Threat Intelligence Database

The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time.

CVE-2026-18362 affects the IRIS web application version 2.4.26 and possibly other versions. The vulnerability involves the lack of protection against brute-force attacks on user authentication, categorized under CWE-770 for allocation of resources without limits or throttling. This can allow an attacker to attempt numerous authentication attempts without restriction. The CVSS score is 5.9, indicating a medium severity level.

CVE-2026-16971 is a medium severity vulnerability in the dfir-iris iris-web application version 2.4.26. The vulnerability involves insufficient protection of the multi-factor authentication (MFA) validation process against brute-force attacks, classified under CWE-770 for allocation of resources without limits or throttling. This flaw could allow an attacker to attempt numerous MFA validation requests without effective rate limiting. No official patch or remediation guidance is currently available from the vendor. The vulnerability does not affect cloud services and no known exploits are reported in the wild.

The IRIS web application version 2.4.26 contains a stored cross-site scripting (XSS) vulnerability in its datastore upload function. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to inject malicious scripts. The vulnerability is classified under CWE-79 and has a CVSS 3.1 score of 7.6, indicating high severity.

The IRIS web application version 2.4.26 contains a stored cross-site scripting (XSS) vulnerability in its custom attributes function. This vulnerability allows an attacker with low privileges and requiring user interaction to execute scripts in the context of another user. The vulnerability impacts confidentiality and integrity but does not affect availability. No official patch or remediation guidance is currently available.

The IRIS web application version 2.4.26 contains a stored cross-site scripting (XSS) vulnerability in its assets function. This vulnerability allows an attacker with low privileges and requiring user interaction to execute scripts in the context of other users, potentially leading to high confidentiality impact and limited integrity impact. The vulnerability has a CVSS score of 7.6, indicating high severity. No official patch or remediation guidance is currently available from the vendor.

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. In versions prior to 2.4.28, users can create alerts for customers that are not assigned to them. This can be abused to falsely attribute fake alerts to customers. In combination with Cross-Site Scripting, this can also be used to exfiltrate alerts from other customers. Version 2.4.28 contains a patch.

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 are vulnerable to a cross-site request forgery attack, because they use the HTTP method `GET` to change state on the server. Version 2.4.28 contains a patch.

CVE-2026-42540 is a vulnerability in dfir-iris iris-web, a web collaborative platform for incident responders. Versions prior to 2.4.28 allow users with limited privileges to modify database values by sending manipulated API requests. This issue is classified as CWE-915, indicating improper control over modification of dynamically-determined object attributes. The vulnerability has a CVSS score of 4.3, reflecting a medium severity level. A patch was released in version 2.4.28 to address this issue.

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 return sensitive data to the user which are not required for the client’s operation. Version 2.4.28 contains a patch.