Vendors / pivotick Records 8 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 2
Exploited now pivotick records in CISA KEV No pivotick vulnerabilities are listed in CISA KEV.
Priority MEDIUM 47
Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering utilities.
CVSS 4.0 CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.00617 · Published 2026-07-28 · No fix listed CWE-79
Priority LOW 36
Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data.
CVSS 4.0 HIGH 8.2· Network · No auth · User interaction · EPSS 0.00428 · Published 2026-07-28 · No fix listed CWE-400
Priority LOW 36
Pivotick fails to sanitize attacker-controlled SVG markup supplied through the per-node style.svgIcon property before inserting it into the document.
CVSS 4.0 HIGH 8.2· Network · No auth · User interaction · EPSS 0.00444 · Published 2026-07-28 · No fix listed CWE-79
Priority LOW 31
Pivotick contains a cross-site scripting vulnerability in the inspect and edit node modals.
CVSS 4.0 MEDIUM 6.9· Network · No auth · User interaction · EPSS 0.00444 · Published 2026-07-28 · No fix listed CWE-79
Priority LOW 31
Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component.
CVSS 4.0 MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00444 · Published 2026-07-27 · Fixed in 1.4.0 CWE-79
Priority LOW 28
Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpolating it into both the data-node-name attribute and the body of a generated <span> element.
CVSS 4.0 MEDIUM 6.3· Network · No auth · User interaction · EPSS 0.00444 · Published 2026-07-28 · No fix listed CWE-79
Priority LOW 24
Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources.
CVSS 4.0 MEDIUM 5.1· Network · No auth · User interaction · EPSS 0.00441 · Published 2026-07-28 · No fix listed CWE-918
Priority LOW 24
Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-layout and cycle-detection components.
CVSS 4.0 MEDIUM 5.1· Network · No auth · User interaction · EPSS 0.00481 · Published 2026-07-28 · No fix listed CWE-1321
Open these records in search → All records by CVSS severity
1 2 5 0 0
THREATIST.IORead the docs