Vulnerabilities

TI-2026-19722 CVE-2026-24467

OpenAEV's Improper Password Reset Token Management Leads to Unauthenticated Account Takeover and Platform Compromise

HIGH 76

OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.009 Published 2026-04-20 Fixed in 2.0.13 CWE-640

TI-2020-19179 CVE-2020-37044 · GHSA-f8vp-6qv4-w6c7

MEDIUM 56

OpenCTI 3.3.1 is vulnerable to a reflected cross-site scripting (XSS) attack via the /graphql endpoint.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00393 Published 2026-01-30 No fix listed CWE-79

TI-2020-19176 CVE-2020-37041 · GHSA-wvqh-8vgx-x89q

MEDIUM 64

OpenCTI 3.3.1 is vulnerable to a directory traversal attack via the static/css endpoint.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.01088 Published 2026-01-30 No fix listed CWE-22