CVE-2026-16969 DFIR-IRIS Stored XSS in Assets

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...

CVE-2026-16969 DFIR-IRIS Stored XSS in Assets

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...

CVE-2026-16969

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...

PT-2026-66446

Name of the Vulnerable Software and Affected Versions IRIS web application version 2.4.26 Description The logout functionality is ineffective, allowing stolen session cookies to be misused for an extended period. Recommendations At the moment, there is no information about a newer version that...

CVE-2026-18360: Improper Neutralization of Input During Web Page Generation

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the custom attributes function...

CVE-2026-16970: Insufficient Session Expiration

The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time...

CVE-2026-18362: Allocation of Resources Without Limits or Throttling

The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks...

PT-2026-66450

The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks...

PT-2026-66449

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the datastore upload function...

PT-2026-66445

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...

PT-2026-66447

The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks...

CVE-2026-16971: Allocation of Resources Without Limits or Throttling

The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks...

CVE-2026-18361: Improper Neutralization of Input During Web Page Generation

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the datastore upload function...

PT-2026-66448

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the custom attributes function...

CVE-2026-16969: Improper Neutralization of Input During Web Page Generation

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...

Felons, Fraudsters Flog Offensive Cybersecurity Startup

A cybersecurity startup dangling millions of dollars to acquire zero-day security vulnerabilities in popular software is run by a pair of far-right conspiracy theorists and convicted felons whose most recent ventures included fake intelligence companies and a now-defunct AI-based lobbying platfor...

The vulnerability of the iris_vb2_stop_streaming() function in the drivers/media/platform/qcom/iris/iris_vb2.c file of the Linux kernel-based multimedia device driver module allows a malicious actor to cause a service failure.

The vulnerability of the irisvb2stopstreaming function in the drivers/media/platform/qcom/iris/irisvb2.c file of the Linux multimedia device driver framework is related to state management errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: media: iris: fixed the use-of-free of fmtsrc during the MBPF check. During concurrency testing, multiple instances can run in parallel. Each instance uses its own inst-lock, while the core-lock protects the list of active...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: media: iris: Fixed a use-after-free in irisreleaseinternalbuffers The recent change in commit 1dabf00ee206 “media: iris: gen1: Destroy internal buffers after FW releases” introduced a regression where sessionreleasebuf might free...

CVE-2026-42329

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 contain a weakness where an attacker can misuse it to redirect the user to a malicious website controlled by an attacker. Version 2.4.28 fixes the issue...