Cyber threat intelligence knowledge platform
Platform by Filigran to structure, store and visualise threat intelligence as a STIX 2.1 knowledge graph, with many connectors.
OpenCTI models threat intelligence with the STIX 2.1 standard: threat actors, campaigns, malware, indicators, vulnerabilities and the relationships between them. Analysts can explore the graph, write reports and link observations to the MITRE ATT&CK framework.
A large catalogue of connectors imports data from feeds and tools (including MISP) and enriches or exports it. OpenCTI is developed by Filigran with an open-source Community Edition and a commercial Enterprise Edition.
Apache-2.0 · Apache License 2.0 (Community Edition) · Open source
Open core: the Community Edition is Apache-2.0; files marked as Enterprise Edition are under the OpenCTI Enterprise Edition License.
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: NOASSERTION.
33 published advisories for OpenCTI in GitHub repository advisories; the 12 most recent are listed. Keep the tool updated: security tools often run with broad access.
GHSA-3h55-hq8v-989mCVE-2026-104253medium2026-10-19
Profile page reflects MFA secret in response
GHSA-2j49-g9h3-75hpCVE-2026-63477high2026-10-02
Organization administrator can escalate to global administrator via unvalidated `grantable_groups` write (incomplete fix of CVE-2026-44730)
GHSA-mwfc-578p-fcccCVE-2026-76823high2026-09-30
Elasticsearch credentials disclosed to connector tokens through logsWorkerConfig
GHSA-2872-rg44-j9gxcritical2026-09-24
EJS template verifier bypass in safeEjs leads to authenticated RCE
GHSA-w45v-76pj-xggmCVE-2026-76822medium2026-09-23
Authorisation vulnerability in case creation
GHSA-f6pj-3m32-q934CVE-2026-76820high2026-09-07
Synchronizer SSRF: stream fetch has no URL validation
GHSA-j2p5-vc4m-xxhxmedium2026-09-07
Privilege escalation: read-only KNOWLEDGE user can delete other users' draft workspaces via draftWorkspaceDelete
GHSA-64j3-qwjh-m4h4critical2026-09-07
Authenticated RCE: safeEjs template sandbox escape via object shorthand
GHSA-w3h6-4frq-fgm7high2026-09-07
SSRF via response-controlled pagination URL in JSON ingestion feature
GHSA-gmv2-pc7f-c2qhhigh2026-09-07
SSRF via ingestionJsonTester or ingestionCsvTester GraphQL Mutation
GHSA-7g3x-wc2m-9h9xCVE-2026-76821high2026-08-26
User-Controlled ReDoS in JSON Ingestion Mapper
GHSA-6crf-vqpj-hvr4high2026-08-26
Unauthenticated resource exhaustion via pre-auth body parsing in TAXII push endpoint
Sources: GitHub repository advisories · checked 2026-10-20.
Threat intelligence sharing platform
Open-source platform to store, correlate and share indicators and threat information within and between organisations and communities.
OSINT automation for footprinting
OSINT automation tool with a web UI and more than 200 modules that gather data on IPs, domains, emails, names and more from public sources.
Pattern matching for malware research
Tool and rule language from VirusTotal to identify and classify malware samples using textual and binary patterns plus conditions.
