CVE-2026-95659

LOWCVSS 4.8 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated into two translated strings and rendered into the HTML response without output encoding. An authenticated attacker who can induce a victim to navigate to a crafted URL can inject arbitrary JavaScript that executes in the victim's browser within the MISP application context. This may allow the attacker to read session data, manipulate the page, or perform actions on behalf of the victim. The vulnerability requires the victim to be authenticated to MISP and to actively visit the attacker-supplied URL. The affected component is the AnalystData controller and the Overmind theme's AnalystData thread element. Version affected: <2.5.47

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://github.com/MISP/MISP/commit/23b879073

Weakness type (CWE)

CWE-20CWE-79CWE-116

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

2 mentions across 1 observed day

What's happening

2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Referenced assets2 URLs

By indicator

Full discourse2 posts

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters2d
CVE-2026-95659 MISP reflected XSS (CVSS 6.1) in AnalystDataController. Patch under review - until then, validate input and be wary of crafted URLs. Details: https://www.valtersit.com/cve/CVE-2026-95659 #CVE #infosec #MISP #MISP #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
0000043
1.1K followersView on X
Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters2d
CVE-2026-95659 MISP reflected XSS (CVSS 6.1) in AnalystDataController. Patch under review - until then, validate input and be wary of crafted URLs. Details: https://www.valtersit.com/cve/CVE-2026-95659/ #CVE #infosec #MISP #MISP #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
0000037
1.1K followersView on X

Explore more

Back to dashboard