https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:27:20 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-373609 EUVD-2026-373609 https://cve.radiocsirt.org/vuln/euvd-2026-373609 https://cve.radiocsirt.org/vuln/fkie_cve-2026-95659 <p>MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated into two translated strings and rendered into the HTML response without output encoding. An authenticated attacker who can induce a victim to navigate to a crafted URL can inject arbitrary JavaScript that executes in the victim&#39;s browser within the MISP application context. This may allow the attacker to read session data, manipulate the page, or perform actions on behalf of the victim.</p> <p>The vulnerability requires the victim to be authenticated to MISP and to actively visit the attacker-supplied URL. The affected component is the AnalystData controller and the Overmind theme&#39;s AnalystData thread element.</p> <p>Version affected: &lt;2.5.47</p> <p>MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated into two translated strings and rendered into the HTML response without output encoding. An authenticated attacker who can induce a victim to navigate to a crafted URL can inject arbitrary JavaScript that executes in the victim&#39;s browser within the MISP application context. This may allow the attacker to read session data, manipulate the page, or perform actions on behalf of the victim.</p> <p>The vulnerability requires the victim to be authenticated to MISP and to actively visit the attacker-supplied URL. The affected component is the AnalystData controller and the Overmind theme&#39;s AnalystData thread element.</p> <p>Version affected: &lt;2.5.47</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-95659 https://cve.radiocsirt.org/vuln/ghsa-296v-9jwc-w27h <p>MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated into two translated strings and rendered into the HTML response without output encoding. An authenticated attacker who can induce a victim to navigate to a crafted URL can inject arbitrary JavaScript that executes in the victim&#39;s browser within the MISP application context. This may allow the attacker to read session data, manipulate the page, or perform actions on behalf of the victim.</p> <p>The vulnerability requires the victim to be authenticated to MISP and to actively visit the attacker-supplied URL. The affected component is the AnalystData controller and the Overmind theme&#39;s AnalystData thread element.</p> <p>Version affected: &lt;2.5.47</p> <p>MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated into two translated strings and rendered into the HTML response without output encoding. An authenticated attacker who can induce a victim to navigate to a crafted URL can inject arbitrary JavaScript that executes in the victim&#39;s browser within the MISP application context. This may allow the attacker to read session data, manipulate the page, or perform actions on behalf of the victim.</p> <p>The vulnerability requires the victim to be authenticated to MISP and to actively visit the attacker-supplied URL. The affected component is the AnalystData controller and the Overmind theme&#39;s AnalystData thread element.</p> <p>Version affected: &lt;2.5.47</p> https://cve.radiocsirt.org/vuln/ghsa-296v-9jwc-w27h https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3520 <p>Ein Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3520