https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T18:57:35.462140+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-369981 EUVD-2026-369981 2026-10-03T18:57:35.464817+00:00 EUVD-2026-369981 https://cve.radiocsirt.org/vuln/fkie_cve-2026-76820 fkie_cve-2026-76820 2026-10-03T18:57:35.464861+00:00

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny list or reject private, loopback, and link-local destinations, allowing an authenticated account with the INGESTION capability to make OpenCTI request internal services and cloud metadata endpoints. Returned connection errors could distinguish open HTTP ports, open non-HTTP ports, and closed ports, enabling internal network scanning, while compatible endpoint responses could disclose internal data. This issue is fixed in version 7.260701.0.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3210 WID-SEC-W-2026-3210 — OpenCTI: Mehrere Schwachstellen 2026-10-03T18:57:35.464902+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenCTI ausnutzen, um beliebigen Code beziehungsweise Befehle im Kontext des OpenCTI-Servers auszuführen, interne Netzwerkdienste und Cloud-Metadaten über SSRF aufzurufen oder auszuspähen sowie fremde Draft Workspaces einschließlich zugehöriger Dateien und Daten unberechtigt zu löschen.