Scottish Government - National Cyber Team

MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures

MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load

MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints

MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection

MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding

MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users

MISP Event Template Instantiation Bypasses Sharing Group and Tagging Authorization

MISP: Unescaped HTML Injection in PDF Report Element Rendering

MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests

MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data