Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/46950?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/46950?format=api", "purl": "pkg:pypi/pycti@6.6.9", "type": "pypi", "namespace": "", "name": "pycti", "version": "6.6.9", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "7.260227.0", "latest_non_vulnerable_version": "7.260227.0", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37178?format=api", "vulnerability_id": "VCID-5tbh-31ep-6qey", "summary": "OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.1, the GraphQL mutation \"WorkspacePopoverDeletionMutation\" allows users to delete workspace-related objects such as dashboards and investigation cases. However, the mutation lacks proper authorization checks to verify ownership of the targeted resources.\nAn attacker can exploit this by supplying an active UUID of another user. Since the API does not validate whether the requester owns the resource, the mutation executes successfully, resulting in unauthorized deletion of the entire workspace. Version 6.8.1 fixes the issue.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-61781", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00156", "scoring_system": "epss", "scoring_elements": "0.36155", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.00156", "scoring_system": "epss", "scoring_elements": "0.36164", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00156", "scoring_system": "epss", "scoring_elements": "0.36124", "published_at": "2026-06-07T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-61781" }, { "reference_url": "https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-pr6m-q4g7-342c", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H" }, { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-05T19:13:53Z/" } ], "url": "https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-pr6m-q4g7-342c" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/46982?format=api", "purl": "pkg:pypi/pycti@6.8.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-8das-2qvp-kuar" }, { "vulnerability": "VCID-ere8-2ws9-jyac" }, { "vulnerability": "VCID-m7xr-bwh3-wkg1" }, { "vulnerability": "VCID-vb19-z3p4-9yc9" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/pycti@6.8.1" } ], "aliases": [ "CVE-2025-61781", "GHSA-pr6m-q4g7-342c", "PYSEC-2026-116" ], "risk_score": 4.1, "exploitability": "0.5", "weighted_severity": "8.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-5tbh-31ep-6qey" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/310263?format=api", "vulnerability_id": "VCID-8das-2qvp-kuar", "summary": "OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Versions prior to 7.260227.0 are vulnerable to XSS in the rendering of email-message observable body data. The content of the body field isn't appropriately sanitized when being rendered. Does require user interaction but could be exploited by someone sharing stix or any of the ingester. This could lead to CSRF and then large scale session theft. Version 7.260227.0 contains a fix.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-35212", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0003", "scoring_system": "epss", "scoring_elements": "0.0915", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.0003", "scoring_system": "epss", "scoring_elements": "0.09131", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.00047", "scoring_system": "epss", "scoring_elements": "0.15042", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-35212" }, { "reference_url": "https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-rg6r-x26x-63vq", "reference_id": "GHSA-rg6r-x26x-63vq", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-06-03T14:22:56Z/" } ], "url": "https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-rg6r-x26x-63vq" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1076552?format=api", "purl": "pkg:pypi/pycti@7.260227.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/pycti@7.260227.0" } ], "aliases": [ "CVE-2026-35212", "GHSA-rg6r-x26x-63vq", "PYSEC-2026-203" ], "risk_score": 2.8, "exploitability": "0.5", "weighted_severity": "5.5", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-8das-2qvp-kuar" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37235?format=api", "vulnerability_id": "VCID-ere8-2ws9-jyac", "summary": "OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.8.16, the OpenCTI platform’s data ingestion feature accepts user-supplied URLs without validation and uses the Axios HTTP client with its default configuration (allowAbsoluteUrls: true). This allows attackers to craft requests to arbitrary endpoints, including internal services, because Axios will accept and process absolute URLs. This results in a semi-blind SSRF, as responses may not be fully visible but can still impact internal systems. This vulnerability is fixed in 6.8.16.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-21887", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00044", "scoring_system": "epss", "scoring_elements": "0.14064", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.00044", "scoring_system": "epss", "scoring_elements": "0.14065", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00044", "scoring_system": "epss", "scoring_elements": "0.14029", "published_at": "2026-06-07T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-21887" }, { "reference_url": "https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-ffm6-vvph-g5f5", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-12T17:51:53Z/" } ], "url": "https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-ffm6-vvph-g5f5" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/48746?format=api", "purl": "pkg:pypi/pycti@6.8.16", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-8das-2qvp-kuar" }, { "vulnerability": "VCID-m7xr-bwh3-wkg1" }, { "vulnerability": "VCID-vb19-z3p4-9yc9" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/pycti@6.8.16" } ], "aliases": [ "CVE-2026-21887", "GHSA-ffm6-vvph-g5f5", "PYSEC-2026-118" ], "risk_score": 3.5, "exploitability": "0.5", "weighted_severity": "6.9", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ere8-2ws9-jyac" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37243?format=api", "vulnerability_id": "VCID-m7xr-bwh3-wkg1", "summary": "OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mutations \"IndividualDeletionDeleteMutation\" is intended to allow users to delete individual entity objects respectively. However, it was observed that this mutation can be misused to delete unrelated and sensitive objects such as analyses reports etc. This behavior stems from the lack of validation in the API to ensure that the targeted object is contextually related to the mutation being executed. Version 6.9.1 fixes the issue.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-21886", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00164", "scoring_system": "epss", "scoring_elements": "0.37143", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.00164", "scoring_system": "epss", "scoring_elements": "0.3715", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00164", "scoring_system": "epss", "scoring_elements": "0.37118", "published_at": "2026-06-07T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-21886" }, { "reference_url": "https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-mhmx-j75v-2m6x", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-17T16:09:27Z/" } ], "url": "https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-mhmx-j75v-2m6x" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/48817?format=api", "purl": "pkg:pypi/pycti@6.9.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-8das-2qvp-kuar" }, { "vulnerability": "VCID-nqfe-un38-ufgb" }, { "vulnerability": "VCID-vb19-z3p4-9yc9" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/pycti@6.9.1" } ], "aliases": [ "CVE-2026-21886", "GHSA-mhmx-j75v-2m6x", "PYSEC-2026-117" ], "risk_score": 3.6, "exploitability": "0.5", "weighted_severity": "7.3", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-m7xr-bwh3-wkg1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37342?format=api", "vulnerability_id": "VCID-vb19-z3p4-9yc9", "summary": "OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.7, an organization admin can escalate their privileges by adding a user from a different organization with higher privileges, to their own organization. This is due to incorrect ACL on userEdit relationAdd. This vulnerability is fixed in 6.9.7.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-44730", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0005", "scoring_system": "epss", "scoring_elements": "0.1593", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.0005", "scoring_system": "epss", "scoring_elements": "0.15972", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.0005", "scoring_system": "epss", "scoring_elements": "0.15983", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-44730" }, { "reference_url": "https://github.com/OpenCTI-Platform/opencti", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/OpenCTI-Platform/opencti" }, { "reference_url": "https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-q537-qhj4-wcjx", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T14:02:23Z/" } ], "url": "https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-q537-qhj4-wcjx" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/pycti/PYSEC-2026-167.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pycti/PYSEC-2026-167.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44730", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44730" }, { "reference_url": "https://github.com/advisories/GHSA-q537-qhj4-wcjx", "reference_id": "GHSA-q537-qhj4-wcjx", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-q537-qhj4-wcjx" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/50026?format=api", "purl": "pkg:pypi/pycti@6.9.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-8das-2qvp-kuar" }, { "vulnerability": "VCID-nqfe-un38-ufgb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/pycti@6.9.7" } ], "aliases": [ "CVE-2026-44730", "GHSA-q537-qhj4-wcjx", "PYSEC-2026-167" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-vb19-z3p4-9yc9" } ], "fixing_vulnerabilities": [], "risk_score": "4.1", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/pycti@6.6.9" }