Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-95698 | not reported | — | No | The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organization identifier with a... | 2026-09-22 |
| CVE-2026-95697 | not reported | — | No | MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unco... | 2026-09-22 |
| CVE-2026-95693 | not reported | — | No | In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmp_name field by invoking file_exists(), mime_content_type(),... | 2026-09-22 |
| CVE-2026-95685 | not reported | — | No | MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allows modification of s... | 2026-09-22 |
| CVE-2026-95683 | not reported | — | No | In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched t... | 2026-09-22 |
| CVE-2026-95682 | not reported | — | No | MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MISP.org organization name settin... | 2026-09-22 |
| CVE-2026-95679 | not reported | — | No | MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. The underlying Xml::build() library contains... | 2026-09-22 |
| CVE-2026-95674 | not reported | — | No | In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules t... | 2026-09-22 |
| CVE-2026-95671 | not reported | — | No | In MISP, the CollectionsController add() method enforced the sharing-group usability authorization check and element capture only when the H... | 2026-09-22 |
| CVE-2026-95667 | not reported | — | No | The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a log file at /var/log/misp_install.log and a named... | 2026-09-22 |
| CVE-2026-95665 | not reported | — | No | MISP contains a reflected cross-site scripting (XSS) vulnerability in the event REST search export confirmation form. The view template app/... | 2026-09-22 |
| CVE-2026-95661 | not reported | — | No | MISP contains a reflected cross-site scripting (XSS) vulnerability in the attribute histogram view. The $selectedTypes variable, which is de... | 2026-09-22 |
| CVE-2026-95659 | not reported | — | No | MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a... | 2026-09-22 |
| CVE-2026-95658 | not reported | — | No | MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedActions list. In CakePHP, listing... | 2026-09-22 |
| CVE-2026-94152 | medium | 4.3 | No | A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /u... | 2026-09-22 |
| CVE-2026-94146 | high | 8.8 | No | A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub_110BC of the file BSMEM64_W10.sys of t... | 2026-09-22 |
| CVE-2026-94139 | high | 7.4 | No | A weakness has been identified in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. Affected is an unknown function of... | 2026-09-22 |
| CVE-2026-94110 | high | 7.3 | No | A security vulnerability has been detected in QCMS up to 6.0.6. This issue affects the function self_Tmp in the library Lib/Config/Controlle... | 2026-09-22 |
| CVE-2026-94099 | critical | 9.9 | No | A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. This issue affects some unknown processing of the file restore.cg... | 2026-09-22 |
| CVE-2026-94094 | medium | 4.3 | No | A flaw has been found in OpenClaw up to 2026.9.5. Affected is the function createCanvasHostHandler of the file extensions/canvas/src/host/se... | 2026-09-22 |