CVE-2026-53693

A stored cross-site scripting vulnerability existed in MISP BSimVis tag rendering code. Several client-side rendering paths interpolated tag names, collection names, entity identifiers, cluster names, and tag metadata directly into HTML, HTML attributes, inline JavaScript event handlers, and CSS style values without context-appropriate escaping. The patch adds shared escaping helpers for HTML, attributes, JavaScript strings, and CSS color validation, then applies them across tag badges, tooltips, context menus, cluster cards, autocomplete suggestions, and dynamically inserted tag cards. An attacker able to create or influence stored tag or metadata values could inject a crafted payload that is later rendered in another user’s browser. Successful exploitation could execute arbitrary JavaScript in the victim’s session when they view affected BSimVis pages, potentially allowing the attacker to perform actions as the victim, read data available to the victim, or alter displayed application content. This issue affects MISP bsimvis: through v0.2.0.

• CWE-79
• CWE-116

• https://github.com/MISP/bsimvis/commit/7bcd2c2e27647dccdfb71877e905fbb032124a63

Published

Jun 10, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53676ThingsBoard contains a prototype pollution vulnerability whi…8.6
• CVE-2026-5368A vulnerability was determined in projectworlds Car Rental P…9.8
• CVE-2026-53689libnfs through 6.0.2 before 55c18ea does not validate a stri…7.1
• CVE-2026-53690An SQL Injection vulnerability exists in Redeight CMS versio…9.3
• CVE-2026-53691An Unrestricted File Upload vulnerability in Redeight CMS ve…8.6
• CVE-2026-53692Redeight CMS version 1.0 uses the MD5 algorithm without a sa…5.9
• CVE-2026-53694Improper Neutralization of Argument Delimiters in a Command …7.3
• CVE-2026-53698Silverpeas through 6.4.6 mishandles the "Personal space" fea…6.5
• CVE-2026-5370A vulnerability was identified in krayin laravel-crm up to 2…3.5
• CVE-2026-53701An out-of-bounds write vulnerability was found in GStreamer'…6.5
• CVE-2026-53702A stack buffer overflow flaw was found in the GStreamer H.26…6.5
• CVE-2026-53703A vulnerability was found in the GStreamer RealMedia demuxer…7.1