Server-Side Request Forgery

Every one of the 11 is a mark on the map. Named now: 1 to 11, most at risk first.

1. MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL.CVE-2020-28043Misp-Project · 1.3% likely

   CWE-918

2. An issue was discovered in MISP before 2.4.156. app/Model/Server.php does not restrict generateServerSettings to the CLI. This could lead to SSRF.CVE-2022-27245Misp-Project · 0.9% likely

   CWE-918

3. MISP Unauthenticated Blind SSRF via XML Body ProcessingCVE-2026-95679MISP · CVSS 6.9 · 0.6% likely

   CWE-918

4. MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII DiscoveryCVE-2026-86419MISP · CVSS 7 · 0.4% likely

   CWE-918

5. cti-transmute Unauthenticated SSRF via Hostnames Resolving to Internal IP AddressesCVE-2026-73160MISP · CVSS 8.7 · 0.4% likely

   CWE-918

6. Server-Side Request Forgery and Local File Disclosure in CTI-Transmute Evaluation PDF RenderingCVE-2026-69078misp · CVSS 8.8 · 0.4% likely

   CWE-918

7. Server-Side Request Forgery protection bypass in misp-modules html_to_markdown via IPv4-mapped IPv6 addressesCVE-2026-62143misp · CVSS 8.3 · 0.4% likely

   CWE-918

8. MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is DisabledCVE-2026-92932misp · CVSS 5.1 · 0.4% likely

   CWE-918

9. MISP Arbitrary Local File Read and SSRF via MISP Export UploadCVE-2026-94401MISP · CVSS 8.3 · 0.4% likely

   CWE-918

10. MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()CVE-2026-112991MISP · CVSS 6.3 · 0.3% likely

    CWE-918

11. MISP sourcecache module SSRF allows fetching arbitrary internal URLs via attribute enrichmentCVE-2026-125871MISP · CVSS 6.3 · 0.3% likely

    CWE-918

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.