CVE Program partner

CIRCL

Computer Incident Response Center Luxembourg (CIRCL)

API
CVEs, 365 days236237 all time, 1 rejected
Quality98%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions95%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationComputer Incident Response Center Luxembourg (CIRCL)
RoleCNA
TypeCERT
Reports toENISA → mitre
ScopeVulnerability assignment related to vulnerability coordination in Luxembourg, which may include reports on software, products, hardware, or services submitted to CIRCL in its role as the national authority for vulnerability coordination in Luxembourg and within the CSIRTs network.
Advisorieshttps://vulnerability.circl.lu/search?assigner=CIRCL

Latest CVEs · RSS

  • CVE-2026-111458 2026-10-16 · CVSS 6.8
    The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is
  • CVE-2026-107278 2026-10-07 · CVSS 5.3
    MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originat
  • CVE-2026-107276 2026-10-07 · CVSS 6.3
    MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurren
  • CVE-2026-107180 2026-10-07 · CVSS 7.1
    On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication setup applied only to
  • CVE-2026-107175 2026-10-07 · CVSS 5.3
    MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sha
  • CVE-2026-106513 2026-10-06 · CVSS 6.9
    MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJob
  • CVE-2026-106512 2026-10-06 · CVSS 8.4
    The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied fil
  • CVE-2026-104914 2026-10-02 · CVSS 5.3
    MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints. When a user queries for soft-deleted att
  • CVE-2026-104912 2026-10-02 · CVSS 7.1
    MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lo
  • CVE-2026-104910 2026-10-02 · CVSS 5.3
    MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the syst
  • CVE-2026-104908 2026-10-02 · CVSS 7.1
    MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying m
  • CVE-2026-104907 2026-10-02 · CVSS 4.8
    MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page. When a linked (remote) MISP server is configured, the event preview r
  • CVE-2026-104906 2026-10-02 · CVSS 6.2
    MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string propertie
  • CVE-2026-104901 2026-10-02 · CVSS 5.1
    MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked
  • CVE-2026-104900 2026-10-02 · CVSS 5.3
    MISP contains a stored cross-site scripting (XSS) vulnerability in the index table rendering of the remote event preview. The count field template escaped the a
  • CVE-2026-103858 2026-10-01 · CVSS 5.3
    MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post,
  • CVE-2026-103664 2026-10-01 · CVSS 4.8
    MISP contains a reflected cross-site scripting (XSS) vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, w
  • CVE-2026-103662 2026-10-01 · CVSS 5.1
    MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag). The affe
  • CVE-2026-103659 2026-10-01 · CVSS 7.1
    MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes th
  • CVE-2026-103655 2026-10-01 · CVSS 9.3
    MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once with
  • CVE-2026-103651 2026-10-01 · CVSS 7.6
    MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (paper) token and rewinding of the token
  • CVE-2026-103389 2026-09-30 · CVSS 6.2
    MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any se
  • CVE-2026-103388 2026-09-30 · CVSS 6.2
    MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER_VALIDATE_URL validation. Because FILTER
  • CVE-2026-103321 2026-09-30 · CVSS 8.3
    MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored wi
  • CVE-2026-103239 2026-09-30 · CVSS 8.6
    MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request

All CVE Program partners