OpenCTI-Platform
Vulnerability activity for OpenCTI-Platform: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 2
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 4
- Critical (CVSS 9+)
- 2
- Exploited (CISA KEV)
- 0
- With exploit code
- 2
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 7.1HighSep 15, 2026OpenCTI-Platform opencti Denial of serviceCVE-2026-76821OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260706.0, the JSON ingestion mapper's extractWithRegexp formula function compiled a user-supplied regular expression with the JavaScript RegExp engine in opencti-platform/opencti-graphql/src/parser/json-mapper.ts without validating its complexity. An authenticated user with JSON mapper creation permission could provide a catastrophically backtracking pattern and matching ingestion inpu
- 7.7HighSep 15, 2026OpenCTI-Platform opencti SSRFCVE-2026-76820OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny list or reject private, loopback, and link-local destinations, allowing an authenticated account with the INGESTION capability to make OpenCTI request internal services and cloud metadata endpoints. Returne
- 9.8CriticalMay 5, 2026OpenCTI-Platform opencti Auth bypass / access controlCVE-2026-27960OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0 through 6.9.12, there is a privilege escalation vulnerability that can be exploited by unauthenticated attackers to query the API as any existing user, including the default admin a4.7% likelyMetasploit · NucleiDetection
- 9.1CriticalApr 9, 2026OpenCTI-Platform opencti Code / command injectionCVE-2026-39980OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.5, the safeEjs.ts file does not properly sanitize EJS templates. Users with the Manage customization capability can run arbitrary JavaScript in the context of the OpenCTI platform proces1.3% likelyMetasploit
Top products
- opencti4 CVEs in the last year, 2 critical
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.