Thehive-project

    Dashboard / Vendors

    Products: 3
    Vulnerabilities: 4
    Known Exploited: 0
    0
    Critical Level Threats
    2
    High Level Threats
    2
    Medium Level Threats
    0
    Low Level Threats

    Vulnerabilities

    100806040200
    JanFebMarAprMayJunJulAugSepOctNovDec
    Critical Level Threats
    High Level Threats
    Medium Level Threats
    Low Level Threats

    Products Security index

    Actions
    Items Per Page

    Vulnerabilities

    CVE-2026-63099

    TheHive 4.1.24 Broken Object Level Authorization via Attachment Download Endpoints

    Last Modified: Jul 28, 2026
    Published: Jul 17, 2026

    CVE-2026-63098

    TheHive 4.1.24 Unauthenticated Information Disclosure via /api/status Endpoint

    Last Modified: Jul 28, 2026
    Published: Jul 17, 2026

    CVE-2019-7652

    TheHive Project UnshortenLink analyzer before 1.1, included in Cortex-Analyzers before 1.15.2, has SSRF. To exploit the vulnerability, an attacker must create a new analysis, select URL for Data Type, and provide an SSRF payload like "http://127.0.0.1:22" in the Data parameter. The result can be seen in the main dashboard. Thus, it is possible to do port scans on localhost and intranet hosts.

    Last Modified: Nov 21, 2024
    Published: May 09, 2019

    CVE-2018-20226

    An organization administrator can add a super administrator in THEHIVE PROJECT Cortex before 2.1.3 due to the lack of overriding the Role.toString method.

    Last Modified: Nov 21, 2024
    Published: Dec 21, 2018
    Items Per Page