https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 22:28:54 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1170 certfr-2026-avi-1170 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1170 https://cve.radiocsirt.org/vuln/euvd-2026-363533 EUVD-2026-363533 https://cve.radiocsirt.org/vuln/euvd-2026-363533 https://cve.radiocsirt.org/vuln/fkie_cve-2026-85239 <p>A vulnerability in MISP&#39;s event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field.</p> <p>The EventTemplate::beforeValidate() method only performed semantic validation when the supplied definition was already represented as an array. If a caller instead supplied a pre-encoded string, including malformed JSON or JSON representing an unexpected data type, the value bypassed validateDefinition() and only needed to satisfy the generic notBlank validation rule. As a result, an invalid event template definition could be stored persistently in the database.</p> <p>When event templates were subsequently retrieved, EventTemplate::afterFind() attempted to decode the stored definition using JsonTool::decode() without handling decoding failures. A definition containing invalid JSON could therefore trigger an exception during retrieval. Because the event template index is available to all authenticated users, a single malicious or malformed template could make the event template listing and other functionality relying on EventTemplate queries return HTTP 500 errors until the offending database row was manually repaired.</p> <p>Valid JSON representing an unexpected type, rather than the expected JSON object, could similarly result in invalid data reaching downstream consumers.</p> <p>The vulnerability can therefore be exploited by a user capable of saving event templates to persist malformed template data and…</p> <p>A vulnerability in MISP&#39;s event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field.</p> <p>The EventTemplate::beforeValidate() method only performed semantic validation when the supplied definition was already represented as an array. If a caller instead supplied a pre-encoded string, including malformed JSON or JSON representing an unexpected data type, the value bypassed validateDefinition() and only needed to satisfy the generic notBlank validation rule. As a result, an invalid event template definition could be stored persistently in the database.</p> <p>When event templates were subsequently retrieved, EventTemplate::afterFind() attempted to decode the stored definition using JsonTool::decode() without handling decoding failures. A definition containing invalid JSON could therefore trigger an exception during retrieval. Because the event template index is available to all authenticated users, a single malicious or malformed template could make the event template listing and other functionality relying on EventTemplate queries return HTTP 500 errors until the offending database row was manually repaired.</p> <p>Valid JSON representing an unexpected type, rather than the expected JSON object, could similarly result in invalid data reaching downstream consumers.</p> <p>The vulnerability can therefore be exploited by a user capable of saving event templates to persist malformed template data and…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-85239 https://cve.radiocsirt.org/vuln/ghsa-f9j4-826c-53wf <p>A vulnerability in MISP&#39;s event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field.</p> <p>The EventTemplate::beforeValidate() method only performed semantic validation when the supplied definition was already represented as an array. If a caller instead supplied a pre-encoded string, including malformed JSON or JSON representing an unexpected data type, the value bypassed validateDefinition() and only needed to satisfy the generic notBlank validation rule. As a result, an invalid event template definition could be stored persistently in the database.</p> <p>When event templates were subsequently retrieved, EventTemplate::afterFind() attempted to decode the stored definition using JsonTool::decode() without handling decoding failures. A definition containing invalid JSON could therefore trigger an exception during retrieval. Because the event template index is available to all authenticated users, a single malicious or malformed template could make the event template listing and other functionality relying on EventTemplate queries return HTTP 500 errors until the offending database row was manually repaired.</p> <p>Valid JSON representing an unexpected type, rather than the expected JSON object, could similarly result in invalid data reaching downstream consumers.</p> <p>The vulnerability can therefore be exploited by a user capable of saving event templates to persist malformed template data and…</p> <p>A vulnerability in MISP&#39;s event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field.</p> <p>The EventTemplate::beforeValidate() method only performed semantic validation when the supplied definition was already represented as an array. If a caller instead supplied a pre-encoded string, including malformed JSON or JSON representing an unexpected data type, the value bypassed validateDefinition() and only needed to satisfy the generic notBlank validation rule. As a result, an invalid event template definition could be stored persistently in the database.</p> <p>When event templates were subsequently retrieved, EventTemplate::afterFind() attempted to decode the stored definition using JsonTool::decode() without handling decoding failures. A definition containing invalid JSON could therefore trigger an exception during retrieval. Because the event template index is available to all authenticated users, a single malicious or malformed template could make the event template listing and other functionality relying on EventTemplate queries return HTTP 500 errors until the offending database row was manually repaired.</p> <p>Valid JSON representing an unexpected type, rather than the expected JSON object, could similarly result in invalid data reaching downstream consumers.</p> <p>The vulnerability can therefore be exploited by a user capable of saving event templates to persist malformed template data and…</p> https://cve.radiocsirt.org/vuln/ghsa-f9j4-826c-53wf https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3173 <p>Ein Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um Sicherheitsmechanismen zu umgehen, Informationen offenzulegen, Daten oder Sitzungen zu manipulieren und die Verfügbarkeit zu beeinträchtigen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um Sicherheitsmechanismen zu umgehen, Informationen offenzulegen, Daten oder Sitzungen zu manipulieren und die Verfügbarkeit zu beeinträchtigen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3173