Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

MISP bug bounty programs

misp-project.org Updated

MISP runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
10
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program MISP runs.

  • MISP

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

10 targets. 4 excluded.

  • https://www.misp-project.org

    Web

  • ApacheAuthenticate and the external authentication paths, including the LDAP integration

    Products and areas

  • Authentication and session handling end to end: local login, authentication keys and their reset flow, and the role and permission model behind both

    Products and areas

  • CIRCL takes vulnerability reports on the MISP platform on the project's behalf, and no narrower scope is written down anywhere: the platform itself is what the channel accepts

    Products and areas

  • File handling: attachments, malware samples, and the export formats that render stored content back out

    Products and areas

  • Sharing groups, distribution levels and instance-to-instance synchronisation, the machinery deciding which organisation sees which event

    Products and areas

  • The administration interface, covering user and organisation management, server settings and the diagnostics pages

    Products and areas

  • The event, attribute, object and shadow-attribute model in full, covering creation, editing, querying and deletion across the whole data layer

    Products and areas

  • The feed and taxonomy import paths and the other content-ingest routes, which take STIX, MISP-format and third-party intelligence authored by someone else

    Products and areas

  • The REST API in full, along with the automation keys that scripted consumers and MISP modules authenticate with

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 4

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Instance misconfiguration, including sharing-group and distribution settings an administrator has set more permissively than they intended

  • Intelligence content itself: a wrong or deliberately poisoned indicator in a feed is a data-quality matter rather than a platform defect

  • MISP modules and third-party integrations, which live in their own repositories

  • The security of the peer organisations a MISP instance synchronises with, as distinct from the synchronisation code

Recent changes

Reward and scope changes across every MISP program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in MISP products, from the NVD.

Search NVD
  • CVE-2026-86452 High

    Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting. The users/forgot password-reset endpoint accepted an attacker-controlled email value without first imposing a reasonable length bound or validating its format. That value was then used to create an audit log entry and queue a password-reset

  • CVE-2026-86440 Medium

    Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget. The widget's URL is stored configuration controlled by a user. The previous renderer considered a URL safe if it appeared relative or if its parsed hostname matched the configured MISP hostname. That logic failed to reject dangerous schemes and URL forms that browsers normalize differe

  • CVE-2026-86441 Low

    Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-related widgets did not honor Security.hide_organisation_index_from_users. As a result, authenticated users without the perm_sharing_group permission could enumerate organisations even though the normal organisation index was intentionally hidden

  • CVE-2026-86451 Medium

    Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::get_reference_data() without first checking whether the requester is authorized to view the object the reference belongs to. The vulnerable code queried ObjectReference.uuid directly and returned the matching row whenever it existed. Because no parent-object ACL was applied, a u

  • CVE-2026-86418 Low

    Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint returned fields including: - organisation ID; - UUID; - name. When Security.hide_organisation_index_from_users was enabled, normal organisation enumeration was re

  • CVE-2026-86419 High

    Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality. In feed processing, redirects were followed without validating the redirect scheme or destination. The original request headers were reused across redirect hops, meaning authentication headers or API credentials configured for a feed could be forw

  • CVE-2026-86408 High

    Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view(). The vulnerable handler queried CryptographicKey directly using the supplied key ID and selected sensitive fields such as: * type * key_data * fingerprint but did not fetch or authorize the associated parent event first. The upstream commit explicitly states

  • CVE-2026-86417 Medium

    Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates(). The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal HTML interface could request the REST/JSON representation and receive template owners’ email addresse

About this page

This page gathers every public program listed under misp-project.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.