What’s Vulnerable › Products

OpenCTI-Platform opencti vulnerabilities

24 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 21 published in the last 12 months.

Check whether your OpenCTI-Platform opencti version is affected

Latest OpenCTI-Platform opencti vulnerabilities

• CVE-2026-76821 — OpenCTI: User-Controlled ReDoS in JSON Ingestion Mapper (CVSS 7.1)
• CVE-2026-76820 — OpenCTI: Synchronizer SSRF: stream fetch has no URL validation (CVSS 7.7)
• CVE-2026-35211 — OpenCTI: Elasticsearch Painless Script Injection via GraphQL `script` filter operator allows authenticated user to exfiltrate data and cause DoS (CVSS 6.5)
• CVE-2026-35210 — OpenCTI: Authorization Bypass via `synchronized-upsert` HTTP Header Injection (CVSS 7.1)
• CVE-2026-35212 — OpenCTI has XSS in the rendering of email-message observable body data (CVSS 6.1)
• CVE-2026-44730 — OpenCTI: Privilege escalation via graphQL API abusable by organization admins, due to incorrect ACL on userEdit relationAdd (CVSS 7.2)
• CVE-2026-27960 — OpenCTI privilege escalation and unauthenticated access via default admin account (CVSS 9.8)
• CVE-2026-39980 — OpenCTI affected by RCE via notifier template (CVSS 7.2)
• CVE-2026-21886 — OpenCTI's GraphQL Mutations Allow Deletion of Unrelated Entities (CVSS 8.1)
• CVE-2026-21887 — OpenCTI has a Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature (CVSS 7.7)
• CVE-2020-37044 — OpenCTI 3.3.1 - Cross Site Scripting (CVSS 6.1)
• CVE-2020-37041 — OpenCTI 3.3.1 - Directory Traversal (CVSS 7.5)
• CVE-2025-61782 — Open Redirect in OpenCTI's SAML Authentication Flow (CVSS 6.1)
• CVE-2025-61781 — GraphQL IDOR allows authenticated user to delete workspace content of other users (CVSS 9.1)
• CVE-2025-46732 — OpenCTI's GraphQL IDOR enables authenticated users to modify or delete notifications of other users (CVSS 5.4)
• CVE-2025-26621 — OpenCTI vulnerable to Denial of Service through web hook (CVSS 6.8)
• CVE-2025-24977 — OpenCTI has remote code execution and sensitive secrets exposed through web hook (CVSS 9.1)
• CVE-2025-24887 — OpenCTI bypass of protected attribute update (CVSS 6.3)
• CVE-2024-45805 — OpenCTI leaks support information due to inadequate access control (CVSS 4.3)
• CVE-2024-45404 — OpenCTI's lack of Rate Limit lead to OTP brute forcing (CVSS 8.1)
• CVE-2024-37155 — OpenCTI May Bypass Introspection Restriction (CVSS 8.2)
• CVE-2024-26139 — OpenCTI Authenticated Privilege Escalation (CVSS 8.1)
• CVE-2022-30290 — (CVSS 7.5)
• CVE-2022-30289 — (CVSS 5.4)