https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 23:36:33 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-367875 EUVD-2026-367875 https://cve.radiocsirt.org/vuln/euvd-2026-367875 https://cve.radiocsirt.org/vuln/fkie_cve-2026-90957 <p>Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox.</p> <p>The commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal &lt;img&gt;, they can execute when the SVG is navigated to directly or embedded as a document. In that case, malicious &lt;script&gt; elements, event handlers, or javascript: URLs execute on the MISP origin with the viewer’s session.</p> <p>The affected use cases include:</p> <p>- organisation SVG logos;  - event-report SVG pictures.</p> <p>Importantly, the vulnerable behavior is on the serve path, not merely the upload path: the patch notes that a malicious SVG uploaded while SVG support was enabled could remain dangerous even after uploads were later disabled.</p> <p>Version affected: ≤2.5.45</p> <p>Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox.</p> <p>The commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal &lt;img&gt;, they can execute when the SVG is navigated to directly or embedded as a document. In that case, malicious &lt;script&gt; elements, event handlers, or javascript: URLs execute on the MISP origin with the viewer’s session.</p> <p>The affected use cases include:</p> <p>- organisation SVG logos;  - event-report SVG pictures.</p> <p>Importantly, the vulnerable behavior is on the serve path, not merely the upload path: the patch notes that a malicious SVG uploaded while SVG support was enabled could remain dangerous even after uploads were later disabled.</p> <p>Version affected: ≤2.5.45</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-90957 https://cve.radiocsirt.org/vuln/ghsa-5mp5-7f8h-r69q <p>Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox.</p> <p>The commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal &lt;img&gt;, they can execute when the SVG is navigated to directly or embedded as a document. In that case, malicious &lt;script&gt; elements, event handlers, or javascript: URLs execute on the MISP origin with the viewer’s session.</p> <p>The affected use cases include:</p> <p>- organisation SVG logos;  - event-report SVG pictures.</p> <p>Importantly, the vulnerable behavior is on the serve path, not merely the upload path: the patch notes that a malicious SVG uploaded while SVG support was enabled could remain dangerous even after uploads were later disabled.</p> <p>Version affected: ≤2.5.45</p> <p>Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox.</p> <p>The commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal &lt;img&gt;, they can execute when the SVG is navigated to directly or embedded as a document. In that case, malicious &lt;script&gt; elements, event handlers, or javascript: URLs execute on the MISP origin with the viewer’s session.</p> <p>The affected use cases include:</p> <p>- organisation SVG logos;  - event-report SVG pictures.</p> <p>Importantly, the vulnerable behavior is on the serve path, not merely the upload path: the patch notes that a malicious SVG uploaded while SVG support was enabled could remain dangerous even after uploads were later disabled.</p> <p>Version affected: ≤2.5.45</p> https://cve.radiocsirt.org/vuln/ghsa-5mp5-7f8h-r69q https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3370 <p>Ein Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und offenzulegen, beliebigen Code auszuführen und Benutzer auf bösartige URLs umzuleiten.</p> <p>Ein Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und offenzulegen, beliebigen Code auszuführen und Benutzer auf bösartige URLs umzuleiten.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3370