Skip to content
OpenAdvisories

Product · dfir-iris

iris-web

19 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.6
    CVE-2026-18361

    DFIR-IRIS Stored XSS in Datastore Upload

    The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload function.

    dfir-iris iris-web
  • High 7.6
    CVE-2026-18360

    DFIR-IRIS Stored XSS in Custom Attributes

    The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function.

    dfir-iris iris-web
  • High 7.6
    CVE-2026-16969

    DFIR-IRIS Stored XSS in Assets

    The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function.

    dfir-iris iris-web
  • High 7.1
    CVE-2026-41522

    Iris has an Improper Authorization issue

    Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at `/graphql` that does not enforce the same authorization checks as the…

    dfir-iris iris-web