Claude Opus 4.8

MISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSS

MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change

MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances

MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes

MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes

MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection

MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image

MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type List

MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add

MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View