TH
Product
TheHive
9
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 1Medium 7Low 0
Watch
Add TheHive to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-39069 | 9.8 | Sep 11 | An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Active Directory authentication mechanism Affected: before 3.5.2; 4.0.0 through 4.1.21; 5.0.0 through 5.0.8 |
| CVE-2017-18376 | 8.8 | Jun 2 | An improper authorization check in the User API in TheHive before 2.13.4 and 3.x before 3.3.1 allows users with read-only or read/write access to escalate their privileges to the… Affected: before 2.13.4; 3.0.0 before 3.3.1 |
| CVE-2025-48738 | 6.9 | May 23 | An e-mail flooding vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1 allows unauthenticated remote… Affected: 5.2.0 before 5.2.16; 5.3.0 before 5.3.11; 5.4.0 before 5.4.10; 5.5.0 before 5.5.1 |
| CVE-2025-48741 | 6.8 | May 23 | A Broken Access Control vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, and 5.4.0 before 5.4.10 allows remote, authenticated, and unprivileged users… Affected: 5.2.0 before 5.2.16; 5.3.0 before 5.3.11; 5.4.0 before 5.4.10 |
| CVE-2025-48740 | 5.9 | May 23 | A Cross-Site Request Forgery (CSRF) vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1 allows a remote… Affected: 5.2.0 before 5.2.16; 5.3.0 before 5.3.11; 5.4.0 before 5.4.10; 5.5.0 before 5.5.1 |
| CVE-2024-22877 | 5.4 | Jan 19 | StrangeBee TheHive 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS) in the case reporting functionality Affected: 5.2.0 through 5.2.8 |
| CVE-2024-22876 | 5.4 | Jan 19 | StrangeBee TheHive 5.1.0 to 5.1.9 and 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS) in the case attachment functionality which enables an attacker to upload a… Affected: 5.1.0 through 5.1.9; 5.2.0 through 5.2.8 |
| CVE-2026-63098 | 5.3 | Jul 17 | TheHive 4.1.24 Unauthenticated Information Disclosure via /api/status Endpoint Affected: through 4.1.24 |
| CVE-2025-48739 | 4.6 | May 23 | A Server-Side Request Forgery (SSRF) vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1 allows remote… Affected: 5.2.0 before 5.2.16; 5.3.0 before 5.3.11; 5.4.0 before 5.4.10; 5.5.0 before 5.5.1 |
Showing 9