# pycti (PyPI) vulnerabilities Source: https://junglewise.ai/threats/technologies/pycti Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/pycti.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 22 vulnerabilities in pycti (PyPI): 0 in the last 7 days and 0 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-35211, was published on 8 July 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 22 (1 critical, 0 exploited in the wild) ## About pycti (PyPI) pycti is a Python client library used to interact with the OpenCTI platform API. ## Latest pycti (PyPI) vulnerabilities - [CVE-2026-35211: Filigran OpenCTI Code Injection in GraphQL API](https://junglewise.ai/threats/cve-2026-35211-filigran-opencti-code-injection-in-graphql-api) (medium, CVSS 6.5, published 8 Jul 2026) - [CVE-2026-35210: Filigran OpenCTI authorization bypass via synchronized-upsert header](https://junglewise.ai/threats/cve-2026-35210-filigran-opencti-authorization-bypass-via-synchronized-upsert) (high, CVSS 7.1, published 8 Jul 2026) - [CVE-2026-21887: OpenCTI SSRF in Data Ingestion Feature](https://junglewise.ai/threats/cve-2026-21887-opencti-ssrf-in-data-ingestion-feature) (high, CVSS 7.7, published 22 Jun 2026) - [CVE-2024-37155: OpenCTI GraphQL introspection restriction bypass](https://junglewise.ai/threats/cve-2024-37155-opencti-graphql-introspection-restriction-bypass) (medium, CVSS 6.5, published 22 Jun 2026) - [CVE-2026-35212: OpenCTI XSS in email-message observable body rendering](https://junglewise.ai/threats/cve-2026-35212-opencti-xss-in-email-message-observable-body-rendering) (low, CVSS 3.1, published 2 Jun 2026) - [CVE-2026-44730: OpenCTI privilege escalation in userEdit relationAdd](https://junglewise.ai/threats/cve-2026-44730-opencti-privilege-escalation-in-useredit-relationadd) (high, CVSS 7.2, published 26 May 2026) - [CVE-2026-27960: OpenCTI privilege escalation and authentication bypass in API](https://junglewise.ai/threats/cve-2026-27960-opencti-privilege-escalation-and-authentication-bypass-in-api) (critical, CVSS 9.8, published 5 May 2026) - [CVE-2026-39980: PYSEC-2026-2265 - OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables…](https://junglewise.ai/threats/cve-2026-39980-pysec-2026-2265-opencti-is-an-open-source-platform-for-managing) (low, CVSS 3.1, published 9 Apr 2026) - [CVE-2026-21886: PYSEC-2026-117 - OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables…](https://junglewise.ai/threats/cve-2026-21886-pysec-2026-117-opencti-is-an-open-source-platform-for-managing) (low, CVSS 3.1, published 17 Mar 2026) - [CVE-2020-37044: PYSEC-2026-115 - OpenCTI 3.3.1 is vulnerable to a reflected cross-site scripting (XSS) attack via the /graphql…](https://junglewise.ai/threats/cve-2020-37044-pysec-2026-115-opencti-3-3-1-is-vulnerable-to-a-reflected-cross) (low, CVSS 3.1, published 30 Jan 2026) - [CVE-2020-37041: PYSEC-2026-114 - OpenCTI 3.3.1 is vulnerable to a directory traversal attack via the static/css endpoint. An…](https://junglewise.ai/threats/cve-2020-37041-pysec-2026-114-opencti-3-3-1-is-vulnerable-to-a-directory) (low, CVSS 3.1, published 30 Jan 2026) - [CVE-2025-61782: OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version…](https://junglewise.ai/threats/cve-2025-61782-pysec-2026-2264-opencti-is-an-open-source-platform-for-managing) (medium, CVSS 5.4, published 7 Jan 2026) - [CVE-2025-61781: OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version…](https://junglewise.ai/threats/cve-2025-61781-pysec-2026-116-opencti-is-an-open-source-platform-for-managing) (high, CVSS 7.1, published 5 Jan 2026) - [CVE-2025-46732: PYSEC-2025-181 - OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables…](https://junglewise.ai/threats/cve-2025-46732-pysec-2025-181-opencti-is-an-open-source-platform-for-managing) (low, CVSS 3.1, published 18 Jul 2025) - [CVE-2025-26621: PYSEC-2025-180 - OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables…](https://junglewise.ai/threats/cve-2025-26621-pysec-2025-180-opencti-is-an-open-source-platform-for-managing) (low, CVSS 3.1, published 19 May 2025) - [CVE-2025-24977: PYSEC-2025-179 - OpenCTI is an open cyber threat intelligence (CTI) platform. Prior to version 6.4.11 any user with…](https://junglewise.ai/threats/cve-2025-24977-pysec-2025-179-opencti-is-an-open-cyber-threat-intelligence-cti) (low, CVSS 3.1, published 5 May 2025) - [CVE-2025-24887: PYSEC-2025-178 - OpenCTI is an open-source cyber threat intelligence platform. In versions starting from 6.4.8 to…](https://junglewise.ai/threats/cve-2025-24887-pysec-2025-178-opencti-is-an-open-source-cyber-threat) (low, CVSS 3.1, published 30 Apr 2025) - [CVE-2024-45805: PYSEC-2024-298 - OpenCTI is an open-source cyber threat intelligence platform. Before 6.3.0, general users can access…](https://junglewise.ai/threats/cve-2024-45805-pysec-2024-298-opencti-is-an-open-source-cyber-threat) (low, CVSS 3.1, published 26 Dec 2024) - [CVE-2024-45404: PYSEC-2024-297 - OpenCTI is an open-source cyber threat intelligence platform. In versions below 6.2.18, because the…](https://junglewise.ai/threats/cve-2024-45404-pysec-2024-297-opencti-is-an-open-source-cyber-threat) (low, CVSS 3.1, published 12 Dec 2024) - [CVE-2024-26139: PYSEC-2024-296 - OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence…](https://junglewise.ai/threats/cve-2024-26139-pysec-2024-296-opencti-is-an-open-source-platform-allowing) (low, CVSS 3.1, published 23 May 2024) - [CVE-2022-30290: PYSEC-2022-43186 - In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile…](https://junglewise.ai/threats/cve-2022-30290-pysec-2022-43186-in-opencti-through-5-2-4-a-broken-access-control) (low, CVSS 3.1, published 5 Jul 2022) - [CVE-2022-30289: PYSEC-2022-43185 - A stored Cross-site Scripting (XSS) vulnerability was identified in the Data Import functionality…](https://junglewise.ai/threats/cve-2022-30289-pysec-2022-43185-a-stored-cross-site-scripting-xss-vulnerability) (low, CVSS 3.1, published 5 Jul 2022) ## Most severe pycti (PyPI) vulnerabilities - [CVE-2026-27960: OpenCTI privilege escalation and authentication bypass in API](https://junglewise.ai/threats/cve-2026-27960-opencti-privilege-escalation-and-authentication-bypass-in-api) (critical, CVSS 9.8, published 5 May 2026) - [CVE-2026-21887: OpenCTI SSRF in Data Ingestion Feature](https://junglewise.ai/threats/cve-2026-21887-opencti-ssrf-in-data-ingestion-feature) (high, CVSS 7.7, published 22 Jun 2026) - [CVE-2026-44730: OpenCTI privilege escalation in userEdit relationAdd](https://junglewise.ai/threats/cve-2026-44730-opencti-privilege-escalation-in-useredit-relationadd) (high, CVSS 7.2, published 26 May 2026) - [CVE-2026-35210: Filigran OpenCTI authorization bypass via synchronized-upsert header](https://junglewise.ai/threats/cve-2026-35210-filigran-opencti-authorization-bypass-via-synchronized-upsert) (high, CVSS 7.1, published 8 Jul 2026) - [CVE-2025-61781: OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version…](https://junglewise.ai/threats/cve-2025-61781-pysec-2026-116-opencti-is-an-open-source-platform-for-managing) (high, CVSS 7.1, published 5 Jan 2026) - [CVE-2026-35211: Filigran OpenCTI Code Injection in GraphQL API](https://junglewise.ai/threats/cve-2026-35211-filigran-opencti-code-injection-in-graphql-api) (medium, CVSS 6.5, published 8 Jul 2026) - [CVE-2024-37155: OpenCTI GraphQL introspection restriction bypass](https://junglewise.ai/threats/cve-2024-37155-opencti-graphql-introspection-restriction-bypass) (medium, CVSS 6.5, published 22 Jun 2026) - [CVE-2025-61782: OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version…](https://junglewise.ai/threats/cve-2025-61782-pysec-2026-2264-opencti-is-an-open-source-platform-for-managing) (medium, CVSS 5.4, published 7 Jan 2026) - [CVE-2020-37041: PYSEC-2026-114 - OpenCTI 3.3.1 is vulnerable to a directory traversal attack via the static/css endpoint. An…](https://junglewise.ai/threats/cve-2020-37041-pysec-2026-114-opencti-3-3-1-is-vulnerable-to-a-directory) (low, CVSS 3.1, published 30 Jan 2026) - [CVE-2022-30290: PYSEC-2022-43186 - In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile…](https://junglewise.ai/threats/cve-2022-30290-pysec-2022-43186-in-opencti-through-5-2-4-a-broken-access-control) (low, CVSS 3.1, published 5 Jul 2022) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other PyPI technologies - [tensorflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-tensorflow): 435 vulnerabilities - [tensorflow-cpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-cpu): 430 vulnerabilities - [tensorflow-gpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-gpu): 427 vulnerabilities - [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui): 177 vulnerabilities - [Django (PyPI)](https://junglewise.ai/threats/technologies/django): 173 vulnerabilities - [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow): 159 vulnerabilities - [pillow (PyPI)](https://junglewise.ai/threats/technologies/pillow): 125 vulnerabilities - [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai): 120 vulnerabilities - [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm): 117 vulnerabilities - [plone (PyPI)](https://junglewise.ai/threats/technologies/pypi-plone): 101 vulnerabilities - [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow): 88 vulnerabilities - [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan): 86 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "pycti (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/pycti, 13 November 2026.