Dfir-Iris Iris-Web
18 CVEs affecting Dfir-Iris Iris-Web. Latest disclosed: 2026-07-30. Critical: 1, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-22783 | Critical | 9.6 | 2026-01-12 | Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to 2.4.24, the DFIR-IRIS datastore fil… |
CVE-2026-18361 | High | 7.6 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload function. |
CVE-2026-18360 | High | 7.6 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function. |
CVE-2026-16969 | High | 7.6 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function. |
CVE-2024-25624 | Medium | 6.8 | 2024-04-25 | Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. Due to an improper setup of Jinja2 env… |
CVE-2026-42539 | Medium | 6.5 | 2026-06-04 | IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 return sensitive da… |
CVE-2026-42538 | Medium | 6.3 | 2026-06-04 | IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 do not properly val… |
CVE-2023-30615 | Medium | 6.3 | 2023-05-25 | Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-Site Scripting (XSS) vu… |
CVE-2026-18362 | Medium | 5.9 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks. |
CVE-2026-16971 | Medium | 5.9 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks. |
CVE-2026-42547 | Medium | 5.4 | 2026-06-04 | IRIS is a web collaborative platform that helps incident responders share technical details during investigations. In versions prior to 2.4.28, users can creat… |
CVE-2026-42329 | Medium | 4.7 | 2026-06-04 | Iris is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 contain a weakness… |
CVE-2024-25640 | Medium | 4.6 | 2024-02-19 | Iris is a web collaborative platform that helps incident responders share technical details during investigations. A stored Cross-Site Scripting (XSS) vulnerab… |
CVE-2023-50712 | Medium | 4.6 | 2023-12-22 | Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-Site Scripting (XSS) vu… |
CVE-2026-42543 | Medium | 4.3 | 2026-06-04 | IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 are vulnerable to a… |
CVE-2026-42540 | Medium | 4.3 | 2026-06-04 | IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 allow a user to alt… |
CVE-2026-16970 | Medium | 4.2 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be mi… |
CVE-2026-41522 | | 2026-06-04 | Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes a… |