Input Validation and Logic

Every one of the 13 is a mark on the map. Named now: 1 to 13, most at risk first.

1. app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters.CVE-2022-48328Misp-Project · 1.3% likely

   CWE-755

2. MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Asset…CVE-2022-48329Misp-Project · CVSS 9.8 · 0.9% likely

   CWE-755

3. MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP)CVE-2026-94379MISP · CVSS 6.9 · 0.6% likely

   CWE-20

4. STIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Injection in misp-stix libraryCVE-2026-77710MISP · CVSS 6.9 · 0.5% likely

   CWE-20

5. MISP Event Template Definition Validation Bypass Allows Persistent Denial of ServiceCVE-2026-85239misp · CVSS 7.1 · 0.4% likely

   CWE-20

6. MISP EventsController queryEnrichment allows querying unavailable or legacy modules without validationCVE-2026-95674MISP · CVSS 5.3 · 0.4% likely

   CWE-20

7. app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity, related to tmp_name.CVE-2025-66384MISP · CVSS 8.2 · 0.4% likely

   CWE-684

8. MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data ForwardingCVE-2026-116469MISP · CVSS 7.1 · 0.4% likely

   CWE-178

9. MISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rulesCVE-2026-116372MISP · CVSS 7.7 · 0.4% likely

   CWE-20

10. MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy Tags to Bypass Feed Policy EnforcementCVE-2026-118173MISP · CVSS 6.1 · 0.3% likely

    CWE-20

11. MISP Object Sync Drops Objects and Attributes When Description Is EmptyCVE-2026-107278MISP · CVSS 5.3 · 0.3% likely

    CWE-20

12. MISP User-controlled order parameter in correlations over-correlation endpointCVE-2026-10863misp · CVSS 6.4 · 0.2% likely

    CWE-20

13. MISP: Improper UUID validation in MISP CollectionsCVE-2026-44379MISP · CVSS 5.3 · 0.2% likely

    CWE-20

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.