Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

pycti

22 known vulnerabilities (3 critical, 8 high, 9 medium), with the versions each affects and the releases that fix them.

Latest release
7.261106.0 (Nov 6, 2026): no advisory affects it
Newest unaffected release
7.261106.0 (Nov 6, 2026), the latest release
Advisories
22 · 3 critical, 8 high, 9 medium
Weekly downloads
78.8K
Dependents
4
Releases
471 since 1.2.1 (Jun 28, 2019)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Show all 22 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 22

  • CVE-2026-35211Medium 6.5

    OpenCTI: Elasticsearch Painless Script Injection via GraphQL `script` filter operator allows authenticated user to exfiltrate data and…

    Affected: fixed in 7.260401.0.

    Fixed in 7.260401.0 (released Apr 1, 2026, 98 days before disclosure).

    The latest release, 7.261106.0, is not affected.

  • OpenCTI: Authorization Bypass via `synchronized-upsert` HTTP Header Injection

    Affected: fixed in 7.260326.0.

    Fixed in 7.260326.0 (released Mar 26, 2026, 104 days before disclosure).

    The latest release, 7.261106.0, is not affected.

  • CVE-2026-35212Medium 5.3

    OpenCTI has XSS in the rendering of email-message observable body data

    Affected: fixed in 7.260227.0.

    Fixed in 7.260227.0 (released Feb 27, 2026, 95 days before disclosure).

    The latest release, 7.261106.0, is not affected.

  • OpenCTI: Privilege escalation via graphQL API abusable by organization admins, due to incorrect ACL on userEdit relationAdd

    Affected: fixed in 6.9.7.

    Fixed in 6.9.7 (released Jan 12, 2026, 134 days before disclosure).

    The latest release, 7.261106.0, is not affected.

  • CVE-2026-27960Critical 9.8

    OpenCTI privilege escalation and unauthenticated access via default admin account

    Affected: from 6.9.0, fixed in 6.9.13.

    Fixed in 6.9.13 (released Jan 29, 2026, 96 days before disclosure).

    The latest release, 7.261106.0, is not affected.

  • CVE-2026-39980Critical 9.1

    OpenCTI affected by RCE via notifier template

    Affected: fixed in 6.9.5.

    Fixed in 6.9.5 (released Jan 4, 2026, 95 days before disclosure).

    The latest release, 7.261106.0, is not affected.

  • CVE-2026-21886Medium 6.5

    OpenCTI's GraphQL Mutations Allow Deletion of Unrelated Entities

    Affected: fixed in 6.9.1.

    Fixed in 6.9.1 (released Dec 16, 2025, 91 days before disclosure).

    The latest release, 7.261106.0, is not affected.

  • OpenCTI has a Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature

    Affected: fixed in 6.8.16.

    Fixed in 6.8.16 (released Dec 9, 2025, 93 days before disclosure).

    The latest release, 7.261106.0, is not affected.

  • CVE-2020-37044Medium 5.1

    OpenCTI 3.3.1 - Cross Site Scripting

    Affected: through 3.3.1.

    Fixed in 3.3.2 (released Jun 4, 2020, 2066 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 7.261106.0, is not affected.

  • OpenCTI 3.3.1 - Directory Traversal

    Affected: through 3.3.1.

    Fixed in 3.3.2 (released Jun 4, 2020, 2066 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 7.261106.0, is not affected.

  • CVE-2025-61782Medium 5.4

    Open Redirect in OpenCTI's SAML Authentication Flow

    Affected: fixed in 6.8.3.

    Fixed in 6.8.3 (released Oct 6, 2025, 93 days before disclosure).

    The latest release, 7.261106.0, is not affected.

  • GraphQL IDOR allows authenticated user to delete workspace content of other users

    Affected: fixed in 6.8.1.

    Fixed in 6.8.1 (released Sep 30, 2025, 97 days before disclosure).

    The latest release, 7.261106.0, is not affected.

  • CVE-2025-46732Medium 5.4

    OpenCTI's GraphQL IDOR enables authenticated users to modify or delete notifications of other users

    Affected: fixed in 6.6.6.

    Fixed in 6.6.6 (released Apr 18, 2025, 91 days before disclosure).

    The latest release, 7.261106.0, is not affected.

  • OpenCTI vulnerable to Denial of Service through web hook

    Affected: fixed in 6.5.2.

    Fixed in 6.5.2 (released Feb 17, 2025, 91 days before disclosure).

    The latest release, 7.261106.0, is not affected.

  • CVE-2025-24977Critical 9.1

    OpenCTI has remote code execution and sensitive secrets exposed through web hook

    Affected: from 6.4.8, fixed in 6.4.11.

    Fixed in 6.4.11 (released Feb 4, 2025, 90 days before disclosure).

    The latest release, 7.261106.0, is not affected.

Show all 22 advisoriesShow fewer advisories
  • CVE-2025-24887Medium 6.3

    OpenCTI bypass of protected attribute update

    Affected: from 6.4.9, fixed in 6.4.11.

    Fixed in 6.4.11 (released Feb 4, 2025, 85 days before disclosure).

    The latest release, 7.261106.0, is not affected.

  • CVE-2024-45805Medium 4.3

    OpenCTI leaks support information due to inadequate access control

    Affected: fixed in 6.3.0.

    Fixed in 6.3.0 (released Sep 17, 2024, 100 days before disclosure).

    The latest release, 7.261106.0, is not affected.

  • OpenCTI's lack of Rate Limit lead to OTP brute forcing

    Affected: fixed in 6.2.18.

    Fixed in 6.2.18 (released Aug 30, 2024, 103 days before disclosure).

    The latest release, 7.261106.0, is not affected.

  • CVE-2024-37155Medium 6.5

    OpenCTI May Bypass Introspection Restriction

    Affected: fixed in 6.1.9.

    Fixed in 6.1.9 (released Jun 6, 2024, 165 days before disclosure).

    The latest release, 7.261106.0, is not affected.

  • OpenCTI Authenticated Privilege Escalation

    Affected: fixed in 5.12.32.

    Fixed in 5.12.32 (released Feb 16, 2024, 97 days before disclosure).

    The latest release, 7.261106.0, is not affected.

  • In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint.

    Affected: fixed in 5.3.0.

    Fixed in 5.3.0 (released May 23, 2022, 43 days before disclosure).

    The latest release, 7.261106.0, is not affected.

  • A stored Cross-site Scripting (XSS) vulnerability was identified in the Data Import functionality of OpenCTI through 5.2.4.

    Affected: fixed in 5.3.0.

    Fixed in 5.3.0 (released May 23, 2022, 43 days before disclosure).

    The latest release, 7.261106.0, is not affected.