CVE-2026-69079

CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activity_timeline endpoint. The endpoint accepts a user-controlled days query parameter that was not restricted to a reasonable range. A remote, unauthenticated attacker could submit an excessively large value for this parameter, causing the application to retrieve and process activity data over an arbitrarily large period. This could consume excessive database, CPU, or memory resources, delay the processing of concurrent requests, or trigger an internal server error. Repeated requests could further degrade the availability of the CTI-Transmute website. The vulnerability is corrected by clamping the requested timeline range to a minimum of one day and a maximum of 1,095 days.

• CWE-770

• https://github.com/MISP/cti-transmute/commit/321892d26b82c8a5af1e210ee30735abb109fac2

Published

Aug 3, 2026

Last Modified

Aug 3, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6901Untrusted Search Path vulnerability in B&R Industrial Automa…8.4
• CVE-2026-6902A Remote Code Execution vulnerability in P4 (Helix Core) Ser…7.7
• CVE-2026-6903The LabOne Web Server, backing the LabOne User Interface, co…8.7
• CVE-2026-6907An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5…5.3
• CVE-2026-69075FlowIntel is affected by a stored cross-site scripting vulne…6.9
• CVE-2026-69078CTI-Transmute is affected by a server-side request forgery v…8.8
• CVE-2026-69082CTI-Transmute contained a cross-site request forgery vulnera…8.8
• CVE-2026-69083SiYuan versions before v3.7.3 contain SQL injection vulnerab…10
• CVE-2026-69084SiYuan versions <= v3.7.2 expose the /api/search/searchEmbed…10
• CVE-2026-69085SiYuan before v3.7.3 contains a SQL injection vulnerability …10
• CVE-2026-69086SiYuan versions before v3.7.3 fail to validate the avID para…8.3
• CVE-2026-69087The Grav form plugin (getgrav/grav-plugin-form) before 9.1.1…7.1