How many CVEs does MISP have?

MISP has 271 published CVE records since 2016, including 171 in the last two years.

How many MISP CVEs are in CISA KEV?

None of MISP's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which MISP products have the most CVEs?

The MISP products with the most published CVEs are misp, cti-transmute, misp-stix, misp-modules, sachertortephp.

What are the most common weakness types in MISP CVEs?

MISP's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-862 (Missing Authorization), CWE-863 (Incorrect Authorization), CWE-352 (Cross-Site Request Forgery (CSRF)).

Are there public exploits for MISP vulnerabilities?

Yes — 12 of MISP's CVEs have a known public exploit.

How many critical MISP vulnerabilities are there?

MISP has 37 critical and 71 high-severity CVEs.

What is the average severity of MISP CVEs?

The average CVSS base score across MISP's scored CVEs is 6.8.

RadicalNotion.AI

Log in Create an account

271 CVEs

MISP Vulnerabilities

Name: MISP vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for MISP.

271

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

12

Public exploits

PoC or exploit code

6.8

Avg CVSS

2016–2026

Overview

MISP has 271 published CVE records since 2016, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 12 have a known public exploit. The average CVSS base score across scored CVEs is 6.8.

Security scorecard

A quick read on MISP's vulnerability posture, as a share of its 271 published CVEs.

Average CVSS: 6.8
Critical / high: 40%
Actively exploited (KEV): 0%
Public exploit available: 4%
Patch available: 100%

Severity and exploitation

How the CVSS severity of MISP's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical37

High71

Medium160

Low3

In CISA’s Known Exploited Vulnerabilities catalog

0

None of MISP's CVEs are currently listed in CISA's KEV catalog.

Public exploits

12

12 of MISP's CVEs have a known public exploit available.

Most affected products

The MISP products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in MISP CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish MISP CVE records.

Disclosure activity by year

How many MISP CVEs were published each year.

2019

10

2020

19

2021

14

2022

13

2023

20

2024

8

2025

7

2026

164

Latest MISP CVEs

The most recently disclosed vulnerabilities affecting MISP.

MISP Object Sync Drops Objects and Attributes When Description Is Empty
CWE-20
Medium · CVSS 5.3
EPSS 0.3%2026-10-07
MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests
CWE-362
Medium · CVSS 6.3
EPSS 0.2%2026-10-07
MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances
CWE-287
High · CVSS 7.1
EPSS 0.3%2026-10-07
MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes
CWE-284
Medium · CVSS 5.3
EPSS 0.2%2026-10-07
MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change
CWE-284
Medium · CVSS 6.9
EPSS 0.6%2026-10-06
MISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSS
CWE-113
High · CVSS 8.4
EPSS 0.3%2026-10-06
MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View
CWE-862
Medium · CVSS 5.3
EPSS 0.2%2026-10-02
MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data
CWE-862
High · CVSS 7.1
EPSS 0.2%2026-10-02
MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization
CWE-862
Medium · CVSS 5.3
EPSS 0.3%2026-10-02
MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging
CWE-915
High · CVSS 7.1
EPSS 0.3%2026-10-02
MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler
CWE-79
Medium · CVSS 4.8
EPSS 0.4%2026-10-02
MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output
CWE-79
Medium · CVSS 6.2
EPSS 0.4%2026-10-02

Get an alert for each new MISP CVE, with AI-written analysis and remediation steps.

Monitor MISP CVEs

Other vendors

CVE counts for other vendors.

Node.js279 CVEs Vim274 CVEs phpMyAdmin272 CVEs SonicWall271 CVEs Spring269 CVEs libtiff268 CVEs Artifex267 CVEs ABB262 CVEs

Browse all vendors

Frequently asked questions

Common questions about MISP vulnerabilities.

How many CVEs does MISP have?: MISP has 271 published CVE records since 2016, including 171 in the last two years.
How many MISP CVEs are in CISA KEV?: None of MISP's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which MISP products have the most CVEs?: The MISP products with the most published CVEs are misp, cti-transmute, misp-stix, misp-modules, sachertortephp.
What are the most common weakness types in MISP CVEs?: MISP's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-862 (Missing Authorization), CWE-863 (Incorrect Authorization), CWE-352 (Cross-Site Request Forgery (CSRF)).
Are there public exploits for MISP vulnerabilities?: Yes — 12 of MISP's CVEs have a known public exploit.
How many critical MISP vulnerabilities are there?: MISP has 37 critical and 71 high-severity CVEs.
What is the average severity of MISP CVEs?: The average CVSS base score across MISP's scored CVEs is 6.8.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track MISP vulnerabilities

Get an alert for each new MISP CVE, with AI-written analysis and remediation steps.

Create an account See pricing