OpenCTI-Platform opencti vulnerabilities

CVEs per yearBy the year they were published

1. 20244
2. 20254
3. 202612

Newest CVEs

• CVE-2026-76820

  OpenCTI: Synchronizer SSRF: stream fetch has no URL validation

  OpenCTI-Platform · opencti

  High7.7
• CVE-2026-76821

  OpenCTI: User-Controlled ReDoS in JSON Ingestion Mapper

  OpenCTI-Platform · opencti

  High7.1
• CVE-2026-35211

  OpenCTI: Elasticsearch Painless Script Injection via GraphQL `script` filter operator allows authenticated user to exfiltrate data and cause DoS

  OpenCTI-Platform · opencti

  Medium6.5
• CVE-2026-35210

  OpenCTI: Authorization Bypass via `synchronized-upsert` HTTP Header Injection

  OpenCTI-Platform · opencti

  High7.1
• CVE-2026-35212

  OpenCTI has XSS in the rendering of email-message observable body data

  OpenCTI-Platform · opencti

  Medium5.3
• CVE-2026-44730

  OpenCTI: Privilege escalation via graphQL API abusable by organization admins, due to incorrect ACL on userEdit relationAdd

  OpenCTI-Platform · opencti

  High7.2
• CVE-2026-27960

  OpenCTI privilege escalation and unauthenticated access via default admin account

  OpenCTI-Platform · opencti

  Critical9.8
• CVE-2026-39980

  OpenCTI affected by RCE via notifier template

  OpenCTI-Platform · opencti

  Critical9.1
• CVE-2026-21886

  OpenCTI's GraphQL Mutations Allow Deletion of Unrelated Entities

  OpenCTI-Platform · opencti

  Medium6.5
• CVE-2026-21887

  OpenCTI has a Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature

  OpenCTI-Platform · opencti

  High7.7