What’s Vulnerable › Products

dfir-iris iris-web vulnerabilities

19 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.

Check whether your dfir-iris iris-web version is affected

Latest dfir-iris iris-web vulnerabilities

• CVE-2026-92605 — IRIS through 2.4.29 Unauthorized Comment Access via Object ID (CVSS 6.5)
• CVE-2026-18362 — DFIR-IRIS Missing Brute Force Protection in User Authentication (CVSS 5.9)
• CVE-2026-18361 — DFIR-IRIS Stored XSS in Datastore Upload (CVSS 7.6)
• CVE-2026-18360 — DFIR-IRIS Stored XSS in Custom Attributes (CVSS 7.6)
• CVE-2026-16971 — DFIR-IRIS Missing Brute Force Protection in OTP Validation (CVSS 5.9)
• CVE-2026-16970 — DFIR-IRIS Insufficient Logout Implementation (CVSS 4.2)
• CVE-2026-16969 — DFIR-IRIS Stored XSS in Assets (CVSS 7.6)
• CVE-2026-42547 — IRIS Alerts Can be Falsely Attributed to Customers (CVSS 5.4)
• CVE-2026-42543 — IRIS has a Cross-Site Request Forgery (CSRF) issue (CVSS 4.3)
• CVE-2026-42540 — IRIS has a Mass Assignment issue (CVSS 4.3)
• CVE-2026-42539 — IRIS has an Excessive Data Exposure issue (CVSS 6.5)
• CVE-2026-42538 — IRIS has an Insecure File Upload (CVSS 6.3)
• CVE-2026-42329 — Iris has an Open Redirect issue (CVSS 4.7)
• CVE-2026-41522 — Iris has an Improper Authorization issue (CVSS 7.1)
• CVE-2026-22783 — Iris Allows Arbitrary File Deletion via Mass Assignment in Datastore File Management (CVSS 8.1)
• CVE-2024-25624 — iris-web vulnerable to Server Side Template Injection in reports (CVSS 6.8)
• CVE-2024-25640 — Improper Neutralization of Alternate XSS Syntax in iris-web (CVSS 5.4)
• CVE-2023-50712 — Improper Neutralization of Alternate XSS Syntax in iris-web (CVSS 5.4)
• CVE-2023-30615 — Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in iris-web (CVSS 5.4)