CVE-2026-95659 (GCVE-0-2026-95659)

Vulnerability from cvelistv5 – Published: 2026-09-22 12:40 – Updated: 2026-09-22 15:34
VLAI
Title
MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread
Summary
MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated into two translated strings and rendered into the HTML response without output encoding. An authenticated attacker who can induce a victim to navigate to a crafted URL can inject arbitrary JavaScript that executes in the victim's browser within the MISP application context. This may allow the attacker to read session data, manipulate the page, or perform actions on behalf of the victim.  The vulnerability requires the victim to be authenticated to MISP and to actively visit the attacker-supplied URL. The affected component is the AnalystData controller and the Overmind theme's AnalystData thread element. Version affected: <2.5.47
Severity
4.8 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:34 UTC
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • CWE-116 - Improper Encoding or Escaping of Output
  • CWE-20 - Improper Input Validation
Assigner
References
Impacted products
Vendor Product Version CPE status
MISP MISP Affected: 0 , < 2.5.47 (semver)
guessed Create a notification for this product.
Credits
Jeroen Pinoy iglocska Claude Fable 5.1
GCVE extensions
AI involvement GCVE-BCP-05-X-01
Whole record AI-generated Human-reviewed GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification
Model Source Identifier
qwen3.8:27b ollama qwen3.8:27b
Patch provenance GCVE-BCP-05-X-02
Generator
patch2vuln.py on 2026-09-22 12:33
Model
qwen3.8:27b
Input
https://github.com/MISP/MISP/commit/23b879073.patch 4476bdd487c3…
Confidence
high
Commit Subject Patch SHA-256
23b879073eef fix: [security] Reflected XSS via the object type in the 4476bdd487c3…
Fix summary

The fix introduces two layers of defense. First, the viewForObject action now validates the object_type parameter against the AnalystData::valid_targets whitelist and rejects any value not in that list with a NotFoundException, preventing arbitrary strings from reaching the view layer. Second, the two output sinks in the Overmind thread.ctp template now apply the h() HTML-encoding function to the object type before interpolation into translated strings, ensuring that even if a valid type were to contain special characters, it would be rendered as inert text rather than executable markup.

Patch summary

In AnalystDataController.php, the patch adds an import of the AnalystData model and inserts a guard clause at the top of viewForObject that checks the $object_type parameter against AnalystData::valid_targets using a strict in_array comparison; if the value is not in the list, a NotFoundException is thrown. In thread.ctp, two occurrences of strtolower($objectType) passed directly into __() translation calls are wrapped with h() to HTML-encode the value before it is embedded in the rendered HTML output.

CVSS rationale

AV:N: The vulnerability is exploitable over the network via a crafted URL. AC:L: No race conditions or special environment conditions are required; the attacker simply crafts a URL with a malicious object_type value. AT:N: No manipulation of the attack target is needed. PR:L: The victim must be authenticated to MISP to reach the AnalystData view. UI:A: The victim must actively navigate to the attacker-supplied URL (e.g., click a link), which constitutes active user interaction. VC:N, VI:N, VA:N: The vulnerable MISP server itself is not directly compromised; the impact is on the victim's browser session. SC:L: The attacker can read data available in the victim's browser context (cookies, session tokens, page content) but impact is limited to the current page. SI:L: The attacker can modify the rendered page or submit forms on behalf of the victim within the session. SA:N: No broader security impact on other systems is expected from this reflected XSS.

Weakness rationale
  • CWE-79 The object_type URL parameter is reflected into HTML output without encoding, allowing script injection. This is a textbook reflected XSS.
  • CWE-116 The view template interpolated the object type into translated strings without applying h() HTML encoding, which is the direct encoding failure that permits the XSS.
  • CWE-20 The controller accepted any arbitrary string as the object_type parameter without validating it against the known set of valid analyst-data target types, allowing attacker-controlled data to reach the output layer.
Attack pattern rationale
  • CAPEC-127 The vulnerability is a reflected XSS: attacker-controlled input from the URL is reflected into the HTML response without encoding. CAPEC-127 is the most specific and directly applicable attack pattern. No uncertainty in this mapping.
  • CAPEC-61 CAPEC-61 is the broader parent pattern for XSS attacks. It is included as a secondary mapping to cover the general class of the vulnerability. CAPEC-127 is the more precise match; CAPEC-61 is listed for completeness.
Assumptions to verify
  • The affected version range is inferred from the tag_version_boundary metadata (v2.5.47 with 58 commits after the fix), suggesting the fix is included in v2.5.47. The exact first affected version is not specified in the patch.
  • PR:L assumes the AnalystData viewForObject action requires authentication, which is consistent with MISP's typical access model but not explicitly confirmed in the patch.
  • UI:A assumes the victim must actively navigate to a crafted URL (e.g., click a link). If the malicious URL could be loaded in an iframe or auto-redirected, UI:P might be more appropriate, but the evidence supports active navigation.
  • SC:L and SI:L reflect the typical impact of reflected XSS limited to the current page context; a more severe impact (SC:H, SI:H) is possible if the XSS can exfiltrate full session credentials or perform privileged actions, but the patch evidence does not confirm the scope of available data.
  • The CAPEC-61 mapping is a broader parent pattern included for completeness; CAPEC-127 is the primary and most precise match.
Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model Score Agreement Confidence Assumptions
qwen3.8:27b 6 9 high 5
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95659",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T15:34:30.477077Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:34:41.995Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "AnalystDataController",
            "Overmind theme AnalystData thread element"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/AnalystDataController.php",
            "app/View/Themed/Overmind/Elements/AnalystData/thread.ctp"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Fable 5.1"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated into two translated strings and rendered into the HTML response without output encoding. An authenticated attacker who can induce a victim to navigate to a crafted URL can inject arbitrary JavaScript that executes in the victim\u0027s browser within the MISP application context. This may allow the attacker to read session data, manipulate the page, or perform actions on behalf of the victim.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThe vulnerability requires the victim to be authenticated to MISP and to actively visit the attacker-supplied URL. The affected component is the AnalystData controller and the Overmind theme\u0027s AnalystData thread element.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated into two translated strings and rendered into the HTML response without output encoding. An authenticated attacker who can induce a victim to navigate to a crafted URL can inject arbitrary JavaScript that executes in the victim\u0027s browser within the MISP application context. This may allow the attacker to read session data, manipulate the page, or perform actions on behalf of the victim.\u00a0\n\nThe vulnerability requires the victim to be authenticated to MISP and to actively visit the attacker-supplied URL. The affected component is the AnalystData controller and the Overmind theme\u0027s AnalystData thread element.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-127",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-127 Cross Site Scripting (Reflected)"
            }
          ]
        },
        {
          "capecId": "CAPEC-61",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-61 Cross Site Scripting"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116 Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T12:41:31.639Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/23b879073"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix introduces two layers of defense. First, the viewForObject action now validates the object_type parameter against the AnalystData::valid_targets whitelist and rejects any value not in that list with a NotFoundException, preventing arbitrary strings from reaching the view layer. Second, the two output sinks in the Overmind thread.ctp template now apply the h() HTML-encoding function to the object type before interpolation into translated strings, ensuring that even if a valid type were to contain special characters, it would be rendered as inert text rather than executable markup.\u003c/p\u003e"
            }
          ],
          "value": "The fix introduces two layers of defense. First, the viewForObject action now validates the object_type parameter against the AnalystData::valid_targets whitelist and rejects any value not in that list with a NotFoundException, preventing arbitrary strings from reaching the view layer. Second, the two output sinks in the Overmind thread.ctp template now apply the h() HTML-encoding function to the object type before interpolation into translated strings, ensuring that even if a valid type were to contain special characters, it would be rendered as inert text rather than executable markup."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary metadata (v2.5.47 with 58 commits after the fix), suggesting the fix is included in v2.5.47. The exact first affected version is not specified in the patch.",
                  "PR:L assumes the AnalystData viewForObject action requires authentication, which is consistent with MISP\u0027s typical access model but not explicitly confirmed in the patch.",
                  "UI:A assumes the victim must actively navigate to a crafted URL (e.g., click a link). If the malicious URL could be loaded in an iframe or auto-redirected, UI:P might be more appropriate, but the evidence supports active navigation.",
                  "SC:L and SI:L reflect the typical impact of reflected XSS limited to the current page context; a more severe impact (SC:H, SI:H) is possible if the XSS can exfiltrate full session credentials or perform privileged actions, but the patch evidence does not confirm the scope of available data.",
                  "The CAPEC-61 mapping is a broader parent pattern included for completeness; CAPEC-127 is the primary and most precise match."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-127",
                    "rationale": "The vulnerability is a reflected XSS: attacker-controlled input from the URL is reflected into the HTML response without encoding. CAPEC-127 is the most specific and directly applicable attack pattern. No uncertainty in this mapping."
                  },
                  {
                    "capecId": "CAPEC-61",
                    "rationale": "CAPEC-61 is the broader parent pattern for XSS attacks. It is included as a secondary mapping to cover the general class of the vulnerability. CAPEC-127 is the more precise match; CAPEC-61 is listed for completeness."
                  }
                ],
                "commit": "23b879073eefce37e1065295d180c4bea7cef95f",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Fable 5.1"
                  }
                ],
                "cvssRationale": "AV:N: The vulnerability is exploitable over the network via a crafted URL. AC:L: No race conditions or special environment conditions are required; the attacker simply crafts a URL with a malicious object_type value. AT:N: No manipulation of the attack target is needed. PR:L: The victim must be authenticated to MISP to reach the AnalystData view. UI:A: The victim must actively navigate to the attacker-supplied URL (e.g., click a link), which constitutes active user interaction. VC:N, VI:N, VA:N: The vulnerable MISP server itself is not directly compromised; the impact is on the victim\u0027s browser session. SC:L: The attacker can read data available in the victim\u0027s browser context (cookies, session tokens, page content) but impact is limited to the current page. SI:L: The attacker can modify the rendered page or submit forms on behalf of the victim within the session. SA:N: No broader security impact on other systems is expected from this reflected XSS.",
                "fixSummary": "The fix introduces two layers of defense. First, the viewForObject action now validates the object_type parameter against the AnalystData::valid_targets whitelist and rejects any value not in that list with a NotFoundException, preventing arbitrary strings from reaching the view layer. Second, the two output sinks in the Overmind thread.ctp template now apply the h() HTML-encoding function to the object type before interpolation into translated strings, ensuring that even if a valid type were to contain special characters, it would be rendered as inert text rather than executable markup.",
                "generatedAt": "2026-09-22T12:33:44.255419Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "4476bdd487c3b17c3cffff36a76763c107e8bf284095d61bd6860865ce8912e0",
                "patchSummary": "In AnalystDataController.php, the patch adds an import of the AnalystData model and inserts a guard clause at the top of viewForObject that checks the $object_type parameter against AnalystData::valid_targets using a strict in_array comparison; if the value is not in the list, a NotFoundException is thrown. In thread.ctp, two occurrences of strtolower($objectType) passed directly into __() translation calls are wrapped with h() to HTML-encode the value before it is embedded in the rendered HTML output.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "23b879073eefce37e1065295d180c4bea7cef95f",
                    "patchSha256": "4476bdd487c3b17c3cffff36a76763c107e8bf284095d61bd6860865ce8912e0",
                    "source": "https://github.com/MISP/MISP/commit/23b879073.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/23b879073.patch",
                    "subject": "fix: [security] Reflected XSS via the object type in the"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/23b879073.patch",
                "subject": "fix: [security] Reflected XSS via the object type in the",
                "tagVersionBoundary": {
                  "commits_after_fix": 58,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-79",
                    "rationale": "The object_type URL parameter is reflected into HTML output without encoding, allowing script injection. This is a textbook reflected XSS."
                  },
                  {
                    "cweId": "CWE-116",
                    "rationale": "The view template interpolated the object type into translated strings without applying h() HTML encoding, which is the direct encoding failure that permits the XSS."
                  },
                  {
                    "cweId": "CWE-20",
                    "rationale": "The controller accepted any arbitrary string as the object_type parameter without validating it against the known set of valid analyst-data target types, allowing attacker-controlled data to reach the output layer."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20234"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-95659",
    "datePublished": "2026-09-22T12:40:38.097Z",
    "dateReserved": "2026-09-22T12:40:33.071Z",
    "dateUpdated": "2026-09-22T15:34:41.995Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "modules": [
                  "AnalystDataController",
                  "Overmind theme AnalystData thread element"
                ],
                "product": "MISP",
                "programFiles": [
                  "app/Controller/AnalystDataController.php",
                  "app/View/Themed/Overmind/Elements/AnalystData/thread.ctp"
                ],
                "repo": "https://github.com/MISP/MISP",
                "vendor": "MISP",
                "versions": [
                  {
                    "lessThan": "2.5.47",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated into two translated strings and rendered into the HTML response without output encoding. An authenticated attacker who can induce a victim to navigate to a crafted URL can inject arbitrary JavaScript that executes in the victim\u0027s browser within the MISP application context. This may allow the attacker to read session data, manipulate the page, or perform actions on behalf of the victim.\u00a0\n\nThe vulnerability requires the victim to be authenticated to MISP and to actively visit the attacker-supplied URL. The affected component is the AnalystData controller and the Overmind theme\u0027s AnalystData thread element.\n\nVersion affected: \u003c2.5.47"
          }
        ],
        "id": "CVE-2026-95659",
        "lastModified": "2026-09-22T16:18:19.293",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 4.8,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "LOW",
                "subIntegrityImpact": "LOW",
                "userInteraction": "ACTIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-95659",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T15:34:30.477077Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-22T13:17:13.797",
        "references": [
          {
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
            "url": "https://github.com/MISP/MISP/commit/23b879073"
          }
        ],
        "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-20"
              },
              {
                "lang": "en",
                "value": "CWE-79"
              },
              {
                "lang": "en",
                "value": "CWE-116"
              }
            ],
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.