affected: MISP versions prior to the fix (commit applied after v2.5.48).</p> <p>MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature.</p> <p>The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element&#39;s src attribute via string concatenation, allowing a crafted value to break out of the attribute context and inject arbitrary script.</p> <p>Preconditions:</p> <p>- An authenticated MISP user with the ability to create or modify an event graph entry.</p> <p>- A second user (the victim) who views the event graph and triggers the preview popover.</p> <p>Impact:</p> <p>- Execution of arbitrary JavaScript in the victim&#39;s browser within the MISP application context.</p> <p>- Potential theft of session tokens, cookies, or sensitive data accessible to the victim&#39;s browser.</p> <p>- Potential for performing actions on behalf of the victim within the MISP application.</p> <p>Affected: MISP versions prior to the fix (commit applied after v2.5.48).</p> https://cve.radiocsirt.org/vuln/ghsa-w4mv-4x7w-vpvv https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3689 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um seine Berechtigungen bis auf „Site-Administrator”-Ebene zu erweitern, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen sowie Cross-Site-Scripting-Angriffe durchzuführen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um seine Berechtigungen bis auf „Site-Administrator”-Ebene zu erweitern, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen sowie Cross-Site-Scripting-Angriffe durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3689