# pycti (PyPI) vulnerabilities 22 known vulnerabilities (3 critical, 8 high, 9 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 7.261106.0 (Nov 6, 2026): no advisory affects it - Newest unaffected release: 7.261106.0 (Nov 6, 2026), the latest release - Weekly downloads: 78.8K - Dependents: 4 - Releases: 471 since 1.2.1 (Jun 28, 2019) - Registry: https://pypi.org/project/pycti/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-35211: 1.2.1 to 7.260326.0 (7.260401.0 is outside it) - CVE-2026-35210: 1.2.1 to 7.260318.0 (7.260326.0 is outside it) - CVE-2026-35212: 1.2.1 to 7.260224.0 (7.260227.0 is outside it) - CVE-2026-44730: 1.2.1 to 6.9.6 (6.9.7 is outside it) - CVE-2026-27960: 6.9.0 to 6.9.12 (6.9.13 is outside it) - CVE-2026-39980: 1.2.1 to 6.9.4 (6.9.5 is outside it) - CVE-2026-21886: 1.2.1 to 6.9.0 (6.9.1 is outside it) - CVE-2026-21887: 1.2.1 to 6.8.15 (6.8.16 is outside it) - CVE-2020-37044: 1.2.1 to 3.3.1 (3.3.2 is outside it) - CVE-2020-37041: 1.2.1 to 3.3.1 (3.3.2 is outside it) - CVE-2025-61782: 1.2.1 to 6.8.2 (6.8.3 is outside it) - CVE-2025-61781: 1.2.1 to 6.8.0 (6.8.1 is outside it) - CVE-2025-46732: 1.2.1 to 6.6.5 (6.6.6 is outside it) - CVE-2025-26621: 1.2.1 to 6.5.1 (6.5.2 is outside it) - CVE-2025-24977: 6.4.8 to 6.4.10 (6.4.11 is outside it) - CVE-2025-24887: 6.4.9 to 6.4.10 (6.4.11 is outside it) - CVE-2024-45805: 1.2.1 to 6.2.19 (6.3.0 is outside it) - CVE-2024-45404: 1.2.1 to 6.2.17 (6.2.18 is outside it) - CVE-2024-37155: 1.2.1 to 6.1.8 (6.1.9 is outside it) - CVE-2024-26139: 1.2.1 to 5.12.31 (5.12.32 is outside it) - CVE-2022-30290: 1.2.1 to 5.2.4 (5.3.0 is outside it) - CVE-2022-30289: 1.2.1 to 5.2.4 (5.3.0 is outside it) ## Advisories (22) ### [CVE-2026-35211](https://cve.now/CVE-2026-35211): OpenCTI: Elasticsearch Painless Script Injection via GraphQL \`script\` filter operator allows authenticated user to exfiltrate data and… - Severity: Medium 6.5 - Published: Jul 8, 2026 - Affected: fixed in 7.260401.0. - Fixed in 7.260401.0 (released Apr 1, 2026, 98 days before disclosure). - The latest release, 7.261106.0, is not affected. ### [CVE-2026-35210](https://cve.now/CVE-2026-35210): OpenCTI: Authorization Bypass via \`synchronized-upsert\` HTTP Header Injection - Severity: High 7.1 - Published: Jul 8, 2026 - Affected: fixed in 7.260326.0. - Fixed in 7.260326.0 (released Mar 26, 2026, 104 days before disclosure). - The latest release, 7.261106.0, is not affected. ### [CVE-2026-35212](https://cve.now/CVE-2026-35212): OpenCTI has XSS in the rendering of email-message observable body data - Severity: Medium 5.3 - Published: Jun 2, 2026 - Affected: fixed in 7.260227.0. - Fixed in 7.260227.0 (released Feb 27, 2026, 95 days before disclosure). - The latest release, 7.261106.0, is not affected. ### [CVE-2026-44730](https://cve.now/CVE-2026-44730): OpenCTI: Privilege escalation via graphQL API abusable by organization admins, due to incorrect ACL on userEdit relationAdd - Severity: High 7.2 - Published: May 26, 2026 - Affected: fixed in 6.9.7. - Fixed in 6.9.7 (released Jan 12, 2026, 134 days before disclosure). - The latest release, 7.261106.0, is not affected. ### [CVE-2026-27960](https://cve.now/CVE-2026-27960): OpenCTI privilege escalation and unauthenticated access via default admin account - Severity: Critical 9.8 - Published: May 5, 2026 - Affected: from 6.9.0, fixed in 6.9.13. - Fixed in 6.9.13 (released Jan 29, 2026, 96 days before disclosure). - The latest release, 7.261106.0, is not affected. ### [CVE-2026-39980](https://cve.now/CVE-2026-39980): OpenCTI affected by RCE via notifier template - Severity: Critical 9.1 - Published: Apr 9, 2026 - Affected: fixed in 6.9.5. - Fixed in 6.9.5 (released Jan 4, 2026, 95 days before disclosure). - The latest release, 7.261106.0, is not affected. ### [CVE-2026-21886](https://cve.now/CVE-2026-21886): OpenCTI's GraphQL Mutations Allow Deletion of Unrelated Entities - Severity: Medium 6.5 - Published: Mar 17, 2026 - Affected: fixed in 6.9.1. - Fixed in 6.9.1 (released Dec 16, 2025, 91 days before disclosure). - The latest release, 7.261106.0, is not affected. ### [CVE-2026-21887](https://cve.now/CVE-2026-21887): OpenCTI has a Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature - Severity: High 7.7 - Published: Mar 12, 2026 - Affected: fixed in 6.8.16. - Fixed in 6.8.16 (released Dec 9, 2025, 93 days before disclosure). - The latest release, 7.261106.0, is not affected. ### [CVE-2020-37044](https://cve.now/CVE-2020-37044): OpenCTI 3.3.1 - Cross Site Scripting - Severity: Medium 5.1 - Published: Jan 30, 2026 - Affected: through 3.3.1. - Fixed in 3.3.2 (released Jun 4, 2020, 2066 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 7.261106.0, is not affected. ### [CVE-2020-37041](https://cve.now/CVE-2020-37041): OpenCTI 3.3.1 - Directory Traversal - Severity: High 7.1 - Published: Jan 30, 2026 - Affected: through 3.3.1. - Fixed in 3.3.2 (released Jun 4, 2020, 2066 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 7.261106.0, is not affected. ### [CVE-2025-61782](https://cve.now/CVE-2025-61782): Open Redirect in OpenCTI's SAML Authentication Flow - Severity: Medium 5.4 - Published: Jan 7, 2026 - Affected: fixed in 6.8.3. - Fixed in 6.8.3 (released Oct 6, 2025, 93 days before disclosure). - The latest release, 7.261106.0, is not affected. ### [CVE-2025-61781](https://cve.now/CVE-2025-61781): GraphQL IDOR allows authenticated user to delete workspace content of other users - Severity: High 7.1 - Published: Jan 5, 2026 - Affected: fixed in 6.8.1. - Fixed in 6.8.1 (released Sep 30, 2025, 97 days before disclosure). - The latest release, 7.261106.0, is not affected. ### [CVE-2025-46732](https://cve.now/CVE-2025-46732): OpenCTI's GraphQL IDOR enables authenticated users to modify or delete notifications of other users - Severity: Medium 5.4 - Published: Jul 18, 2025 - Affected: fixed in 6.6.6. - Fixed in 6.6.6 (released Apr 18, 2025, 91 days before disclosure). - The latest release, 7.261106.0, is not affected. ### [CVE-2025-26621](https://cve.now/CVE-2025-26621): OpenCTI vulnerable to Denial of Service through web hook - Severity: High 7.6 - Published: May 19, 2025 - Affected: fixed in 6.5.2. - Fixed in 6.5.2 (released Feb 17, 2025, 91 days before disclosure). - The latest release, 7.261106.0, is not affected. ### [CVE-2025-24977](https://cve.now/CVE-2025-24977): OpenCTI has remote code execution and sensitive secrets exposed through web hook - Severity: Critical 9.1 - Published: May 5, 2025 - Affected: from 6.4.8, fixed in 6.4.11. - Fixed in 6.4.11 (released Feb 4, 2025, 90 days before disclosure). - The latest release, 7.261106.0, is not affected. ### [CVE-2025-24887](https://cve.now/CVE-2025-24887): OpenCTI bypass of protected attribute update - Severity: Medium 6.3 - Published: Apr 30, 2025 - Affected: from 6.4.9, fixed in 6.4.11. - Fixed in 6.4.11 (released Feb 4, 2025, 85 days before disclosure). - The latest release, 7.261106.0, is not affected. ### [CVE-2024-45805](https://cve.now/CVE-2024-45805): OpenCTI leaks support information due to inadequate access control - Severity: Medium 4.3 - Published: Dec 26, 2024 - Affected: fixed in 6.3.0. - Fixed in 6.3.0 (released Sep 17, 2024, 100 days before disclosure). - The latest release, 7.261106.0, is not affected. ### [CVE-2024-45404](https://cve.now/CVE-2024-45404): OpenCTI's lack of Rate Limit lead to OTP brute forcing - Severity: High 8.1 - Published: Dec 11, 2024 - Affected: fixed in 6.2.18. - Fixed in 6.2.18 (released Aug 30, 2024, 103 days before disclosure). - The latest release, 7.261106.0, is not affected. ### [CVE-2024-37155](https://cve.now/CVE-2024-37155): OpenCTI May Bypass Introspection Restriction - Severity: Medium 6.5 - Published: Nov 18, 2024 - Affected: fixed in 6.1.9. - Fixed in 6.1.9 (released Jun 6, 2024, 165 days before disclosure). - The latest release, 7.261106.0, is not affected. ### [CVE-2024-26139](https://cve.now/CVE-2024-26139): OpenCTI Authenticated Privilege Escalation - Severity: High 8.3 - Published: May 23, 2024 - Affected: fixed in 5.12.32. - Fixed in 5.12.32 (released Feb 16, 2024, 97 days before disclosure). - The latest release, 7.261106.0, is not affected. ### [CVE-2022-30290](https://cve.now/CVE-2022-30290): In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint. - Severity: Unrated - Published: Jul 5, 2022 - Affected: fixed in 5.3.0. - Fixed in 5.3.0 (released May 23, 2022, 43 days before disclosure). - The latest release, 7.261106.0, is not affected. ### [CVE-2022-30289](https://cve.now/CVE-2022-30289): A stored Cross-site Scripting (XSS) vulnerability was identified in the Data Import functionality of OpenCTI through 5.2.4. - Severity: Unrated - Published: Jul 5, 2022 - Affected: fixed in 5.3.0. - Fixed in 5.3.0 (released May 23, 2022, 43 days before disclosure). - The latest release, 7.261106.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/pycti Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.