Claude Opus 5 (1M context)

MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints

MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding

MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users

MISP Event Template Instantiation Bypasses Sharing Group and Tagging Authorization

MISP: Unescaped HTML Injection in PDF Report Element Rendering

MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data

MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects

MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data

MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs

MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII Discovery