CVE-2026-95661

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description A reflected cross-site scripting (XSS) issue exists in the attribute histogram view. The $selectedTypes variable, derived from the URL path segment, is interpolated directly into a JavaScript array literal within an onClick HTML attribute without proper encoding or escaping. This allows an attacker to execute arbitrary JavaScript in the browser of an authenticated user who visits a crafted URL. Potential impacts include the theft of session cookies, unauthorized actions performed on behalf of the user, or exfiltration of sensitive data from the application interface.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.