247962 matches found
CVE-2026-16971
The CVE-2026-16971 entry concerns the IRIS web application (noted around version 2.4.26) where MFA validation is not protected against brute-force attempts. The connected CVE records consistently describe insufficient brute-force protection for OTP validation, indicating that an attacker could re...
CVE-2026-16971 DFIR-IRIS Missing Brute Force Protection in OTP Validation
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks...
CVE-2026-16971
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks...
EUVD-2026-51072
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks...
CVE-2026-18361 DFIR-IRIS Stored XSS in Datastore Upload
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the datastore upload function...
CVE-2026-18361
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the datastore upload function...
CVE-2026-18361
The CVE-2026-18361 entry affects the IRIS web application (version 2.4.26, possibly others) and is due to a stored XSS vulnerability in the datastore upload function. The reported impact is high (CVSS 3.1: 7.6), with user interaction required and a changed scope. The documents do not provide expl...
EUVD-2026-51071
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the datastore upload function...
EUVD-2026-51070
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the custom attributes function...
CVE-2026-18360 DFIR-IRIS Stored XSS in Custom Attributes
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the custom attributes function...
CVE-2026-18360
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the custom attributes function...
CVE-2026-18360
The CVE-2026-18360 entry describes a stored XSS in the IRIS web application (version ~2.4.26 and possibly others) specifically in the custom attributes function. The vulnerability is characterized by CVSS v3.1 metrics: Network attack vector, Low attack complexity, Privileges required Low, User in...
CVE-2026-18360 DFIR-IRIS Stored XSS in Custom Attributes
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the custom attributes function...
EUVD-2026-51069
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...
CVE-2026-16969
Affected product: IRIS web application (version 2.4.26 and possibly others). Vulnerability: Stored cross-site scripting (XSS) in the assets function. Impact: High (CVE-2026-16969, CVSS v3.1 base score 7.6) with confidentiality impact elevated; requires user interaction and has network access with...
CVE-2026-16969 DFIR-IRIS Stored XSS in Assets
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...
CVE-2026-16969
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...
io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation
A flaw was found in Eclipse Vert.x Web Client. The WebClientSession component does not properly validate the Domain attribute of a Set-Cookie response header against the originating server's domain. This vulnerability allows a remote attacker to inject a cookie scoped to an arbitrary third-party...
CVE-2026-18353
PIA's POST /v1/upload/sbom endpoint accepts a Bearer JWT and checks its unverified iss claim against an issuer allowlist using Python's urlparse before performing OIDC discovery with requests. Because urlparse and requests/urllib3 parse an authority string containing a backslash e.g...
