CVE-2026-18362 DFIR-IRIS Missing Brute Force Protection in User Authentication

The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks...

CVE-2026-18362

CVE-2026-18362 concerns the IRIS web application (noted in version 2.4.26 and possibly other revisions) that does not protect user authentication against brute-force attacks. The connected sources confirm the affected software and the underlying issue but do not provide details on exploit vectors...

CVE-2026-16971

The CVE-2026-16971 entry concerns the IRIS web application (noted around version 2.4.26) where MFA validation is not protected against brute-force attempts. The connected CVE records consistently describe insufficient brute-force protection for OTP validation, indicating that an attacker could re...

EUVD-2026-51072

The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks...

CVE-2026-18361 DFIR-IRIS Stored XSS in Datastore Upload

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the datastore upload function...

CVE-2026-18361

The CVE-2026-18361 entry affects the IRIS web application (version 2.4.26, possibly others) and is due to a stored XSS vulnerability in the datastore upload function. The reported impact is high (CVSS 3.1: 7.6), with user interaction required and a changed scope. The documents do not provide expl...

EUVD-2026-51071

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the datastore upload function...

CVE-2026-18360 DFIR-IRIS Stored XSS in Custom Attributes

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the custom attributes function...

EUVD-2026-51070

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the custom attributes function...

CVE-2026-18360 DFIR-IRIS Stored XSS in Custom Attributes

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the custom attributes function...

CVE-2026-18360

The CVE-2026-18360 entry describes a stored XSS in the IRIS web application (version ~2.4.26 and possibly others) specifically in the custom attributes function. The vulnerability is characterized by CVSS v3.1 metrics: Network attack vector, Low attack complexity, Privileges required Low, User in...

EUVD-2026-51069

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...

CVE-2026-16969 DFIR-IRIS Stored XSS in Assets

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...

CVE-2026-16969 DFIR-IRIS Stored XSS in Assets

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...

CVE-2026-16969

Affected product: IRIS web application (version 2.4.26 and possibly others). Vulnerability: Stored cross-site scripting (XSS) in the assets function. Impact: High (CVE-2026-16969, CVSS v3.1 base score 7.6) with confidentiality impact elevated; requires user interaction and has network access with...

CVE-2026-16969

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...

[SECURITY] Fedora 43 Update: nginx-mod-naxsi-1.6-21.fc43

naxsi is an nginx module that provides score based Web Application Firewall WAF abilities in a highly granular fashion...

PT-2026-66446

Name of the Vulnerable Software and Affected Versions IRIS web application version 2.4.26 Description The logout functionality is ineffective, allowing stolen session cookies to be misused for an extended period. Recommendations At the moment, there is no information about a newer version that...

CVE-2026-16970: Insufficient Session Expiration

The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time...

CVE-2026-18362: Allocation of Resources Without Limits or Throttling

The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks...