dfir-iris iris-web

Name: dfir-iris iris-web
Brand: dfir-iris

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

EPSS ≥ 10%

critical

by severity

0critical1high4medium0low

updated 2026-10-28

vulnerabilities (18)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2024-25624US	medium6.8	0.85% (58th)	—	no fix	2024-04-25	2 versions
CVE-2023-30615US	medium5.4	0.38% (32nd)	—	no fix	2023-05-25	≤ < 2.2.1
CVE-2026-18362US	—	0.37% (31st)	—	no fix	2026-07-30	≤ 2.4.26
CVE-2026-22783US	high8.1	0.36% (29th)	—	no fix	2026-01-12	≤ < 2.4.24
CVE-2024-25640US	medium5.4	0.34% (27th)	—	no fix	2024-02-19	2 versions
CVE-2026-16971US	—	0.33% (26th)	—	no fix	2026-07-30	≤ 2.4.26
CVE-2023-50712US	medium5.4	0.30% (22nd)	—	no fix	2023-12-22	≤ < 2.3.7
CVE-2026-18360US	—	0.28% (21st)	—	no fix	2026-07-30	≤ 2.4.26
CVE-2026-41522US	—	0.25% (16th)	—	no fix	2026-06-04	≤ < 2.4.28
CVE-2026-42539US	—	0.23% (14th)	—	no fix	2026-06-04	≤ < 2.4.28
CVE-2026-16970US	—	0.22% (12th)	—	no fix	2026-07-30	≤ 2.4.26
CVE-2026-18361US	—	0.21% (11th)	—	no fix	2026-07-30	≤ 2.4.26
CVE-2026-16969US	—	0.21% (11th)	—	no fix	2026-07-30	≤ 2.4.26
CVE-2026-42540US	—	0.18% (8th)	—	no fix	2026-06-04	≤ < 2.4.28
CVE-2026-42538US	—	0.18% (7th)	—	no fix	2026-06-04	≤ < 2.4.28
CVE-2026-42547US	—OT elevated	0.17% (7th)	—	no fix	2026-06-04	≤ < 2.4.28
CVE-2026-42543US	—	0.17% (7th)	—	no fix	2026-06-04	≤ < 2.4.28
CVE-2026-42329US	—	0.17% (7th)	—	no fix	2026-06-04	≤ < 2.4.28

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6 CVEs
CWE-434Unrestricted Upload of File with Dangerous Type2 CVEs
CWE-770Allocation of Resources Without Limits or Throttling2 CVEs
CWE-87Improper Neutralization of Alternate XSS Syntax2 CVEs
CWE-915Improperly Controlled Modification of Dynamically-Determined Object Attributes2 CVEs
CWE-1336Improper Neutralization of Special Elements Used in a Template Engine1 CVEs
CWE-201Insertion of Sensitive Information Into Sent Data1 CVEs
CWE-285Improper Authorization1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.