https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 10:12:04 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-379288 EUVD-2026-379288 https://cve.radiocsirt.org/vuln/euvd-2026-379288 https://cve.radiocsirt.org/vuln/fkie_cve-2026-103388 <p>MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP&#39;s FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a javascript: URL as the cluster source.</p> <p>When another user views the affected Galaxy Cluster and clicks the rendered link, the embedded script executes in the victim&#39;s browser context, enabling session hijacking, data exfiltration, or actions performed on behalf of the victim.</p> <p>Preconditions:</p> <p>- Attacker must hold galaxy editor privileges (local or via sync).</p> <p>- Victim must view the affected cluster and click the malicious link.</p> <p>Impact:</p> <p>- Stored cross-site scripting (XSS) in the victim&#39;s browser.</p> <p>- Potential session theft, credential harvesting, or unauthorized actions within the MISP application.</p> <p>Affected: &lt;2.5.48.</p> <p>MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP&#39;s FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a javascript: URL as the cluster source.</p> <p>When another user views the affected Galaxy Cluster and clicks the rendered link, the embedded script executes in the victim&#39;s browser context, enabling session hijacking, data exfiltration, or actions performed on behalf of the victim.</p> <p>Preconditions:</p> <p>- Attacker must hold galaxy editor privileges (local or via sync).</p> <p>- Victim must view the affected cluster and click the malicious link.</p> <p>Impact:</p> <p>- Stored cross-site scripting (XSS) in the victim&#39;s browser.</p> <p>- Potential session theft, credential harvesting, or unauthorized actions within the MISP application.</p> <p>Affected: &lt;2.5.48.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-103388 https://cve.radiocsirt.org/vuln/ghsa-ccjm-jpcq-p5hf <p>MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP&#39;s FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a javascript: URL as the cluster source.</p> <p>When another user views the affected Galaxy Cluster and clicks the rendered link, the embedded script executes in the victim&#39;s browser context, enabling session hijacking, data exfiltration, or actions performed on behalf of the victim.</p> <p>Preconditions:</p> <p>- Attacker must hold galaxy editor privileges (local or via sync).</p> <p>- Victim must view the affected cluster and click the malicious link.</p> <p>Impact:</p> <p>- Stored cross-site scripting (XSS) in the victim&#39;s browser.</p> <p>- Potential session theft, credential harvesting, or unauthorized actions within the MISP application.</p> <p>Affected: &lt;2.5.48.</p> <p>MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP&#39;s FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a javascript: URL as the cluster source.</p> <p>When another user views the affected Galaxy Cluster and clicks the rendered link, the embedded script executes in the victim&#39;s browser context, enabling session hijacking, data exfiltration, or actions performed on behalf of the victim.</p> <p>Preconditions:</p> <p>- Attacker must hold galaxy editor privileges (local or via sync).</p> <p>- Victim must view the affected cluster and click the malicious link.</p> <p>Impact:</p> <p>- Stored cross-site scripting (XSS) in the victim&#39;s browser.</p> <p>- Potential session theft, credential harvesting, or unauthorized actions within the MISP application.</p> <p>Affected: &lt;2.5.48.</p> https://cve.radiocsirt.org/vuln/ghsa-ccjm-jpcq-p5hf https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3689 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um seine Berechtigungen bis auf „Site-Administrator”-Ebene zu erweitern, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen sowie Cross-Site-Scripting-Angriffe durchzuführen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um seine Berechtigungen bis auf „Site-Administrator”-Ebene zu erweitern, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen sowie Cross-Site-Scripting-Angriffe durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3689