Advisories · Technology

dfir-iris iris-web.

Every CVE that names dfir-iris iris-web among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-92605 CVE record

CVSS 7.1 High

IRIS through 2.4.29 Unauthorized Comment Access via Object ID
- dfir-iris iris-web
- Broken access control
Not analysed yet 16 Sept 2026
CVE-2026-16970 CVE record

CVSS 4.2 Medium

DFIR-IRIS Insufficient Logout Implementation
- dfir-iris iris-web
- Authentication bypass
Not analysed yet 30 Jul 2026
CVE-2026-18362 CVE record

CVSS 5.9 Medium

DFIR-IRIS Missing Brute Force Protection in User Authentication
- dfir-iris iris-web
- Denial of service
Not analysed yet 30 Jul 2026
CVE-2026-16971 CVE record

CVSS 5.9 Medium

DFIR-IRIS Missing Brute Force Protection in OTP Validation
- dfir-iris iris-web
- Denial of service
Not analysed yet 30 Jul 2026
CVE-2026-18361 CVE record

CVSS 7.6 High

DFIR-IRIS Stored XSS in Datastore Upload
- dfir-iris iris-web
- Cross-site scripting (XSS)
Not analysed yet 30 Jul 2026
CVE-2026-18360 CVE record

CVSS 7.6 High

DFIR-IRIS Stored XSS in Custom Attributes
- dfir-iris iris-web
- Cross-site scripting (XSS)
Not analysed yet 30 Jul 2026
CVE-2026-16969 CVE record

CVSS 7.6 High

DFIR-IRIS Stored XSS in Assets
- dfir-iris iris-web
- Cross-site scripting (XSS)
Not analysed yet 30 Jul 2026
CVE-2026-42547 CVE record

CVSS 5.4 Medium

IRIS Alerts Can be Falsely Attributed to Customers
- dfir-iris iris-web
- Broken access control
Not analysed yet 4 Jun 2026
CVE-2026-42543 CVE record

CVSS 4.3 Medium

IRIS has a Cross-Site Request Forgery (CSRF) issue
- dfir-iris iris-web
- CWE-650
Not analysed yet 4 Jun 2026
CVE-2026-42540 CVE record

CVSS 4.3 Medium

IRIS has a Mass Assignment issue
- dfir-iris iris-web
- Broken access control
Not analysed yet 4 Jun 2026
CVE-2026-42539 CVE record

CVSS 6.5 Medium

IRIS has an Excessive Data Exposure issue
- dfir-iris iris-web
- Information disclosure
Not analysed yet 4 Jun 2026
CVE-2026-42538 CVE record

CVSS 6.3 Medium

IRIS has an Insecure File Upload
- dfir-iris iris-web
- Unrestricted file upload
Not analysed yet 4 Jun 2026
CVE-2026-42329 CVE record

CVSS 4.7 Medium

Iris has an Open Redirect issue
- dfir-iris iris-web
- CWE-602
Not analysed yet 4 Jun 2026
CVE-2026-41522 CVE record

CVSS 7.1 High

Iris has an Improper Authorization issue
- dfir-iris iris-web
- Broken access control
Not analysed yet 4 Jun 2026
CVE-2026-22783 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Iris Allows Arbitrary File Deletion via Mass Assignment in Datastore File Management
- dfir-iris iris-web
- Path traversal
- Unrestricted file upload
Not analysed yet 12 Jan 2026
CVE-2024-25624 CVE record

CVSS 6.8 Medium

iris-web vulnerable to Server Side Template Injection in reports
- dfir-iris iris-web
- Code injection
Not analysed yet 25 Apr 2024
CVE-2024-25640 CVE record

CVSS 4.6 Medium

Improper Neutralization of Alternate XSS Syntax in iris-web
- dfir-iris iris-web
- Cross-site scripting (XSS)
Not analysed yet 19 Feb 2024
CVE-2023-50712 CVE record

CVSS 4.6 Medium

Improper Neutralization of Alternate XSS Syntax in iris-web
- dfir-iris iris-web
- Cross-site scripting (XSS)
Not analysed yet 22 Dec 2023
CVE-2023-30615 CVE record

CVSS 6.3 Medium

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in iris-web
- dfir-iris iris-web
- Cross-site scripting (XSS)
Not analysed yet 25 May 2023