MISP · weakness class
Cross-Site Request Forgery
13 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 13 is a mark on the map. Named now: 1 to 13, most at risk first.
- In MISP before 2.4.129, setting a favourite homepage was not CSRF protected.
- Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP
- Cross-Site Request Forgery in the Administrative User Deletion Endpoint
- MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution of workflow modules
- MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints
- MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request
- cti-transmute CSRF Allows Unauthorized Follow and Notification State Changes
- MISP CSRF vulnerability allows unauthorized attribute modification
- MISP: State-changing actions accessible via GET request enabling CSRF
- MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests
- MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent
- MISP automation endpoints may be exposed to CSRF when Sec-Fetch-Site protection is disabled by default
- misp-modules website - Missing CSRF protection in the website home blueprint
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.