https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 18:57:28 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-369981 EUVD-2026-369981 https://cve.radiocsirt.org/vuln/euvd-2026-369981 https://cve.radiocsirt.org/vuln/fkie_cve-2026-76820 <p>OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny list or reject private, loopback, and link-local destinations, allowing an authenticated account with the INGESTION capability to make OpenCTI request internal services and cloud metadata endpoints. Returned connection errors could distinguish open HTTP ports, open non-HTTP ports, and closed ports, enabling internal network scanning, while compatible endpoint responses could disclose internal data. This issue is fixed in version 7.260701.0.</p> <p>OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny list or reject private, loopback, and link-local destinations, allowing an authenticated account with the INGESTION capability to make OpenCTI request internal services and cloud metadata endpoints. Returned connection errors could distinguish open HTTP ports, open non-HTTP ports, and closed ports, enabling internal network scanning, while compatible endpoint responses could disclose internal data. This issue is fixed in version 7.260701.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-76820 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3210 <p>Ein Angreifer kann mehrere Schwachstellen in OpenCTI ausnutzen, um beliebigen Code beziehungsweise Befehle im Kontext des OpenCTI-Servers auszuführen, interne Netzwerkdienste und Cloud-Metadaten über SSRF aufzurufen oder auszuspähen sowie fremde Draft Workspaces einschließlich zugehöriger Dateien und Daten unberechtigt zu löschen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in OpenCTI ausnutzen, um beliebigen Code beziehungsweise Befehle im Kontext des OpenCTI-Servers auszuführen, interne Netzwerkdienste und Cloud-Metadaten über SSRF aufzurufen oder auszuspähen sowie fremde Draft Workspaces einschließlich zugehöriger Dateien und Daten unberechtigt zu löschen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3210