SBA Research is a research center for Information Security funded partly by the national initiative for COMET Competence Centers for Excellent Technologies.
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets (CVE-2026-16969), custom attributes (CVE-2026-18360) and datastore upload (CVE-2026-18361) functions. Read More
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation (CVE-2026-16971) and user authentication (CVE-2026-18362) against brute-force attacks. Read More
The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time. Read More
The genucenter web interface before version 8.0p11 unnecessarily exposes sensitive SNMP authentication and encryption keys in its HTTP responses to users with the “Service” or “Admin” role. This exposure allows potential unauthorized access to network devices. Read More
SWUpdate before 2026.05 is affected by a time-of-check time-of-use (TOCTOU) race condition that allows local unprivileged attackers to escalate privileges to root or install untrusted contents using a signed update. Read More
Users can create alerts for customers that are not assigned to them. This can be abused to falsely attribute fake alerts to customers. In combination with Cross-Site Scripting, this can also be used to exfiltrate alerts from other customers. Read More
The IRIS web application is vulnerable to a Cross-site request forgery attack, because it uses the HTTP method GET to change state on the server. Read More
The IRIS web application does not properly validate uploaded files. It can therefore be misused to host phishing pages, amongst other things. This also creates an instance of a Cross-Site Scripting (XSS) vulnerability. Read More
A new paper, “Systematization of Knowledge: The Design Space of Digital Payment Systems with Potential for CBD,” led by first author Judith Senn, research assistant at the University of Innsbruck, and co-authored by Aljosha Judmayer, researcher at the University of Vienna, Nicholas Stifter, researcher at SBA Research, ... ∞
Last week, our annual event for partners and friends of SBA Research, IMPACT, brought together experts, practitioners, and decision-makers from research, industry, and the open-source community. The afternoon provided an opportunity to discuss the latest developments in security, AI, and innovation, celebrate our long-standing relationships, and mark 20 years of SBA Research’s contributions to cutting-edge cybersecurity and trustworthy digital innovation. ∞
A group of dedicated young researchers presented their work at the 22st ICT Security Conference on 16 and 17 September 2026, which was organized by the Austrian Armed Forces. ∞