OOpenCTI-Platform

Products

Exploited and recent CVEs

• CVE-2026-76820 High 7.7 OpenCTI: Synchronizer SSRF: stream fetch has no URL validation 0.4%
• CVE-2026-76821 High 7.1 OpenCTI: User-Controlled ReDoS in JSON Ingestion Mapper 0.5%
• CVE-2026-35211 Medium 6.5 OpenCTI: Elasticsearch Painless Script Injection via GraphQL `script` filter operator allows authenticated user to exfiltrate data and cause DoS 0.5%
• CVE-2026-35210 High 7.1 OpenCTI: Authorization Bypass via `synchronized-upsert` HTTP Header Injection 0.4%
• CVE-2026-35212 Medium 5.3 OpenCTI has XSS in the rendering of email-message observable body data 0.1%
• CVE-2026-44730 High 7.2 OpenCTI: Privilege escalation via graphQL API abusable by organization admins, due to incorrect ACL on userEdit relationAdd 0.3%
• CVE-2026-27960 Critical 9.8 OpenCTI privilege escalation and unauthenticated access via default admin account 7.1%
• CVE-2026-39980 Critical 9.1 OpenCTI affected by RCE via notifier template 1.4%
• CVE-2026-21886 Medium 6.5 OpenCTI's GraphQL Mutations Allow Deletion of Unrelated Entities 0.2%
• CVE-2026-21887 High 7.7 OpenCTI has a Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature 0.2%
• CVE-2025-61782 Medium 5.4 Open Redirect in OpenCTI's SAML Authentication Flow 0.3%
• CVE-2025-61781 High 7.1 GraphQL IDOR allows authenticated user to delete workspace content of other users 0.2%
• CVE-2025-46732 Medium 5.4 OpenCTI's GraphQL IDOR enables authenticated users to modify or delete notifications of other users 0.2%
• CVE-2025-26621 High 7.6 OpenCTI vulnerable to Denial of Service through web hook 0.4%
• CVE-2025-24977 Critical 9.1 OpenCTI has remote code execution and sensitive secrets exposed through web hook 0.9%
• CVE-2025-24887 Medium 6.3 OpenCTI bypass of protected attribute update 0.3%
• CVE-2024-45805 Medium 4.3 OpenCTI leaks support information due to inadequate access control 0.3%
• CVE-2024-45404 High 8.1 OpenCTI's lack of Rate Limit lead to OTP brute forcing 0.6%
• CVE-2024-37155 Medium 6.5 OpenCTI May Bypass Introspection Restriction 0.5%
• CVE-2024-26139 High 8.3 OpenCTI Authenticated Privilege Escalation 0.4%