- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 10
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
10 assets you may test, 4 excluded.
Web 1
- https://www.misp-project.org
Products and areas 9
- ApacheAuthenticate and the external authentication paths, including the LDAP integration
- Authentication and session handling end to end: local login, authentication keys and their reset flow, and the role and permission model behind both
- CIRCL takes vulnerability reports on the MISP platform on the project's behalf, and no narrower scope is written down anywhere: the platform itself is what the channel accepts
- File handling: attachments, malware samples, and the export formats that render stored content back out
- Sharing groups, distribution levels and instance-to-instance synchronisation, the machinery deciding which organisation sees which event
- The administration interface, covering user and organisation management, server settings and the diagnostics pages
- The event, attribute, object and shadow-attribute model in full, covering creation, editing, querying and deletion across the whole data layer
- The feed and taxonomy import paths and the other content-ingest routes, which take STIX, MISP-format and third-party intelligence authored by someone else
- The REST API in full, along with the automation keys that scripted consumers and MISP modules authenticate with
Out of scope (4)
- Instance misconfiguration, including sharing-group and distribution settings an administrator has set more permissively than they intended
- Intelligence content itself: a wrong or deliberately poisoned indicator in a feed is a data-quality matter rather than a platform defect
- MISP modules and third-party integrations, which live in their own repositories
- The security of the peer organisations a MISP instance synchronises with, as distinct from the synchronisation code
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
Reporting is handled by CIRCL, the Luxembourg Computer Incident Response Center, through the contact URL published in the misp-project.org security.txt
-
Encrypt to the GnuPG key published in the project's SECURITY.md, fingerprint CA57 2205 C002 4E06 BA70 BE89 EAAD CFFC 22BD 4CD5
-
Advisories are published on misp-project.org , so coordinate any writeup with that publication rather than with a GitHub advisory
-
State the MISP version and whether the instance was synchronising with other organisations, since the sharing and feed configuration changes what an access-control finding actually reaches
Not accepted
-
a wrong or deliberately poisoned indicator in a feed is a data-quality matter rather than a platform defect
-
Instance misconfiguration, including sharing-group and distribution settings an administrator has set more permissively than they intended
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-86452 | Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting. The users/forgot password-reset endpoint accepted an attacker-controlled email value without first imposing a reasonable length bound or validating its format. That value was then used to create an audit log entry and queue a password-reset | High 8.7 | 7 Sep 2026 |
| CVE-2026-86440 | Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget. The widget's URL is stored configuration controlled by a user. The previous renderer considered a URL safe if it appeared relative or if its parsed hostname matched the configured MISP hostname. That logic failed to reject dangerous schemes and URL forms that browsers normalize differe | Medium 5.1 | 7 Sep 2026 |
| CVE-2026-86441 | Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-related widgets did not honor Security.hide_organisation_index_from_users. As a result, authenticated users without the perm_sharing_group permission could enumerate organisations even though the normal organisation index was intentionally hidden | Low 2.3 | 7 Sep 2026 |
| CVE-2026-86451 | Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::get_reference_data() without first checking whether the requester is authorized to view the object the reference belongs to. The vulnerable code queried ObjectReference.uuid directly and returned the matching row whenever it existed. Because no parent-object ACL was applied, a u | Medium 5.3 | 7 Sep 2026 |
| CVE-2026-86418 | Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint returned fields including: - organisation ID; - UUID; - name. When Security.hide_organisation_index_from_users was enabled, normal organisation enumeration was re | Low 2.3 | 7 Sep 2026 |
| CVE-2026-86419 | Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality. In feed processing, redirects were followed without validating the redirect scheme or destination. The original request headers were reused across redirect hops, meaning authentication headers or API credentials configured for a feed could be forw | High 7.0 | 7 Sep 2026 |
| CVE-2026-86408 | Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view(). The vulnerable handler queried CryptographicKey directly using the supplied key ID and selected sensitive fields such as: * type * key_data * fingerprint but did not fetch or authorize the associated parent event first. The upstream commit explicitly states | High 7.1 | 7 Sep 2026 |
| CVE-2026-86417 | Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates(). The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal HTML interface could request the REST/JSON representation and receive template owners’ email addresse | Medium 5.3 | 7 Sep 2026 |
| CVE-2026-86351 | Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage value can be stored as a user setting and later used by the post-login routing logic. The commit expli | Medium 5.1 | 7 Sep 2026 |
| CVE-2026-86347 | Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile() because the ACL entry for templates/uploadFile used the wildcard *. This bypasses the intended role restrictions applied to neighboring template-management operations. The upload handler accepts arbitrary content with only minimal checks and writes it into app/tmp/files/. A low-privileged or read-onl | High 7.1 | 7 Sep 2026 |
| CVE-2026-86342 | Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview performed correlation lookups against attributes from events without applying the requesting user's ACL, allowing restricted event correlations and associated event information to be exposed to users who could not otherwise access those events. The vulnerable queries were scoped | Medium 5.3 | 7 Sep 2026 |
| CVE-2026-85236 | A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible operation while accepting HTTP GET requests. Because bodyless GET requests are not subject to CakePHP's CSRF validation, an attacker could cause an authenticated MISP user with sufficient privileges to invoke the endpoint simply by causing their | High 8.8 | 3 Sep 2026 |
| CVE-2026-85237 | A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts. The email_otp() endpoint did not apply brute-force protection when validating submitted OTP values. An attacker who had reached the OTP verification stage, for example after successfully providing a user's primary authentication crede | High 8.6 | 3 Sep 2026 |
| CVE-2026-85238 | MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier. As a result, if an attacker can cause a victim to use a session identifier known to the attacker before authent | High 7.6 | 3 Sep 2026 |
| CVE-2026-85239 | A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field. The EventTemplate::beforeValidate() method only performed semantic validation when the supplied definition was already represented as an array. If a caller instead supplied a pre-encoded string, including malforme | High 7.1 | 3 Sep 2026 |
| CVE-2026-85230 | A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered and were not validated when the configuration was saved. As a result, an authenticated user able to modify dashboard widget settings could persist arbitrary URL values, including URLs using the javascript: scheme, through ei | Medium 5.3 | 3 Sep 2026 |
| CVE-2026-85216 | MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. The custom LdapAuthenticate and LinOTPAuthenticate components replace CakePHP's FormAuthenticate implementation but did not replicate its credential validation checks. As a result, empty or non-string values could reach the underlying au | Critical 9.5 | 3 Sep 2026 |
| CVE-2026-85221 | MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and therefore defaulted to null. When passed to cURL, this value effectively disabled TLS peer verification unless the calling code explicitly enabled it. As a result, HTTPS connections made through affected CurlClient instances could accept certific | High 7.6 | 3 Sep 2026 |
| CVE-2026-85226 | MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distribution, sharing group, organization, or other access-control restrictions associated with the correlated attributes and events. As a result, an authenticated user could receive correlation results referring to attributes or event | Medium 5.3 | 3 Sep 2026 |
| CVE-2026-85227 | MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML escaping before being serialized as JSON and embedded inside a <script> element. Because JsonTool::encode() uses JSON_UNESCAPED_SLASHES, an attacker-controlled valu | Medium 6.1 | 3 Sep 2026 |
| CVE-2026-56423 | MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The affected deleteSelection handlers authorized deletion using broad role-level permissions instead of validating authorization for each selected object. For Event Reports, EventReportsController::deleteSelection relied on the global perm_add capability rather than a per-report owners | Critical 9.4 | 22 Jun 2026 |
| CVE-2026-56424 | MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong entity, or where ownership/editability checks were missing on write paths. In affected subsystems, a lower-privileged authenticated user with the relevant feature permission could cause the application to authorize one object but mutate another, or could modify objects that were mer | High 7.1 | 22 Jun 2026 |
| CVE-2026-56425 | The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its OAuth 2.0 authorization flow that could allow attackers to bypass important security guarantees provided by the protocol. The application used the PHP session identifier (session_id()) as the OAuth state parameter. Because session identifiers are long-lived authentication credentials, exposing them | Critical 9.3 | 22 Jun 2026 |
| CVE-2026-56446 | MISP allowed a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool. Because log entries can include attacker-controlled content, an authenticated attacker with site administrator privileges could direct log output to a PHP file in a web-accessible directory and inject PHP code through logged data. Accessing the resulting file could lead to remo | High 8.7 | 22 Jun 2026 |
| CVE-2026-56447 | MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config setting to an arbitrary filesystem path. MISP subsequently parsed the referenced INI file and passed its options to rdkafka. A crafted attacker-controlled configuration file could use rdkafka options such as plugin.library.paths to load an external library, resulting in arbitrary code execution with the privileges of | Critical 9.3 | 22 Jun 2026 |
| CVE-2026-10863 | A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters. This allowed an authenticated user to override the server-defined ordering of over-correlating values. Depending on how the value was processed by the underlying data access layer, this could allow manipulation of database query orderi | Medium 6.4 | 4 Jun 2026 |
| CVE-2026-10864 | A vulnerability in the MISP dashboard widgets allowed an authenticated user to manipulate the fields option and influence which fields were returned by the New Users and New Organisations widgets. In some cases, requesting a field set that became empty after validation or redaction could cause the underlying query to fall back to returning unintended model fields. For the New Users widget, this co | Medium 5.3 | 4 Jun 2026 |
| CVE-2026-10860 | A logic error in the MISP CRUD component delete handler allowed validation failures to be bypassed when requests used the HTTP DELETE method. Due to missing parentheses in the delete condition, the expression was evaluated as ($validationError === null && POST) || DELETE, meaning a DELETE request could proceed even when the delete validation callback had rejected the operation. An authenticated at | High 7.9 | 4 Jun 2026 |
| CVE-2026-10854 | A visibility control issue in the event template creation workflow allowed non-site-admin users to access private galaxies belonging to other organisations. The event template builder loaded all enabled galaxies without applying organisation or distribution-based access restrictions, potentially exposing private galaxy metadata such as galaxy type and description to users who should not have visib | Medium 5.3 | 4 Jun 2026 |
| CVE-2026-10855 | An authorization flaw existed in the MISP Event Template Importer overwrite workflow. When importing an event template in overwrite mode, the application checked whether a matching template already existed but did not verify that the importing user belonged to the organization that owned the existing template. As a result, an authenticated user with access to the template import functionality coul | Medium 5.1 | 4 Jun 2026 |
| CVE-2026-10856 | A URL validation flaw in the MISP dashboard button widget allowed a crafted relative-looking URL to be accepted as a local path while being interpreted by browsers as an external URL. The validation rejected URLs containing an explicit scheme, host, or user component, but did not reject paths beginning with a slash followed by a backslash, such as /\example.com. Some browsers normalize backslashes | Medium 5.1 | 4 Jun 2026 |
| CVE-2026-10861 | An open redirect vulnerability existed in MISP UsersController::routeafterlogin() because the value stored in the pre_login_requested_url session key was used as the post-login redirect destination without sufficiently enforcing that it was a local application path. An unauthenticated remote attacker could craft a link that causes a victim to visit a trusted MISP instance and, after successful aut | Medium 5.1 | 4 Jun 2026 |
| CVE-2026-10611 | An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement. In deployments configured with LdapAuth.mixedAuth=true and Security.require_otp=true, users authenticated through an authentication plugin, such as LDAP, may have their authenticated session established during the application beforeFilter phase before the normal login flow enforces | High 8.2 | 2 Jun 2026 |
| CVE-2026-9136 | A vulnerability was identified in the ShadowAttribute proposal creation workflow. The add action accepted user-controlled ShadowAttribute request data without removing the id field before saving the record. Because the underlying framework treats a supplied primary key as an instruction to update an existing record, an authenticated user able to submit shadow attribute proposals could provide the | High 8.3 | 20 May 2026 |
| CVE-2026-9137 | The CSP report endpoint in MISP intended to limit logged CSP reports to 1 KB but incorrectly allowed reports up to 1 MB before truncation. On deployments where the endpoint is reachable by untrusted clients, this could allow attackers to generate excessive log volume and contribute to resource exhaustion or log flooding. | Medium 5.1 | 20 May 2026 |
| CVE-2026-44380 | MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, an improper access control vulnerability in the authentication key reset functionality allowed an authenticated organization administrator to reset authentication keys belonging to site administrator accounts within the same organization. Because non-site administrators were not explicitly prevented from accessing or | High 8.6 | 13 May 2026 |
| CVE-2026-44381 | MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, a SQL injection vulnerability existed in the handling of user-controlled ordering parameters in the event and shadow attribute listing endpoints. The affected code accepted order or sort values from request parameters and incorporated them into database query ordering clauses without sufficient validation of the requ | Critical 9.3 | 13 May 2026 |
| CVE-2026-44379 | MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, MISP Collections did not enforce RFC 4122 UUID validation on the uuid field. As a result, a user able to create or modify Collection records could submit malformed UUID values, potentially causing integrity issues or unexpected behaviour in code paths that assume Collection UUIDs are valid identifiers. This vulnerabi | Medium 5.3 | 13 May 2026 |
| CVE-2026-8080 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in misp allows Stored XSS. This issue affects MISP before 2.5.37. A stored cross-site scripting vulnerability exists in the template element attribute handling logic. The application accepted arbitrary values for the TemplateElementAttribute type and category fields without validating them aga | Medium 6.8 | 7 May 2026 |
| CVE-2026-39962 | MISP is an open source threat intelligence and sharing platform. Prior to 2.5.36, improper neutralization of special elements in an LDAP query in ApacheAuthenticate.php allows LDAP injection via an unsanitized username value when ApacheAuthenticate.apacheEnv is configured to use a user-controlled server variable instead of REMOTE_USER (such as in certain proxy setups). An attacker able to control | High 8.8 | 9 Apr 2026 |
| CVE-2025-67906 | In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path. | Medium 5.4 | 15 Dec 2025 |
| CVE-2024-58128 | In MISP before 2.4.193, menu_custom_right_link parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can conduct XSS attacks via a global menu link. | Medium 5.5 | 28 Mar 2025 |
| CVE-2024-58129 | In MISP before 2.4.193, menu_custom_right_link_html parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can conduct XSS attacks against every page. | Medium 5.5 | 28 Mar 2025 |
| CVE-2024-58130 | In app/Controller/Component/RestResponseComponent.php in MISP before 2.4.193, REST endpoints have a lack of sanitization for non-JSON responses. | High 7.2 | 28 Mar 2025 |
| CVE-2024-57969 | app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search. | Medium 4.3 | 14 Feb 2025 |
| CVE-2024-46918 | app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in the same org. | Medium 4.9 | 15 Sep 2024 |
| CVE-2024-45509 | In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org admin. | Medium 6.5 | 1 Sep 2024 |
| CVE-2024-29858 | In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload. | Critical 9.8 | 21 Mar 2024 |
| CVE-2024-29859 | In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload. | Critical 9.8 | 21 Mar 2024 |
| CVE-2024-25674 | An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and MIME type. | Critical 9.8 | 9 Feb 2024 |
| CVE-2024-25675 | An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to app/Controller/JobsController.php and app/View/Events/export.ctp. | Critical 9.8 | 9 Feb 2024 |
| CVE-2023-50918 | app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs. | Critical 9.8 | 15 Dec 2023 |
| CVE-2023-49926 | app/Lib/Tools/EventTimelineTool.php in MISP before 2.4.179 allows XSS in the event timeline widget. | Medium 6.1 | 3 Dec 2023 |
| CVE-2023-48655 | An issue was discovered in MISP before 2.4.176. app/Controller/Component/IndexFilterComponent.php does not properly filter out query parameters. | Critical 9.8 | 17 Nov 2023 |
| CVE-2023-48656 | An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles order clauses. | Critical 9.8 | 17 Nov 2023 |
| CVE-2023-48657 | An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles filters. | Critical 9.8 | 17 Nov 2023 |
| CVE-2023-48658 | An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php lacks a checkParam function for alphanumerics, underscore, dash, period, and space. | Critical 9.8 | 17 Nov 2023 |
| CVE-2023-48659 | An issue was discovered in MISP before 2.4.176. app/Controller/AppController.php mishandles parameter parsing. | Critical 9.8 | 17 Nov 2023 |
| CVE-2023-41098 | An issue was discovered in MISP 2.4.174. In app/Controller/DashboardsController.php, a reflected XSS issue exists via the id parameter upon a dashboard edit. | Medium 6.1 | 23 Aug 2023 |
| CVE-2023-40224 | MISP 2.4.174 allows XSS in app/View/Events/index.ctp. | Medium 6.1 | 10 Aug 2023 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 4 Last 12 months Injection 50 % Access control 30 % Auth bypass 15 % Latest advisories Loading the feed Overview MISP is the threat-intelligence sharing platform running at national CSIRTs, sectoral ISACs, CERTs and critical-infrastructure operators, and what sits inside an instance is the live record of who is attacking whom and which incidents are still open. It is federated by design, synchronising events with other organisations' instances under a sharing-group policy, so an access-control defect dissolves the boundary between all of them at once. CVE-2026-44381 is the reference point: a CRITICAL SQL injection through unvalidated ordering parameters, reaching the whole intelligence database in one step. CIRCL handles disclosure and there is no money attached to any of it, so sorona.xyz pays you directly on qualified, reproduced findings. In scope CIRCL takes vulnerability reports on the MISP platform on the project's behalf, and no narrower scope is written down anywhere: the platform itself is what the channel accepts The event, attribute, object and shadow-attribute model in full, covering creation, editing, querying and deletion across the whole data layer Authentication and session handling end to end: local login, authentication keys and their reset flow, and the role and permission model behind both ApacheAuthenticate and the external authentication paths, including the LDAP integration Sharing groups, distribution levels and instance-to-instance synchronisation, the machinery deciding which organisation sees which event The feed and taxonomy import paths and the other content-ingest routes, which take STIX, MISP-format and third-party intelligence authored by someone else The REST API in full, along with the automation keys that scripted consumers and MISP modules authenticate with File handling: attachments, malware samples, and the export formats that render stored content back out The administration interface, covering user and organisation management, server settings and the diagnostics pages Out of scope MISP modules and third-party integrations, which live in their own repositories Intelligence content itself: a wrong or deliberately poisoned indicator in a feed is a data-quality matter rather than a platform defect Instance misconfiguration, including sharing-group and distribution settings an administrator has set more permissively than they intended The security of the peer organisations a MISP instance synchronises with, as distinct from the synchronisation code Most-valued findings SQL injection anywhere in query construction, already the single densest class in this project's record: CVE-2026-44381 reached the entire intelligence database through unvalidated ordering parameters in the event and shadow-attribute queries Access-control defects across the sharing boundary, meaning anything that lets one organisation read events, attributes or shadow attributes another restricted, because federation is the product and that boundary is the whole of it Privilege escalation to admin or site-admin, the outcome CVE-2026-44380 reached through the auth-key reset flow Injection through external authentication, particularly the LDAP path that carried CVE-2026-39962, which sits in front of every user on the instances that use it Anything reachable through the sync or feed ingest path, since a MISP instance accepts data from peer organisations by design and one compromised peer should not become a foothold in every instance it shares with Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Reporting is handled by CIRCL, the Luxembourg Computer Incident Response Center, through the contact URL published in the misp-project.org security.txt Encrypt to the GnuPG key published in the project's SECURITY.md, fingerprint CA57 2205 C002 4E06 BA70 BE89 EAAD CFFC 22BD 4CD5 Expect a short turnaround: the project states it usually fixes confirmed vulnerabilities in less than 48 hours, so plan your disclosure window around that rather than a 90-day default Advisories are published on misp-project.org , so coordinate any writeup with that publication rather than with a GitHub advisory State the MISP version and whether the instance was synchronising with other organisations, since the sharing and feed configuration changes what an access-control finding actually reaches Disclosure Coordinated through CIRCL, the Luxembourg national CERT, which handles vulnerability reports on the project's behalf and publishes advisories on misp-project.org . The project's own commitment is unusually fast, with confirmed vulnerabilities usually fixed inside 48 hours, so the practical embargo is measured in days. Both the credit and the advisory come out of CIRCL's process rather than a repository pipeline. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability