Vulnerabilities

TI-2026-28398 CVE-2026-39416

Stored XSS in modal item preview for long item content in AIL Framework

LOW 36

AIL framework is an open-source platform to collect, crawl, process and analyse unstructured data.

CVSS 4.0HIGH 8.5 Network High privileges No interaction EPSS 0.00223 Published 2026-04-08 Fixed in 6.8 CWE-79

TI-2025-27744 CVE-2025-42620 · GHSA-r226-j7pf-48g6

CSRF vulnerability in CIRCL Vulnerability-Lookup

LOW 36

In affected versions, vulnerability-lookup handled user-controlled content in comments and bundles in an unsafe way, which could lead to stored Cross-Site Scripting (XSS).

CVSS 4.0HIGH 8.3 Network High privileges User interaction EPSS 0.00293 Published 2025-12-08 Fixed in 2.18.0 CWE-79

TI-2025-27743 CVE-2025-42616 · GHSA-cr8j-9qv8-5jph

CSRF vulnerability in CIRCL Vulnerability-Lookup

LOW 32

Some endpoints in vulnerability-lookup that modified application state (e.g.

CVSS 4.0HIGH 7.0 Network High privileges User interaction EPSS 0.00173 Published 2025-12-08 Fixed in 2.18.0 CWE-352

TI-2025-27742 CVE-2025-42615 · GHSA-w22j-qgr5-cw5m

Improper Restriction of Excessive Authentication Attempts vulnerability in CIRCL Vulnerability-Lookup

LOW 35

In affected versions, vulnerability-lookup did not track or limit failed One-Time Password (OTP) attempts during Two-Factor Authentication (2FA) verification.

CVSS 4.0HIGH 8.1 Network High privileges User interaction EPSS 0.00412 Published 2025-12-08 Fixed in 2.18.0 CWE-307

TI-2025-37615 CVE-2025-60249 · GHSA-9737-qv54-hq49

Cross-site scripting in CIRCL vulnerability-lookup

LOW 28

vulnerability-lookup 2.16.0 allows XSS in bundle.py, comment.py, and user.py, by a user on a vulnerability-lookup instance who can add bundles, comments, or sightings.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00203 Published 2025-09-25 No fix listed CWE-79

TI-2025-23489 CVE-2025-32413 · GHSA-c7r7-h35f-36jp

Vulnerability-Lookup before 2.7.1 allows stored XSS via a user bio in website/web/views/user.py.

LOW 28

Vulnerability-Lookup before 2.7.1 allows stored XSS via a user bio in website/web/views/user.py.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00253 Published 2025-04-08 Fixed in 2.7.1 CWE-79

TI-2023-09040 CVE-2023-22898 · GHSA-m7r3-6mr9-xj8f

workers/extractor.py in Pandora (aka pandora-analysis/pandora) 1.3.0 allows a denial of…

LOW 30

workers/extractor.py in Pandora (aka pandora-analysis/pandora) 1.3.0 allows a denial of service when an attacker submits a deeply nested ZIP archive (aka ZIP bomb).

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0064 Published 2023-01-10 No fix listed CWE-20

TI-2021-20557 CVE-2021-45470 · GHSA-hq5r-m79m-vm9v

lib/DatabaseLayer.py in cve-search before 4.1.0 allows regular expression injection…

LOW 37

lib/DatabaseLayer.py in cve-search before 4.1.0 allows regular expression injection, which can lead to ReDoS (regular expression denial of service) or other impacts.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01936 Published 2021-12-23 No fix listed CWE-1333

TI-2020-06847 CVE-2020-8545 · GHSA-r4pw-7999-5gh4

Global.py in AIL framework 2.8 allows path traversal.

LOW 36

Global.py in AIL framework 2.8 allows path traversal.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01319 Published 2020-02-03 No fix listed CWE-22

Vulnerabilities

Filters