Cross-Site Request Forgery in the Administrative User Deletion Endpoint

Server-Side Request Forgery and Local File Disclosure in CTI-Transmute Evaluation PDF Rendering

cti-transmute Unauthenticated SSRF via Hostnames Resolving to Internal IP Addresses

Unauthenticated Denial of Service via Unbounded Activity-Timeline Range in CTI-Transmute

cti-transmute Conversion History Authorization Bypass Leads to Sensitive Data Disclosure After Conversion Deletion

cti-transmute CSRF Allows Unauthorized Follow and Notification State Changes

cti-transmute Sunburst and Treemap Tooltips Allow Cross-Site Scripting via Crafted Conversion Data

cti-transmute Missing Authorization Allows Reactions to Private Comments

cti-transmute Evaluation Report Exports Expose Private Comments and Author Information

cti-transmute Following List Exposes User Email Addresses to Authenticated Users

cti-transmute Conversion Table Allows XSS via Unescaped Cell Content During Search Highlighting

cti-transmute Stored XSS via Crafted Tag Icon on Admin Triage Interface

cti-transmute Saved Graph Configuration Allows Stored Cross-Site Scripting via svgIcon

Stored Cross-Site Scripting in CTI-Transmute Conversion Graph via Malicious STIX/MISP Content

Unauthenticated Stored Vue Template Injection Leads to Cross-Site Scripting in CTI-Transmute

cti-transmute Remote MISP Event Browser Allows Cross-Site Scripting via Malicious Event Metadata