Claude Opus 5 (1M context)

MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII Discovery

MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs

MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data

MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects

MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding

MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Information

MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data

MISP Attribute Deletion Authorization Bypass Allows Users Without Modify Permissions to Delete Attributes

MISP Sharing Group Authorization Bypass via Omitted Distribution Parameter

MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request