CVE-2026-44379

🔶 medium

Summary

MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, MISP Collections did not enforce RFC 4122 UUID validation on the uuid field. As a result, a user able to create or modify Collection records could submit malformed UUID values, potentially causing integrity issues or unexpected behaviour in code paths that assume Collection UUIDs are valid identifiers. This vulnerability is fixed in 2.5.37.

CVSS Score

5.3

Medium

EPSS Score

0.2

Exploit Probability

Published Date

2026-05-13

First Seen: 2026-05-17

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 19.0% of all 365,863 vulnerabilities in our database.

#296,493

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: May 14, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

SSVC data provided by CISA

Last Modified 2026-06-22

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVSS Vector 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CWE IDs (Weakness Types)

CWE-20

📦 Affected Products 2

Vendor	Product	Status	Affected Versions
misp	misp	Affected	< 2.5.37
misp-project	misp	Affected	< 2.5.37

🔗 References 2

https://github.com/MISP/MISP/commit/f8b20358c3cd8fd3...

Patch

https://github.com/MISP/MISP/security/advisories/GHS...

Third Party Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-86342	🔶 medium	4.3	0.2	Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview ...	2026-09-07
CVE-2026-86347	🔶 medium	6.5	0.3	Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile() because the ACL entry...	2026-09-07
CVE-2026-86351	🔶 medium	6.1	0.2	Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with...	2026-09-07
CVE-2026-86408	🔶 medium	6.5	0.2	Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKe...	2026-09-07
CVE-2026-86417	🔶 medium	4.3	0.2	Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates(). T...	2026-09-07
CVE-2026-86418	🔶 medium	4.3	0.2	Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the sa...	2026-09-07

These CVEs affect the same products