Product by Dfir-iris
Iris-web
19 known vulnerabilities in Iris-web (Dfir-iris), 0 of them actively exploited (CISA KEV).
Key figures
19
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-92605 | IRIS through 2.4.29 Unauthorized Comment Access via Object ID | 6.5 | |
| Critical | CVE-2026-22783 | Iris Allows Arbitrary File Deletion via Mass Assignment in Datastore File Management | 9.6 | |
| Medium | CVE-2024-25624 | iris-web vulnerable to Server Side Template Injection in reports | 6.8 | |
| High | CVE-2026-18360 | DFIR-IRIS Stored XSS in Custom Attributes | 7.6 | |
| High | CVE-2026-16969 | DFIR-IRIS Stored XSS in Assets | 7.6 | |
| High | CVE-2026-18361 | DFIR-IRIS Stored XSS in Datastore Upload | 7.6 | |
| Medium | CVE-2026-18362 | DFIR-IRIS Missing Brute Force Protection in User Authentication | 5.9 | |
| Medium | CVE-2026-16971 | DFIR-IRIS Missing Brute Force Protection in OTP Validation | 5.9 | |
| High | CVE-2026-41522 | Iris has an Improper Authorization issue | — | |
| Medium | CVE-2026-42539 | IRIS has an Excessive Data Exposure issue | 6.5 | |
| Medium | CVE-2026-42538 | IRIS has an Insecure File Upload | 6.3 | |
| Medium | CVE-2026-42547 | IRIS Alerts Can be Falsely Attributed to Customers | 5.4 | |
| Medium | CVE-2026-16970 | DFIR-IRIS Insufficient Logout Implementation | 4.2 | |
| Medium | CVE-2023-30615 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in iris-web | 6.3 | |
| Medium | CVE-2026-42329 | Iris has an Open Redirect issue | 4.7 | |
| Medium | CVE-2026-42540 | IRIS has a Mass Assignment issue | 4.3 | |
| Medium | CVE-2026-42543 | IRIS has a Cross-Site Request Forgery (CSRF) issue | 4.3 | |
| Medium | CVE-2024-25640 | Improper Neutralization of Alternate XSS Syntax in iris-web | 4.6 | |
| Medium | CVE-2023-50712 | Improper Neutralization of Alternate XSS Syntax in iris-web | 4.6 |