{"cve":"CVE-2026-44364","nvd":{"published":"2026-05-13T20:16:23.157","modified":"2026-10-26T14:10:00.130","status":"Deferred","description":"MISP modules are autonomous modules that can be used to extend MISP for new services. In 3.0.7 and earlier, a Cross-Site Request Forgery vulnerability in the MISP Modules website allowed an attacker to cause an authenticated user to submit unintended requests to the home endpoint. The vulnerability was due to the home blueprint being exempted from CSRF protection. This could allow modification of session query data in the context of the authenticated user. The issue was fixed by enabling CSRF protection for the affected blueprint and hardening query parsing.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H","score":9.3},"cvss_v3":null,"cwes":["CWE-352"],"references":["https://github.com/MISP/misp-modules/security/advisories/GHSA-j4rh-7jcr-qm69"],"products":[],"source":"nvd","synced_at":"2026-10-26T14:27:29.784594657+00:00"},"epss":{"cve":"CVE-2026-44364","score":0.00185,"percentile":0.07995,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-j4rh-7jcr-qm69","url":"https://osv.dev/vulnerability/GHSA-j4rh-7jcr-qm69","summary":"misp-modules website - Missing CSRF protection in the website home blueprint","modified":"2026-06-29T12:26:08.899388382Z","packages":[{"ecosystem":"PyPI","name":"misp-modules","purl":"pkg:pypi/misp-modules","ranges":["<=3.0.7"],"fixed":[]}]},{"id":"PYSEC-2026-414","url":"https://osv.dev/vulnerability/PYSEC-2026-414","summary":"misp-modules website - Missing CSRF protection in the website home blueprint","modified":"2026-07-01T20:22:58.041637Z","packages":[{"ecosystem":"PyPI","name":"misp-modules","purl":"pkg:pypi/misp-modules","ranges":["<=3.0.7"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}