https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 05:16:08 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-367385 EUVD-2026-367385 https://cve.radiocsirt.org/vuln/euvd-2026-367385 https://cve.radiocsirt.org/vuln/fkie_cve-2026-90895 <p>Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies.</p> <p>The patch shows that CLI access could differ from the web application in multiple security-sensitive areas:</p> <p>- feed listings did not enforce the same lookup_visible restrictions for non-host-organisation users;  - feed detail access did not enforce the same host-organisation/site-admin authorization as FeedsController::view();  - Feed.headers, which can contain HTTP authorization credentials, could be exposed instead of being hidden or masked;  - server synchronization authkey values were not explicitly hidden from CLI detail output;  - sharing-group detail access did not consistently use SharingGroup::checkIfAuthorised();  - the use command could establish context for a record without first proving that the user was authorized to view that record</p> <p>The commit additionally hardens pagination and terminal rendering, including neutralization of terminal control sequences found in database-backed values. Those are important hardening changes, but the main vulnerability is the CLI authorization/data-disclosure mismatch.</p> <p>Version affected: ≤2.5.45</p> <p>Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies.</p> <p>The patch shows that CLI access could differ from the web application in multiple security-sensitive areas:</p> <p>- feed listings did not enforce the same lookup_visible restrictions for non-host-organisation users;  - feed detail access did not enforce the same host-organisation/site-admin authorization as FeedsController::view();  - Feed.headers, which can contain HTTP authorization credentials, could be exposed instead of being hidden or masked;  - server synchronization authkey values were not explicitly hidden from CLI detail output;  - sharing-group detail access did not consistently use SharingGroup::checkIfAuthorised();  - the use command could establish context for a record without first proving that the user was authorized to view that record</p> <p>The commit additionally hardens pagination and terminal rendering, including neutralization of terminal control sequences found in database-backed values. Those are important hardening changes, but the main vulnerability is the CLI authorization/data-disclosure mismatch.</p> <p>Version affected: ≤2.5.45</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-90895 https://cve.radiocsirt.org/vuln/ghsa-rx79-g748-j44m <p>Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies.</p> <p>The patch shows that CLI access could differ from the web application in multiple security-sensitive areas:</p> <p>- feed listings did not enforce the same lookup_visible restrictions for non-host-organisation users;  - feed detail access did not enforce the same host-organisation/site-admin authorization as FeedsController::view();  - Feed.headers, which can contain HTTP authorization credentials, could be exposed instead of being hidden or masked;  - server synchronization authkey values were not explicitly hidden from CLI detail output;  - sharing-group detail access did not consistently use SharingGroup::checkIfAuthorised();  - the use command could establish context for a record without first proving that the user was authorized to view that record</p> <p>The commit additionally hardens pagination and terminal rendering, including neutralization of terminal control sequences found in database-backed values. Those are important hardening changes, but the main vulnerability is the CLI authorization/data-disclosure mismatch.</p> <p>Version affected: ≤2.5.45</p> <p>Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies.</p> <p>The patch shows that CLI access could differ from the web application in multiple security-sensitive areas:</p> <p>- feed listings did not enforce the same lookup_visible restrictions for non-host-organisation users;  - feed detail access did not enforce the same host-organisation/site-admin authorization as FeedsController::view();  - Feed.headers, which can contain HTTP authorization credentials, could be exposed instead of being hidden or masked;  - server synchronization authkey values were not explicitly hidden from CLI detail output;  - sharing-group detail access did not consistently use SharingGroup::checkIfAuthorised();  - the use command could establish context for a record without first proving that the user was authorized to view that record</p> <p>The commit additionally hardens pagination and terminal rendering, including neutralization of terminal control sequences found in database-backed values. Those are important hardening changes, but the main vulnerability is the CLI authorization/data-disclosure mismatch.</p> <p>Version affected: ≤2.5.45</p> https://cve.radiocsirt.org/vuln/ghsa-rx79-g748-j44m https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3370 <p>Ein Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und offenzulegen, beliebigen Code auszuführen und Benutzer auf bösartige URLs umzuleiten.</p> <p>Ein Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und offenzulegen, beliebigen Code auszuführen und Benutzer auf bösartige URLs umzuleiten.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3370