Loading vulnerability…
CVE-2026-72751 is a stored cross-site scripting vulnerability in CTI-Transmute’s conversion graph and associated raw JSON viewer affecting versions 1.4 and earlier. Attacker-controlled values derived from converted MISP or STIX content were propagated to multiple HTML-parsing sinks in the graph interface without sufficient output neutralization. Affected data paths included node labels, node sublabels, edge labels, node properties, edge properties, hash algorithm names, child attributes, and STIX object types. The Pivotick graph library rendered some of these values through HTML-resolving code paths, causing crafted markup to be interpreted as HTML rather than displayed as text. Additional exposure existed in the raw JSON viewer, where a graph node’s raw object was inserted into a new document using document.write() with interpolated HTML, allowing crafted JSON content to break out of the intended preformatted block and inject executable markup. A later patch also addressed graph properties panel vectors reachable when a node is hovered over or selected.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.