rt_for_incident_response vulnerabilities
CVEs whose affected-version data names the rt_for_incident_response package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-105456Medium· 5.3Stored XSS via HTML scrubber rule in RTIR
RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change ap…
▾ SunlitBest Practical Solutions · RT for Incident ResponseEPSS 0.45%via CVEORG
CVE-2026-105455Medium· 5.3Stored XSS via related ticket subject on RTIR Split and Create Incident forms
RTIR's ticket creation forms show the subject of the related ticket when splitting a ticket or creating an incident from a report, and they render that subject without HTML escaping. A ticket subject containing script r…
▾ SunlitBest Practical Solutions · RT for Incident ResponseEPSS 0.41%via CVEORG