CVE-2026-103664 — MISP reflected cross-site scripting via an unsanitized analyst data seed parameter

In MISP analyst data views, a user-supplied seed parameter was reflected without sanitization into inline JavaScript in the HTML response, enabling reflected XSS. The source states that the vulnerability is remediated by coercing the seed parameter to an integer at both the controller and view-template layers. The vulnerability metadata is a draft and requires human validation.