Vulnerabilities

TI-2026-60085 CVE-2026-88069 · GHSA-g437-q4fp-pq2g

Path traversal in pandora-analysis pandora

MEDIUM 47

Pandora contains a path traversal vulnerability in its archive extraction worker.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00496 Published 2026-09-09 No fix listed CWE-22

TI-2026-52885 CVE-2026-75531

LOW 31

Pandora contains a stored cross-site scripting (XSS) vulnerability in the rendering of URL observables.

CVSS 4.0HIGH 7.0 Network No auth User interaction EPSS 0.00436 Published 2026-08-17 No fix listed CWE-79

TI-2026-52884 CVE-2026-75529

LOW 37

Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00444 Published 2026-08-17 No fix listed CWE-79

TI-2026-52541 CVE-2026-74767 · GHSA-6vpw-p5cx-8hg6

MEDIUM 44

Pandora contains a denial-of-service vulnerability in its handling of DAA (Direct Access Archive) files.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00428 Published 2026-08-15 No fix listed CWE-434

TI-2026-52538 CVE-2026-74764 · GHSA-47rx-4cw9-crm9

MEDIUM 50

Pandora contains a path traversal vulnerability in its TAR archive extraction functionality.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00606 Published 2026-08-15 No fix listed CWE-22