CVE-2026-103321

{
  "etk_id": "ETK-2026-118",
  "cve_id": "CVE-2026-103321",
  "display_id": "CVE-2026-103321",
  "ghsa_id": "GHSA-w4mv-4x7w-vpvv",
  "euvd_id": "EUVD-2026-89800",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in MISP event graph previews",
  "summary": "MISP versions before 2.5.48 can retain unsafe event graph preview image data. An authenticated user able to edit event graph entries may cause script to run in another user's MISP session when that user opens the preview.",
  "mitigation": "Upgrade MISP to version 2.5.48 or later. Until upgraded, restrict event graph editing to trusted users and avoid opening previews from untrusted entries.",
  "vendor": "MISP",
  "product": "MISP",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2.5.48"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.5.48"
      ],
      "package_name": "MISP",
      "purl": null
    }
  ],
  "cwes": [
    79
  ],
  "cvss_score": 8.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N",
  "epss_score": 0.0036,
  "epss_percentile": 0.2831,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 10.821183883333333,
  "t0_at": "2026-09-30T12:19:01.829000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-09-30T12:19:01.829000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-30T12:19:01.829000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103321"
    }
  }
}