CVE-2026-69079

CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activity_timeline endpoint. The endpoint accepts a user-controlled days query parameter that was not restricted to a reasonable range. A remote, unauthenticated attacker could submit an excessively large value for this parameter, causing the application to retrieve and process activity data over an arbitrarily large period. This could consume excessive database, CPU, or memory resources, delay the processing of concurrent requests, or trigger an internal server error. Repeated requests could further degrade the availability of the CTI-Transmute website. The vulnerability is corrected by clamping the requested timeline range to a minimum of one day and a maximum of 1,095 days.

• CWE-770

• https://github.com/MISP/cti-transmute/commit/321892d26b82c8a5af1e210ee30735abb109fac2

Published

Aug 3, 2026

Last Modified

Oct 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-69068Insufficient length validation in the GNSS firmware loader m…9.1
• CVE-2026-6907An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5…5.3
• CVE-2026-69075FlowIntel is affected by a stored cross-site scripting vulne…6.9
• CVE-2026-69076Exposure of Job Discard to an Unauthorized Actor vulnerabili…7.5
• CVE-2026-69077Exposure of unauthorized cross-project job manipulation vuln…7.5
• CVE-2026-69078CTI-Transmute is affected by a server-side request forgery v…8.8
• CVE-2026-69080Exposure of SQL Black List to an Unauthorized Actor vulnerab…7.5
• CVE-2026-69082CTI-Transmute contained a cross-site request forgery vulnera…8.8
• CVE-2026-69083SiYuan versions before v3.7.3 contain SQL injection vulnerab…10
• CVE-2026-69084SiYuan versions <= v3.7.2 expose the /api/search/searchEmbed…10
• CVE-2026-69085SiYuan before v3.7.3 contains a SQL injection vulnerability …10
• CVE-2026-69086SiYuan versions before v3.7.3 fail to validate the avID para…7.7