MISP 2.4.136 has XSS via a crafted URL to the app/View/Elements/global_menu.ctp user homepage favourite button.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-3184.json"