CVE-2026-42540: Dfir-Iris Iris-Web

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 allow a user to alter values in the database via manipulated API requests. Version 2.4.28 contains a patch.

Affected products

• Dfir-Iris Iris-Web: before 2.4.28 (fixed in 2.4.28)

Published 2026-06-04. Last modified 2026-07-22.