The daily firehose — everything the toolchain shipped today, already filtered.
We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.
READ AS
Focus:What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out:Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus:New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out:Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus:Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out:Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus:API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out:Governance, SOC operations, and vendor launches with no developer surface.
AMOUNT
DETAIL
ORDER
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
What stands out across today's releases, grouped by what it lets you do. Every tool named links to its entry below.
Three unrelated things stand out today. Jamf Pro now patches non-App Store Mac apps straight from the vendor, retiring the repackage-and-reupload treadmill. BloodHound adds synthetic privilege-zone nodes so tiering shows up in the graph itself, not in a side spreadsheet. JumpCloud and Sophos Central both start treating AI agents and other non-human identitiesnon-human identitiesA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. as inventory you can see and manage.
protect
Keep third-party Mac apps current without repackaging each release
The new App Lifecycle Management Engine declares an app and lets the vendor's own distribution drive install and update, so admins stop rebuilding a PKG and re-uploading every time a Chrome or Zoom version ships. Third-party app patch lag is where most endpoint exposure actually lives, and this is the manual step that caused it.
See the AI agents and service identities someone created in your tenant
Sophos Central surfaces AI agents and non-human identities created in Microsoft Entra; JumpCloud ships REST APIsREST APIsA convention for building HTTP-based interfaces where resources are addressed by URL and manipulated with standard verbs like GET, POST, and DELETE, giving cyber tools a predictable way to integrate with external services. for managing agent identities outright. Agent identities get spun up outside normal joiner-mover-leaver flow and hold real scopes, so an inventory of them is the precondition for governing them at all.
Read your privilege tiering off the attack graph instead of a side document
Synthetic privilege-zone nodes put tier boundaries into the graph as first-class objects, so a path that crosses from Tier 1 to Tier 0 is visible in Explore rather than inferred by hand, and Findings now exports to CSV for the remediation ticket queue.
Stop silently running with rules that never loaded
rsigma's strict load validation and parse-error gauge make a malformed SigmaSigmaAn open, vendor-neutral rule format for describing patterns in log data, maintained by the Sigma project community, giving cyber tools a shared detection language that converts into platform-specific queries. rule a visible number instead of a silent gap in coverage, and its EVTXEVTXWindows XML-based binary log format used by the Event Log service to store system, application, and security events; cyber tools parse it to extract forensic artifacts from live systems or offline disk images. field rendering now matches what Windows shows, which is the usual reason upstream rules misfire. SkillSpector adds detections for agent-memory file writes, npx-based MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. configs, and credentials in urllib headers.
Three unrelated things stand out today: Jamf Pro can keep third-party Mac apps current without repackaging, BloodHound makes privilege-zone exposure easier to query and export, and opentaint extends taint-flow analysis into Go codebases.
protect
Keep non-App Store Mac apps updated without repackaging them
Jamf Pro’s App Lifecycle Management Engine adds declarative, vendor-direct deployment and auto-updating for non-App Store Mac apps. That removes the packaging treadmill that often delays application updates and leaves endpoints running older builds.
Map privilege exposure with more usable graph outputs
BloodHound adds synthetic privilege-zone graph nodes, richer Explore controls, sortable and exportable tables, CSV export for findings, and sharper search and audit APIs. Teams can turn graph analysis into reviewable evidence and handoffs without manually reconstructing paths outside the tool.
opentaint adds a formal models system and built-in Go models alongside its Java coverage. That lets teams apply source-to-sink analysis to Go codebases instead of treating those services as a blind spot or building approximations by hand.
Harden rule pipelines before bad telemetry silently drops coverage
rsigma now validates rule loads strictly, exposes a parse-error gauge, and renders EVTXEVTXWindows XML-based binary log format used by the Event Log service to store system, application, and security events; cyber tools parse it to extract forensic artifacts from live systems or offline disk images. records closer to native Windows output. Detection teams get earlier failure signals when content will not load cleanly, instead of discovering during an investigation that a rule never matched.
Open-source engine for passive OSINT checks: 21 tools as CLI, MCP server and web UI. Hosted Monitor & Diligence at app.openosint.tech.
CVE-2026-86045: Unauthenticated setup endpoint lets network attackers hijack OpenOSINT AI backend traffic (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 10.0, affects <= 2.23.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-12568: Arbitrary File Write in postman_download Module (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects >= 2.1.0, <= 2.8.5)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
4 more releases in this issue
· 2025-10-09 → 2026-06-17
CVE-2026-12565: Path traversal (Zip-Slip) in unarchive module - incomplete fix for CVE-2025-10284 (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects >= 2.3.1, <= 2.8.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-10284: Various issues in unarchive.py can cause arbitrary file write and RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.6, affects < 2.7.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-10282: gitlab.py exposes globally configured gitlab API key to on-premise GitLab instances, potentially threatening confidentiality of a gitlab.com API key (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.7, affects < 2.7.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-10281: git_clone.py can be made to expose a user's github.com API key to an attacker-controlled webserver (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.7, affects < 2.7.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Hunt down social media accounts by username across social networks
CVE-2026-44590: Command Injection via pull_request_target in validate_modified_targets.yml (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.3, affects <= v0.16.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2024-51735: Stored XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. to RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. on Osmedeus Web Server (affects <= 4.6.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities
CVE-2023-46117: Inadequate validation of retrieved subdomains may lead to a Remote Code Execution (RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives.) (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.6, affects < v2.7.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-41316: db_import unsafe deserialisation (CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-502) exposes Metasploit to code execution via crafted XML/ZIP import (related to CVE-2026-41316) (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.0, affects >= 4.0, < 6.5.5)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-34227: One-Click Remote Access: Insecure CORSCORSA browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript. & Unauthenticated MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Interface (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.8, affects <= v1.7.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-32941: Authenticated OOMOOMAn out-of-memory condition: a program requests more memory than the system or device can provide. The allocation fails or the operating system may stop the process. via Memory Exhaustion in mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with./WireGuardWireGuardA modern VPN protocol and Linux kernel module, maintained as an open-source project, that establishes encrypted tunnels using minimal code and fast cryptography, giving cyber tools a lightweight, high-performance transport layer. Transports (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects <= v1.7.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-29781: CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-476: Authenticated Nil-Pointer Dereference in Handlers (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects <= v1.7.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-25791: DNS C2 OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. Bypass Allows Unauthenticated Session Flooding and Denial of Service (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects 1.6.11)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-25760: Website Path Traversal / Arbitrary File Read (Authenticated) in Sliver (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects 1.6.10)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-27093: Unrestricted traffic between Wireguard clients.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.3, affects <= 1.5.43)
CVE-2025-27090: SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. in sliver teamserver v1.5.42/85b0e870d05ec47184958dbcb871ddee2eb9e3df (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects v1.5.26 to v1.5.42)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2024-41111: Authenticated Operator-to-Server RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.2, affects 1.6.0-dev)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2023-35170: MitM attack against implants due to a cryptographic vulnerability (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.1, affects 1.5.0 - 1.5.39)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Automated pentest reporting with custom templates, project tracking, customer dashboard and client management tools. Streamline your security workflows effortlessly!
CVE-2026-34406: Privilege Escalation via Mass Assignment of is_superuser in User Edit Endpoint (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.8, affects <= 2.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
1 more release in this issue
· 2024-12-23 → 2026-03-31
CVE-2024-56363: Server Side Template Injection (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.8, affects 1.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-27413: Arbitrary File Write to RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. using Path Traversal in template update from backup templates.json (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects <1.2.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
3 more releases in this issue
· 2024-12-10 → 2025-02-28
CVE-2025-23044: Cross-Site Request Forgery (CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session.) allows creating admin account with POST request (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.8, affects latest)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2024-55652: Server-Side Template Injection - Sandbox Escape to RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. using custom filters (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects <1.0.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2024-55653: UnhandledPromiseRejection on audits causes Denial of Service (DoS) (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects =< 0.5.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Open-source, self-hosted AI penetration testing framework: maps your attack surface into a graph, autonomously exploits it from a Kali sandbox with human approval gates, and opens PRs that fix what it finds. MCP both ways: plug in any MCP server as a tool, or drive RedAmon from Claude Code or your own agent.
CVE-2026-103015: Unauthenticated remote code executionremote code executionRemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. via exposed Kali MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tool servers (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.8, affects < 5.3.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-61732: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. context (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 10.0, affects <= 1.1.16)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-50558: Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.9, affects < 0.19.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-48113: ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. Bypass via Post-Handshake SSH Channel ExtraData Injection (affects 1.11.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
1 more release in this issue
· 2024-08-26 → 2026-05-20
CVE-2024-43798: AUTH environment variable not respected in server entrypoint (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.6, affects < v1.10.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-27884: Arbitrary file write via path traversal in spider_plus module (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects < 1.5.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.
noir adds query verbs (noir trace, noir reach, noir query), native Windows and npm installs, Anthropic and Gemini AI providers, and new AI flags for streaming and key-file auth.
└──▷ GET THIS VERSIONDockernpmgit
Docker
$ docker pull ghcr.io/owasp-noir/noir:1.5.0
npm
$ npm install -g @owasp-noir/noir@1.5.0
git
$ git clone --branch v1.5.0 https://github.com/owasp-noir/noir.git
# already have the repo? check out this version:$ git checkout v1.5.0
published under the project's GitHub account · signed build provenance · checked 2 Nov
Match a request to its route with noir trace, list routes that reach a file with noir reach FILE[:LINE], and filter by guard, sink, param, path or handler with noir query — all reading a saved report via --from or scanning live.
Control AI behaviour with new flags --ai-stream, --ai-key-file, and --ai-temperature, and attach per-endpoint review context using the new ai_context JSON Schema.
Use a native Anthropic provider or a Gemini preset alongside existing AI providers, with explicit provider errors when misconfigured.
TypeScript, TSX and Ruby now use their own tree-sitter grammars, improving ASTASTAn abstract syntax tree, a structured representation of parsed code. Tools inspect or transform this tree to understand expressions and statements rather than just matching text.-based parsing for NestJS-family decorators, Fastify, Feathers, tRPC, LoopBack, and Rails callbacks.
New detectionLarge repositories now scan faster — GitLab drops from 13s to 4.3s, vikunja from 15.6s to 2.0s, qdrant from 4.2s to 1.8s, and n8n peak memory from 669 MB to 410 MB.
Mend SCA introduces an Intelligent Agent that lets users query risk data in natural language and generate executive-level risk summaries across all applications and projects.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Mend sca is a traditional application security misses AI risk. Standalone AI security tools miss your code.
Mend SCA introduces an Intelligent Agent that lets users query risk data in natural language and generate executive-level risk summaries across all applications and projects.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
└──▷ WHAT SHIPPED ·
1 FEATURE0 OF 1 FEATUREmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Intelligent Agent for natural-language risk queriesnew50how completely this was documenteddepth25/40specificity15/30actionability10/3050 / 100
Mend SCA now includes the Intelligent Agent, an AI assistant embedded in the platform that accepts natural language queries to explore capabilities, navigate to relevant views, and generate executive-level risk summaries across all applications and projects.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ It is enabled by default for organizations with a signed AI consent addendum.
The skill-scanner is a security scanner for AI agent skills
CVE-2026-26057: Skill-scanner Unsecured Network Binding Vulnerability (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects <= 1.0.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
DeepAudit：人人拥有的 AI 黑客战队，让漏洞挖掘触手可及。小白一键部署运行，自主协作审计 + 自动化沙箱 PoC 验证。支持 Ollama 私有部署 ，一键生成报告。支持中转站。让安全不再昂贵，让审计不再复杂。
CVE-2026-25729: User Enumeration via Broken Access Control (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects <=3.0.5)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Terraform enables you to safely and predictably create, change, and improve infrastructure. It is a source-available tool that codifies APIs into declarative configuration files that can be shared amongst team members, treated as code, edited, reviewed, and versioned.
CVE-2019-19316: Cleartext transmission of Terraform state snapshots when using Azure backend with certain SAS tokens (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects < 0.12.17)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
opentaint's analyzer gains a formal models system (replacing the old approximations mechanism) and ships built-in Go models alongside its existing Java models, extending taint-flow analysis to Go codebases.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
The open source taint analysis engine for the AI era. A formal dataflow analysis tool you can customize and self-host, built so AI agents drive your application security analysis without burning tokens on every scan.
opentaint's analyzer gains a formal models system (replacing the old approximations mechanism) and ships built-in Go models alongside its existing Java models, extending taint-flow analysis to Go codebases.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
└──▷ WHAT SHIPPED ·
2 FEATURES1 OF 2 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0101
Models support in analyzer (renamed from approximations)breaking35how completely this was documenteddepth15/40specificity10/30actionability10/3035 / 100
opentaint's analyzer now supports models (formerly called approximations), enabling taint-flow modelling at analysis time.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ The rename is breaking: any configuration or rules referencing approximations by name will need to be updated.
OpenBao is a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys.
CVE-2026-104093: ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. Bypass via Non-Canonical URL Access in OpenBao (affects <2.6.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
13 more releases in this issue
· 2026-05-21 → 2026-09-23
CVE-2026-104092: OpenBao's PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.ACMEACMEAn IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. Issues Certificate With Unvalidated SANs (affects <2.6.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-55776: OpenBao crashes on Transit engine key creation with derived=true for RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. key types (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects <=2.5.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-55774: Cross-namespace lease revocation via lease ID in path bypasses ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. (affects <=2.5.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-55770: LDAPi ldaputil (wrong escape func) (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.8, affects <=2.5.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-46405: OpenBao's KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. Auth Method Accumulates Unaccessible Tokens (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects <=2.5.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
A Kubernetes controller and tool for one-way encrypted Secrets
CVE-2026-59341: Internal POST endopints leaks sealed-secret plaintext through a template-injection oracle in sealed-secrets (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.2, affects <= v0.38.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
1 more release in this issue
· 2026-02-25 → 2026-09-11
CVE-2026-22728: sealed-secrets /v1/rotate can widen sealing scope to cluster-wide via attacker-controlled template annotations (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.9, affects sealed-secrets)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
CVE-2026-76805: Environment Variable Disclosure via Response-Derived Data in DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces./Fuzz Mode (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects >= 3.0.0, < 3.10.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
6 more releases in this issue
· 2023-08-04 → 2026-07-16
CVE-2026-76804: Local File Read via Workflow File-Protocol Gate Bypass (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.5, affects >= 3.0.0, < 3.10.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-76802: Arbitrary Command Execution via DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. Code Signature Bypass (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.7, affects >= 3.0.0, < 3.10.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-76819: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.6, affects >= 3.0.0, < 3.10.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2024-43405: Nuclei Template Signature Verification Bypass (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.4, affects > 3.0.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2024-40641: Unsigned code template execution through workflows in projectdiscovery/nuclei (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.4, affects > 3.0.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2023-37896: Nuclei < 2.9.9 - Sandbox restriction bypass (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.9, affects < 2.9.9)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-73232: ffuf denial of service (OOMOOMAn out-of-memory condition: a program requests more memory than the system or device can provide. The allocation fails or the operating system may stop the process.) via HTTP response decompression bomb (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects <= 2.1.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
CVE-2026-49978: DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.1, affects <3.4.6)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
8 more releases in this issue
· 2024-10-11 → 2026-05-27
CVE-2026-49459: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. via attacker-controlled root DOM (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.1, affects <= 3.4.5)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-49458: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound instanceof checks (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.1, affects <= 3.4.5)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-47423: DOMPurify XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. via selectedcontent re-clone (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.2, affects 3.4.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-41240: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix) (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.1, affects <= 3.2.6)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-41239: Dompurify SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.8, affects < 3.3.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-41238: Prototype Pollution to XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. Bypass via CUSTOM_ELEMENT_HANDLING Fallback (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.9, affects 3.0.1 through 3.3.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2024-48910: Tampering by prototype polution (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.1, affects < 2.4.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2024-47875: nesting-based mXSS (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 10.0, affects <2.5.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Dalfox is an XSS scanner that automates parameter analysis, reflected/stored/DOM-based XSS detection, and WAF fingerprinting for web apps.
CVE-2026-45088: Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via custom-payload-file in Dalfox Server Mode (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects <= 2.12.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-45090: Unauthenticated Remote DoS via Closed-Channel Write in ParameterAnalysis (server mode) (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects <= 2.12.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
CVE-2026-40606: LDAP InjectionLDAP InjectionAn attack technique where unsanitized user input is embedded into LDAP queries, manipulating directory lookups to bypass authentication or extract data. Tools use it to test directory services for input-validation flaws. in mitmproxy (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.8, affects <=12.2.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
3 more releases in this issue
· 2022-03-19 → 2026-04-12
CVE-2022-24766: Insufficient Protection against HTTP Request Smuggling in mitmproxy (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.8, affects <=7.0.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-24853: Insufficient patch for DNS rebind leading to RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.1, affects <0.55.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
4 more releases in this issue
· 2025-01-17 → 2026-02-13
CVE-2025-66025: Improper Handling of External Links in Markdown (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.3, affects <=0.52.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-53834: Reflected XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. in Caido Toast (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.3, affects <0.49.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-49004: Hijacking Caido instance during the initial setup via DNS Rebinding to achieve RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects < 0.48.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-23039: Cross Site Scripting on URL decode Tooltip (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.2, affects = 0.45.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Open-source and cloud-native Web Application Firewall (WAF)
CVE-2026-75514: rDNS bypass via missing forward-confirmation (FCrDNS) in blacklist, greylist, whitelist and antibot (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.9, affects < 1.6.13)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
3 more releases in this issue
· 2024-11-27 → 2026-07-16
CVE-2026-54728: Authenticated privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. via Host header handling in BunkerWeb UI and API (affects < 1.6.12)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-61718: Read-only Web UI users can delete job cache files due to missing authorization on /cache/ routes (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.4, affects >= 1.6.2, < 1.6.12)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
GuardDog is a CLI tool to Identify malicious PyPI and npm packages
CVE-2026-44971: Blind GitHub URL rewrite in remote project scanning causes SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. and GH_TOKEN exfiltration (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.2, affects >= 1.0.0, <= 2.9.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
4 more releases in this issue
· 2022-12-05 → 2026-05-06
CVE-2026-44972: Unsanitized human-readable scan output allows terminal escape injection from malicious package content (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.0, affects >= 2.6.0, <= 2.9.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-22871: Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.8, affects 2.7.0 and below)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-22870: Zip Bomb Vulnerability in safe_extract() Allows DoS (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects 2.7.0 and below)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2022-23530: Arbitrary file write when scanning a specially-crafted remote PyPI package (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.8, affects <v0.1.7)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-40090: Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.1, affects >=v0.23.0, <v0.74.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
1 more release in this issue
· 2026-03-06 → 2026-04-14
CVE-2026-29064: Symlink targets in archives are not validated against destination directory (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.2, affects >=v0.54.0, < v0.73.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Code signing and transparency for containers and binaries
CVE-2026-39395: verify-blob-attestation reports false positive when payload parsing fails (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.3, affects <= v3.0.5, <= v2.6.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
4 more releases in this issue
· 2022-08-04 → 2026-04-06
CVE-2026-22703: Verification accepts any valid Rekor entry under certain conditions (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.5, affects <= 2.6.1, <= 3.0.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2024-29903: Malicious artifacts can cause machine-wide DoS (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.2, affects <= 2.2.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2022-36056: Vulnerabilities with blob verification (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.5, affects <=1.11.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2022-35929: cosign verify-attestation --type can report a false positive if any attestation exists (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.8, affects < 1.10.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CLI tool and library for generating a Software Bill of Materials from container images and filesystems
CVE-2026-33481: Syft improper temporary file cleanup (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects < v1.42.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
1 more release in this issue
· 2023-02-06 → 2026-03-20
CVE-2023-24827: Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects >= v0.69.0 && < v0.70.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-24686: go-tuf TAP 4 multirepo repoName path traversal escapes local metadata cache directory (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.7, affects <= 2.4.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
4 more releases in this issue
· 2022-05-05 → 2026-01-26
CVE-2026-23992: Improper validation of configured threshold for delegations (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.9, affects < v2.3.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-23991: Client DoS via malformed server response (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.9, affects < v2.3.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2022-29173: No protection against rollback attacks for roles other than root (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.8, affects v0.2.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CycloneDX SBOM Model and Utils for Creating and Validating BOMs
CVE-2025-64518: BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. validation is vulnerable to XML External Entity injection (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects <11.0.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
1 more release in this issue
· 2024-06-24 → 2025-11-10
CVE-2024-38374: Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects >= 2.1.0, < 9.0.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.
CVE-2025-61776: Possible disclosure of private NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. repository credentials to api.nuget.org (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.7, affects < 4.13.5)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
4 more releases in this issue
· 2022-10-11 → 2025-10-07
CVE-2025-27137: Local file inclusion via custom notification templates (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.4, affects < 4.12.6)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2024-54002: Enumeration of managed users via /api/v1/user/login endpoint (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects < 4.12.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2024-38515: Possible XML External Entity injection via upload of CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. BOMs in XML format (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.4, affects >= 3.6.0, < 4.11.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2022-39351: Logging of API keys in clear text when handling API requests using keys with insufficient permissions (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.4, affects < 4.6.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
HyperDbg v0.25 brings Linux host support, allowing practitioners to debug a Windows guest over a serial connection from a Linux machine, alongside improved anti-detection coverage.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
State-of-the-art native debugging tools
HyperDbg v0.25 brings Linux host support, allowing practitioners to debug a Windows guest over a serial connection from a Linux machine, alongside improved anti-detection coverage.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
└──▷ WHAT SHIPPED ·
2 FEATURES1 OF 2 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0101
Linux host support for debugging Windows guestsnew65how completely this was documenteddepth25/40specificity20/30actionability20/3065 / 100
HyperDbg now supports running as a Linux host to debug a Windows guest machine over a serial kernel debugger connection.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ The .debug command on Linux now accepts device and socket paths, enabling serial connections over termios devices and UNIX sockets.
— Names command and connection types but no full syntaxv0.25
thinner coverage below
0200
XSETBV handling in hyperevadeimproved35how completely this was documenteddepth15/40specificity15/30actionability5/3035 / 100
HyperDbg's hyperevade module now handles XSETBV instructions to improve anti-detection coverage.
— Names module and instruction but lacks mechanism detailv0.25
Ghidra is a software reverse engineering (SRE) framework
CVE-2026-100504: Out-of-bounds read and write in leftshift128 during decompilation (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.1, affects < 12.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
3 more releases in this issue
· 2026-09-22 → 2026-10-22
CVE-2026-100503: Heap-use-after-free in the opInsertAfter via a stale INDIRECT effect-op reference (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.1, affects < 12.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-100505: Heap out-of-bounds read in decompiler StringManager::getCodepoint() when reconstructing constant strings (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.4, affects < 12.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-96273: Improper Array Index Validation in DB Unregistered Options parsing Leads to unreleased lock and Denial of Service (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.5, affects < 12.1.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
UNIX-like reverse engineering framework and command-line toolset
CVE-2026-108387: Remote code executionRemote code executionRemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. when loading Pebble/SMD binary (affects < 6.2.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
4 more releases in this issue
· 2020-07-20 → 2026-09-03
CVE-2026-81885: Infinite relocation-chain loop causes denial of service in radare2 NE parser (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.5, affects <6.1.9)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-81886: Uncontrolled memory allocation in radare2 dmp64 parser (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.5, affects <6.1.9)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-81879: Heap out-of-bounds read in radare2 ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code.PN_XNUM handling (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.5, affects <6.1.9)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2020-15121: Command injectionCommand injectionAn attack that makes an application execute operating-system commands supplied through untrusted input. It often happens when input is passed unsafely to a shell. during opening PE file with malformed debug symbol information (PDBPDBA debug symbol file format used by Microsoft's toolchain that maps compiled binaries back to source code, function names, and variable types, letting cyber tools resolve symbols during reverse engineering or memory analysis.) - idpd command (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.6, affects <4.5.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-42049: RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. Via Groovy Code Injection in Gradle Export (affects <= 1.5.5)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
4 more releases in this issue
· 2022-07-20 → 2026-07-10
CVE-2026-54684: XAPK archive entries with absolute paths can plant drop-in plugins and achieve code execution on the next jadx run (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.0, affects v1.5.2 through v1.5.5)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2024-32653: Insufficient input filtering of package name allows command execution in the device with shell privileges (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.1, affects <=1.4.7)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2022-39259: Jadx-gui: Swing HTML DOS attack (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.5, affects <= 1.4.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2021-22569: Vulnerable library protobuf-java 3.11.4 (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.5, affects 3.11.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-49263: Capstone WASMWASMA binary instruction format for a stack-based virtual machine, maintained by the W3C, that lets code compiled from any language run at near-native speed inside a sandboxed environment across browsers and servers.br_table instruction-size truncation can cause no-progress disassembly and parser desynchronization (affects commit 511ba599951113828c4e8edd262ee363395bd81d)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-49282: Capstone M68K and RISCV cs_insn_name() invalid IDs can trigger out-of-bounds reads and process crashes (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.1, affects commit 511ba599951113828c4e8edd262ee363395bd81d)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-47143: NULL Pointer Dereference with 3DNow!︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ opcodes (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.1, affects 6.0.0-Alpha5)
CVE-2025-68114: Unchecked vsnprintf return in SStream_concat allows stack buffer underflow&overflow (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.8, affects 6.0.0-Alpha5)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-67873: Skipdata length unchecked leads to cs_insn.bytes heap buffer overflow (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.8, affects 6.0.0-Alpha5)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
UNIX-like reverse engineering framework and command-line toolset.
CVE-2026-22780: Heap overflow on mach0_chained_fixups.c (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.4, affects < 0.8.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
6 more releases in this issue
· 2021-12-13 → 2026-02-01
CVE-2024-53256: Command injectionCommand injectionAn attack that makes an application execute operating-system commands supplied through untrusted input. It often happens when input is passed unsafely to a shell. via RzBinInfo bclass due legacy code (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.3, affects < 0.7.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2023-40022: Integer Overflow in C++ demangler logic (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.3, affects <=0.6.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2023-27590: Stack-based buffer overflow when parsing GDB registers profile files (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.8, affects <=v0.5.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2022-36043: Double Free in bobj.c when using QNX binary plugin (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.8, affects <=0.4.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2022-36040: Out-of-bounds Write in pyc/marshal.c (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.8, affects <=0.4.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2021-43814: Heap-based OOB write when parsing dwarf DIE info in Rizin (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.8, affects <=0.3.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
A Java 8+ Jar & Android APK Reverse Engineering Suite (Decompiler, Editor, Debugger & More)
CVE-2022-21675: Bytecode Viewer v2.10.x Zip Slip (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.8, affects v2.10.16)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-85737: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects <= 0.77.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Forensics artefact collection tool for systems running Microsoft Windows
CVE-2026-11958: Local privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. via DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. side-loading when executed as SYSTEM or from a user-writable directory (affects <10.2.8)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
This is the development tree. Production downloads are at:
CVE-2026-24857: Heap-based Buffer Overflow in bulk_extractor (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.8, affects >= 1.4, < 2.2.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-28407: Nested archive extraction failure can drop content from scan inputs (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects < v1.21.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
2 more releases in this issue
· 2026-01-29 → 2026-02-27
CVE-2026-24845: OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. image scanning could expose registry credentials (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects >= 0.10.0, < 1.20.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-24846: Archive extraction could write outside extraction directory (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.5, affects >= 1.8.0, < 1.20.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CAPEv2 adds multi-tenancy isolation with per-group sandbox policies, a reconcile CLI, and a generic plugin hook/startup extension loader︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
└──▷ TRY IT
Dry-run the tenancy reconcile tool to preview which MongoDB/Elasticsearch reports would be restamped before committing changes on an upgraded install.
Reconcile a single task's ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. and visibility after migrating from inline tenancy SQL columns to the new task_acl side-table.
$ python utils/tenancy_reconcile.py --task 14
Manage multi-tenancy entitlements with GroupSandboxPolicy to assign per-group VM allocations, network routes, and machine tags, backed by a side-table TaskAcl with monotonic visibility_seq compare-and-swap synchronization, under the [multitenancy] and [object_storage] config sections in lib/tenancy/.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Run utils/tenancy_reconcile.py with --dry-run, --adopt-public-from-reports, --demote-public, or --task <id> to restamp MongoDB/Elasticsearch reports, preserve public task visibility in task_acl, and drop legacy inline-tenancy SQL columns.
CAPEv2 now supports vendor-neutral object storage backends — s3, gcs, azure, and local — configured under the [object_storage] section via the opt-in lib.tenancy package.
CAPEv2 adds a generic plugin hook system and startup extension loader in lib/cuckoo/common/hooks.py, letting single-tenant installs opt in to extensions without incurring runtime or schema overhead.
CAPEv2 adds lib/cuckoo/common/pebble_utils.py with teardown_pool() and is_pool_healthy() to give the PebbleEngine and extractor pool bounded teardown and a single shared health check, preventing permanent hangs on D-state workers.
Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
CVE-2026-107362: SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. with full response-body readback via the FilePond fetch API in the file-upload component (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.1, affects <= 26.08.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
8 more releases in this issue
· 2026-07-15 → 2026-09-30
CVE-2026-107333: Authorization bypass: an unresolved /./ segment defeats every nginx RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. role restriction (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.1, affects <= v26.08.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-107361: Missing Server-to-Server (s2s) Authentication Configuration on Hedgehog Sensor Arkime Reachback Port (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.2, affects <= v26.07.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-107337: Unauthenticated script execution via CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session. in kiosk /script_call endpoint (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.1, affects <= v26.07.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-107336: Unauthenticated bypass of the nginx auth gate on the /iddash2ark/ Arkime shortcut (regex case-sensitivity mismatch + forwarded-identity confused deputy) (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects = v26.07.1 (current CalVer line; also present in nginx_readonly.conf — note: pre-CalVer v6.4.3 is NOT affected))︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-107334: Percent-Encoded Request Paths Bypass Malcolm's nginx RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.4, affects <= v26.07.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-107335: Raw-stream and Lzip Uploads Bypass Malcolm's Archive-Bomb Protections (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects <= v26.07.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-63133: Uncontrolled Resource Consumption in Archive Extraction (Inode-Exhaustion DoS) (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects <= v26.06.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-63134: Path Traversal in Archive Extraction Allows Arbitrary Directory Creation (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.4, affects <= v26.06.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.
CVE-2026-94084: detect/http2: header inspection can trigger a use-after-free (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.1, affects >= 8.0.4, < 8.0.7)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-94083: DoH2: upgrade from HTTP2 to DoH2 can cause a type-confused free (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.1, affects >= 8.0.0, < 8.0.7)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
CVE-2026-44982: CrowdSec AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. silently drops request body for chunked / HTTP-2 requests (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.2, affects =>1.5.0, =<1.7.7)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Daemon to ban hosts that cause multiple authentication errors
CVE-2021-32749: Possible RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. vulnerability in mailing action using mailutils (mail-whois) (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.1, affects <= 9.7, <= 10.6, <= 11.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Edit and replay captured network traffic at arbitrary speeds — a suite of pcap tools for *NIX and Windows.
CVE-2026-102897: Heap Out-of-Bounds Read up via --pktlen combined with --preload-pcap in tcpreplay (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.7, affects <= 4.6.0-beta2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
9 more releases in this issue
· 2026-07-23 → 2026-07-24
CVE-2026-102898: Heap Out-of-Bounds Write in ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. Address Rewriting via Unvalidated ar_hln/ar_pln (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.1, affects <= 4.6.0-beta2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-102896: Stack Buffer Overflow in tcpprep --services File Parser via Unbounded Regex Match Copied with strncpy() (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.8, affects <= 4.6.0-beta2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-102752: Double free in tcpedit_dlt_cleanup in tcprewrite (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.0, affects <= 4.5.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-102749: Heap buffer overflow in tcprewrite fragroute ip6_opt module when inserting IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. extension headers (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.4, affects <= 4.5.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-102746: Heap Buffer Overflow via Negative Fragment/Segment Size in fragroute tcp_seg/ip_frag Modules (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.4, affects <= 4.5.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-102733: Integer overflow in NetFlow v9 option template offset accumulation leads to heap OOB read (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects Version 1.7.8 and earlier)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
6 more releases in this issue
· 2026-07-22 → 2026-07-23
CVE-2026-102694: NULL pointer dereference in NetFlow v9 sub-template sequencer traversal (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects Version 1.7.8 and earlier)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-102691: Integer overflow in PushArrayNextElement leads to array record header corruption in NBAR/ifvrf option data processing (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects <= 1.7.8)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-94558: Legacy v1-layout file header ident field causes stack out-of-bounds read in nfdump (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.5, affects Version 1.7.8 and earlier)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-94557: Heap out-of-bounds read parsing the interface/VRFVRFA Virtual Routing and Forwarding instance is a router feature that maintains multiple independent routing tables on one device, letting a cyber tool isolate traffic flows or simulate separate network segments without extra hardware. name array record in nfdump (nfdump -r) (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.5, affects Version 1.7.8 and earlier)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-94559: Malformed appendix block causes an excessive loop and log-flood denial of service in nfdump (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.5, affects Version 1.7.8 and earlier)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-94553: Unauthenticated IPFIXIPFIXAn IETF standard protocol for exporting network flow records from routers and probes to a collector, giving cyber tools a vendor-neutral stream of structured traffic metadata without full packet capture. withdraw-all leaves dangling template pointers, causing remote use-after-free in nfcapd (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects Version 1.7.8 and earlier 1.7.x)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-25061: TIM Element OOB Write in wifipcap (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects <= 1.61)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Hubble - Network, Service & Security Observability for Kubernetes using eBPF
CVE-2025-48056: Character injection in Hubble CLI (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects < v1.17.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. Supports Linux and Android on x86_64 and arm64.
CVE-2024-24790: ecapture docker images CVE-2024-24790 (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.8, affects >=1.22.0-0,<1.22.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, detections, and case management.
CVE-2020-27985: Security Onion v2 prior to 2.3.10 has an incorrect sudo configuration (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.8, affects < 2.3.10)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-79705: Local file overwrite by extracting a malicious tar archive (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.1, affects < 1.43.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
5 more releases in this issue
· 2021-07-15 → 2026-09-17
CVE-2026-44517: Build breakout using a Git repository or a tar archive fetched over the network (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.3, affects >= v1.38.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2024-11218: Build breakout using malicious Containerfiles and concurrent builds (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.6, affects < 1.38.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2024-1753: CVE-2024-1753 container escape at build time (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.6, affects 1.35.0 through and including v1.24.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2022-27651: Default inheritable capabilities for linux container should be empty (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.8, affects < 1.25.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2021-3602: chroot isolation: environment value leakage to intermediate processes (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.5, affects 1.21.2, 1.20.0, 1.19.8, 1.18.0, 1.17.1, 1.16.7)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Kata Containers is an open source project and community working to build a standard implementation of lightweight Virtual Machines (VMs) that feel and perform like containers, but provide the workload isolation and security advantages of VMs. https://katacontainers.io/
CVE-2026-77176: generated policy allows mounting attacker-chosen guest paths to specific locations (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.1, affects <= 4.0.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
10 more releases in this issue
· 2025-09-23 → 2026-08-20
CVE-2026-86072: Untrusted pod annotation bind-mounts any host path into the Kata guest, bypassing the operator allowlist (affects <= 3.32.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-64676: kata-agent mem-agent ttRPC methods are not subject to agent-policy enforcement, letting an untrusted host tamper with confidential-guest memory management (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.7, affects <= 3.31.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-50540: Config Path Annotation Arbitrary File Loading (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.6, affects <=3.32.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-44210: VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.9, affects <= 3.29.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-41326: CopyFile Policy Subversion via Symlinks (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.2, affects v3.4.0 - v3.28.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-24834: Kata Container to Guest micro VM privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.3, affects <= 3.26.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-24054: Runtime: Host block device can be hotplugged to the VM if the container image is malformed or contains no layers (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 10.0, affects <= 3.25.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF
CVE-2026-53941: Uprobe gadgets: unprivileged container's ld.so.cache causes high CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. utilization and container startup DoS (affects >= v0.27.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
4 more releases in this issue
· 2026-01-29 → 2026-06-16
CVE-2026-44778: Unprivileged container can crash USDTUSDTUserspace Statically Defined Tracing probes, a mechanism originating in Solaris and adopted by Linux, that lets a program embed named hook points so debuggers and tracers can attach at runtime with near-zero overhead when idle. note parser via crafted ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. (no shipped gadget affected) (affects >= v0.28.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-31890: Tracing Denial of Service via Event Flooding (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.5, affects <v0.50.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-25996: Unsanitized ANSI Escape Sequences In columns Output Mode (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.8, affects <=v0.49.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-24905: Command Injection in Makefile.build (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.8, affects <v0.51.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Manage admission policies in your Kubernetes cluster with ease
CVE-2026-42541: RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. Reconnaissance via unchecked can_i host capability call (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.3, affects v1.32.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
3 more releases in this issue
· 2025-01-30 → 2026-04-27
CVE-2026-29773: Cross-namespace data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels. via deprecated host callback binding (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.3, affects v1.6.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-24784: Information leak via AdmissionPolicyGroup Resource (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.3, affects >= 1.17.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-24376: AdmissionPolicy and AdmissionPolicyGroup policies can be used to alter PolicyReport resources (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects >= 1.7.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Define and run multi-container applications with Docker
CVE-2025-62725: Path Traversal via OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. Artifact Layer Annotations (affects < v2.40.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CLI to install, manage & troubleshoot Kubernetes clusters running Cilium
CVE-2023-28114: cilium-cli disables etcd authorization for clustermesh clusters (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.8, affects < 0.13.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Low-level unprivileged sandboxing tool used by Flatpak and similar projects
CVE-2026-87766: CVE-2026-87766: Sandbox escape: symlink traversal via /oldroot allows writing files outside sandbox during setup (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.8, affects < 0.12.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
1 more release in this issue
· 2026-04-23 → 2026-08-26
CVE-2026-41163: CVE-2026-41163: Privilege escalationPrivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. in setuid mode via ptrace (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.0, affects 0.11.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Tetragon is an eBPF-based security observability and runtime enforcement tool for Kubernetes and cloud-native environments.
CVE-2026-65960: Unauthenticated Tetragon gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. admin API accessible from hostNetwork pods (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.8, affects < v1.7.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
This repo hosts Prowler OSS (CLI and Local Server). Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment for Humans and AI Agents.
CVE-2026-73262: Stored XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. in HTML reports through unescaped cloud resource tags (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.4, affects <= 5.36.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
3 more releases in this issue
· 2026-06-22 → 2026-08-03
CVE-2026-73263: RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. on Prowler App workers via kubeconfig auth-provider cmd-path (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.9, affects < 5.36.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-73264: Server-Side Request Forgery (SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly.) in Lighthouse Provider (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.6, affects <=5.33.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-59151: SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. Domain Claiming Enables Cross-Tenant Account Takeover (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.6, affects <= 5.30.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Real-time global intelligence dashboard. AI-powered news aggregation, geopolitical monitoring, and infrastructure tracking in a unified situational awareness interface
World Monitor's v2.11.7 release adds Arabic spoken answers to MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface., a Gemini CLI extension manifest, new procurement and food-price sources, expanded energy feeds, and removes the deprecated /api/fwdstart endpoint.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
└──▷ WHAT SHIPPED ·
6 FEATURES1 OF 6 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Arabic language support for MCP spoken answersnew70how completely this was documenteddepth20/40specificity25/30actionability25/3070 / 100
MCP spoken answers now support Arabic by setting spoken_language to "ar".︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
— Names exact config key and value to enable itv2.11.7
thinner coverage below
0200
National energy feeds in fuel panel and country briefnew55how completely this was documenteddepth20/40specificity20/30actionability15/3055 / 100
Shows national energy feeds in the fuel panel and country brief, and adds Guatemala MEM fuel prices to the regional energy feeds.
— Names UI surfaces and a specific new sourcev2.11.7
0301
Removal of /api/fwdstart endpointbreaking55how completely this was documenteddepth20/40specificity25/30actionability10/3055 / 100
The /api/fwdstart endpoint and the unused tech/finance variant FEEDS have been removed — any client calling /api/fwdstart will break.
— Names exact removed endpoint, no migration guidancev2.11.7
0400
New procurement feed sources for Georgia and Armenianew45how completely this was documenteddepth15/40specificity20/30actionability10/3045 / 100
Adds EPADS, Georgia, and Armenia tender sources to the procurement feed.
— Names sources but no access path or formatv2.11.7
0500
Expanded official food-price datanew35how completely this was documenteddepth15/40specificity15/30actionability5/3035 / 100
Adds 11 batch-2 official food-price sources and official local prices with weekly comparisons.
CVE-2026-104258: SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. via webhook notifier allows authenticated users to reach internal services (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.5, affects <= 7.260722.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
20 more releases in this issue
· 2025-05-19 → 2026-10-22
CVE-2026-104253: Profile page reflects MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. secret in response (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.2, affects < 7.260715.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-63477: Organization administrator can escalate to global administrator via unvalidated grantable_groups write (incomplete fix of CVE-2026-44730) (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.8, affects < 7.260624.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-76822: Authorisation vulnerability in case creation (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.3, affects < 7.260701.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-76820: Synchronizer SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly.: stream fetch has no URL validation (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.7, affects < 7.260701.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-76821: User-Controlled ReDoSReDoSA denial-of-service attack that exploits catastrophically backtracking regular expressions, causing a regex engine to consume exponential CPU time on crafted input; tools use detection of vulnerable patterns to flag risky code. in JSON Ingestion Mapper (affects < 7.260706.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-102892: TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. Public Collection Incorrect Authorization & Data Leak (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects < 7.260416.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-35211: Elasticsearch Painless Script Injection via GraphQL script filter operator allows authenticated user to exfiltrate data and cause DoS (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects < 7.260401.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-35210: Authorization Bypass via synchronized-upsert HTTP Header Injection (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.1, affects < 7.260326.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-35212: XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. in the rendering of email-message observable body data (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.1, affects < 7.260227.0 )︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-44730: Privilege escalationPrivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. via graphQL API abusable by organization admins, due to incorrect ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. on userEdit relationAdd (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.2, affects < 6.9.7)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-27960: Priviledge escalation and unauthenticated access using default admin (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.8, affects >= 6.6.0, < 6.9.13)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-39980: RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. via notifier template (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.1, affects < 6.9.5)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-21886: GraphQL Mutations Allow Deletion of Unrelated Entities (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects < 6.9.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-21887: Semi-Blind SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. via Unvalidated External URL in Data Ingestion Feature (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.7, affects < 6.8.16)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-61782: Open Redirect in OpenCTI's SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. Authentication Flow (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.4, affects < 6.8.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-61781: GraphQL IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data. allows authenticated user to delete workspace content of other users (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.1, affects < 6.8.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-26621: Denial of Service through web hook (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.6, affects < 6.5.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-66460: XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. due to lack of escaping in HTML elements passed to Datatables (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.1, affects <=1.35.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-66459: XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. due to unescaped error message passed to innerHTML (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.1, affects <=1.35.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-66458: Multiple XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. due to unsafe use of f-strings in Markup (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.1, affects <=1.35.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-63502: Path traversal in ExportTask name allows authenticated arbitrary file read and write (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.3, affects <= 2.5.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
5 more releases in this issue
· 2024-09-10 → 2026-07-01
CVE-2026-63489: Authenticated AQL injection via unvalidated search sorting and filter_aliases parameters (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.6, affects <= 2.5.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-63482: Unauthenticated Access to Full Audit Timeline Discloses All Threat Intelligence Data (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects commit 1f5b1261b1ae862423b1226e3447182e7df12dcf )︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2024-46508: Insecure default secret key specified in config (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects - 2.3.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2024-46507: Server Side Template Injection in Exports (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.1, affects - 2.1.12)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2024-45412: CVE-2024-45412: Potential Denial of Service due to the One Milion Unicode characters attack (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.3, affects - 2.1.10)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
MISP (core software) - Open Source Threat Intelligence and Sharing Platform
CVE-2026-44381: MISP - SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. via unvalidated ordering parameters in event and shadow attribute listings (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects < 2.5.37)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
3 more releases in this issue
· 2026-04-08 → 2026-04-29
CVE-2026-44380: MISP - Improper access control in auth key reset allows privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. to site administrator (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.2, affects < 2.5.37)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-44379: Improper UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. validation in MISP Collections (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects < 2.5.37)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-39962: LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variable (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.6, affects 2.5.35)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-40584: RansomLook - Improper Filtering of Private Location Entries in API Endpoints Leads to Information Exposure (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects < 1.9.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
ClamUI v0.5.0 rebuilds the desktop app on a Rust/Tauri core and adds a Network view with VirusTotal IP lookups, read-only firewall auditing, and safer configuration recovery tooling.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
└──▷ WHAT SHIPPED ·
7 FEATURES1 OF 7 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Save & Apply configuration recovery flownew80how completely this was documenteddepth30/40specificity20/30actionability30/3080 / 100
A new Save & Apply recovery flow exposes a See Configuration panel showing the exact native ClamAV configuration attempted for each full target path, with separate copy actions for manual recovery after partial or failed writes.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
After a failed configuration write, inspect exactly what ClamAV configuration ClamUI attempted before manually editing the file on disk.
📍In ClamUI, open Preferences and trigger Save & Apply. If a write fails, click See Configuration to view the exact native ClamAV configuration attempted for each full target path, then use the separate copy action to paste it into the file manually.
— Includes exact UI steps and a runnable recovery workflowv0.5.0
0200
Network view with listener snapshots and VirusTotal lookupsnew77how completely this was documenteddepth30/40specificity25/30actionability22/3077 / 100
A new Network view shows current TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. listeners and connections with filtering, copying, and permission-aware process attribution. It can open VirusTotal IP reports in the browser after explicit confirmation for accepted public IP addresses, without sending port or process information.
Review active TCP/UDP listeners and attribute them to processes to spot unexpected network exposure on a host.
📍In ClamUI, open the Network view to see current TCP/UDP listeners and connections. Use the filter controls to narrow results, and copy rows of interest for reporting.
— Describes mechanism and privacy scope plus a usage walkthroughv0.5.0
0300
Native packaging across Debian, AppImage, Flatpak, RPMnew70how completely this was documenteddepth25/40specificity30/30actionability15/3070 / 100
Adds native Debian application and helper packages, an x86_64 AppImage with .zsync metadata, Flatpak bundles for x86_64 and aarch64, and helper-only Fedora RPM support for x86_64 and aarch64 with protected-preference recovery requiring the matching signed RPM and detached .rpm.asc asset for the host architecture.
— Names exact package formats and architectures supportedv0.5.0
0401
Rust/Tauri rewrite of the desktop corebreaking65how completely this was documenteddepth35/40specificity25/30actionability5/3065 / 100
ClamUI now uses a headless Rust core with a Tauri 2/WebKitGTK and React desktop, replacing the Python/PyGObject runtime while retaining existing XDGXDGA set of specifications maintained by freedesktop.org that standardise where Linux applications store config, data, and cache files, letting tools respect user-defined paths instead of hardcoding locations. JSON and SQLite data layouts, scanning, history, quarantine, profiles, exports, clipboard actions, tray controls, and file-manager integration.
— Explains before/after architecture but no migration actionv0.5.0
thinner coverage below
0500
Read-only firewall audit across UFW, firewalld, nftablesnew55how completely this was documenteddepth20/40specificity25/30actionability10/3055 / 100
ClamUI's firewall audit now inventories UFWUFWA command-line frontend for Linux's iptables firewall, maintained by Canonical, that lets tools configure host-based packet filtering rules without writing raw iptables syntax., firewalld, nftables, IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. iptables, and supported management interfaces in a read-only, non-interactive view.
— Names surfaces covered but no navigation path givenv0.5.0
0600
Helper trust distinction with Polkit-confirmed installnew45how completely this was documenteddepth20/40specificity15/30actionability10/3045 / 100
ClamUI now distinguishes missing helpers from untrusted helpers and, on supported hosts, can offer a Polkit-confirmed installation of a verified matching signed helper package.
— Explains behaviour but no concrete command or pathv0.5.0
0700
Nine active UI localesnew30how completely this was documenteddepth10/40specificity15/30actionability5/3030 / 100
The interface now supports nine active locales: German, English, Spanish, French, Hungarian, Italian, Norwegian Bokmål, Brazilian Portuguese, and Simplified Chinese.
CVE-2026-28280: Stored Cross-Site Scripting (XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session.) in On-Demand Query List (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.1, affects < 0.5.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-28279: OS Command Injection via Environment Configuration in osctrl-admin (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.3, affects < 0.5.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Sophos Central's October release adds visibility into AI agents and non-human identitiesnon-human identitiesA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. created in Microsoft Entra, shows per-policy application status on endpoint details pages, and expands Protected Browser with phishing protection, standalone DNS protection, an MSI installer, and data boundary controls.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Sophos Central is a cloud-based management console for Sophos security products, letting administrators deploy, monitor, and manage endpoint, firewall, email, and server protection from one place.
Sophos Central's October release adds visibility into AI agents and non-human identitiesnon-human identitiesA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. created in Microsoft Entra, shows per-policy application status on endpoint details pages, and expands Protected Browser with phishing protection, standalone DNS protection, an MSI installer, and data boundary controls.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
└──▷ WHAT SHIPPED ·
3 FEATURES0 OF 3 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Non-human identity visibility for Microsoft Entranew57how completely this was documenteddepth22/40specificity20/30actionability15/3057 / 100
Sophos ITDRITDRIdentity Threat Detection and Response: a discipline focused on detecting and responding to attacks that abuse identity systems such as Active Directory or IAM platforms, giving cyber tools visibility into credential-based intrusions. now surfaces AI agents, blueprints, and apps created by Microsoft Entra — including ownership and sponsorship details — under Non-Human Identities in the Directory.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
— Names the UI location but not mechanism behind detectionOctober 12, 2026
0200
Protected Browser phishing, DNS, and deployment updatesimproved57how completely this was documenteddepth20/40specificity22/30actionability15/3057 / 100
Protected Browser adds Phishing Protection to guard organizational credentials, direct DNS Protection that works independent of endpoint or network policies, a new MSI installer for Windows deployment, and more flexible data boundary controls.
— Names four distinct additions but no config or command specificsOctober 12, 2026
0300
Policy application status on endpoint detailsnew48how completely this was documenteddepth18/40specificity15/30actionability15/3048 / 100
The Policies tab of an endpoint's details page now shows the application status for each policy, including confirmation that updated policies (such as exclusions) have been applied.
— Clear UI path but no mechanism detail beyond thatOctober 12, 2026
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
CVE-2026-74041: Case-sensitivity mismatch bypasses remote-command validation, allowing command execution as root (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.2, affects >= 4.14.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
18 more releases in this issue
· 2026-08-18 → 2026-10-13
CVE-2026-74033: Missing destination-path validation in CDB list cluster-callable handlers allows arbitrary file read/delete on the manager (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.1, affects >= 4.1.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-74037: Improper session invalidation in check_token: revoking a run_as user's administrator grant does not invalidate their token, enabling permanent self-re-grant of administrator (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.2, affects >= 4.0.0, <= 4.14.7)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-74045: Heap buffer overflow in wazuh-analysisd fim_generate_alert() lets an enrolled agent corrupt manager heap memory and terminate the analysis engine (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.1, affects >= 3.12.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-74035: An empty password bypasses both the password policy and the reserved user guard in security.update_user, allowing a delegated user administrator to take over the wazuh superuser account (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.2, affects >= 4.6.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-93346: API brute-force protection is still bypassable by concurrent login requests, the asyncio.Lock fix for GHSA-m2mr-xhhv-jx58 serializes the counter but does not close the check-then-count race (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects >= 4.0.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-74034: Arbitrary file read as root via agent-injected upgrade_custom command (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects >= 4.1.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-74032: RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. Authorization Bypass in Wazuh API (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.3, affects >= 4.0.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-74047: authd.pass disclosed to low-privileged users through the per-agent active configuration endpoint (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects >= 4.0.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-74040: Cluster worker can overwrite arbitrary master files (incl.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ ossec.conf) → root RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. on manager and every agent — bypass of #36296 excluded_files guard + missing extra_valid enforcement (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.1, affects >= 3.9.0)
CVE-2026-74030: SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. YAML alias expansion causes memory exhaustion (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.9, affects >= 3.9.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-62365: Heap Buffer Overflow in DecodeWinevt() join_data Accumulation via Crafted EventChannel XML (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects >= 3.8.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-61811: Unbounded Recursion in os_xml _getattributes() Causes analysisd Worker Thread Stack Exhaustion (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects >= 3.8.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-61783: RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects >= 4.14.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-54084: Wazuh agent enrollment NULL pointer dereference via malformed manager response (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects >= 4.0.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-54085: Missing input validation in multiple active response scripts allows argument injection (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.9, affects >= 4.2.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-61800: Incomplete fix for CVE-2026-30893: missing directory confinement in cluster worker file sync allows arbitrary file write under /var/ossec on worker nodes (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.0, affects >= 4.4.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-74046: zlib decompression bomb in cluster archive processing lets authenticated peer exhaust wazuh-clusterd memory (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.9, affects >= 4.4.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-74039: Authenticated denial-of-service of the Wazuh API via POST /security/user/authenticate/run_as (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects >= 4.0.0, <= 5.0.0-beta2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-69190: Manager-to-Owner privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. on saved searches and dashboards (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.3, affects >= 6.3.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
10 more releases in this issue
· 2023-07-05 → 2026-07-07
CVE-2026-55425: System Catalog titles endpoint can be used to retrieve values of protected database fields (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.0, affects 7.1.0 - 7.1.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-55841: Fortigate syslog message parser can be exploited to modify or delete fields from the original message (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects < 6.3.12, < 7.0.7, < 7.1.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-55867: Graylog token revocation endpoint allows authenticated users to delete other users’ access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. (affects >=6.2.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-53106: Privilege escalationPrivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. through API tokens (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.8, affects >=6.2.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-46827: Session Takeover via Insufficient HTML Sanitization (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.0, affects <= 6.0.13, <= 6.1.9)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-30373: Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects >= 6.1.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2024-52506: Concurrent PDF report rendering can leak other users' reports (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects 6.1.0, 6.1.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2024-24823: Session fixation vulnerability through cookie injection (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.7, affects 4.3.0 - 5.2.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2024-24824: Instantiation of arbitrary classes triggered by API request (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.8, affects >= 2.0.0, <=5.2.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2023-41045: Insecure source port usage for DNS queries (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects <= 5.1.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
ClickHouse® is a real-time analytics database management system
CVE-2025-1385: CVE-2025-1385- Fail input validation in clickhouse-library-bridge API could lead to RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. (affects < 24.3.18.6)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
2 more releases in this issue
· 2023-12-18 → 2025-03-20
CVE-2024-6873: Specially crafted request could caused undefined behavior which may lead to Remote Code Execution.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.1, affects < v24.5.1.1763)
CVE-2023-47118: Heap buffer overflow in T64 codec decompression (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.0, affects < v23.10.2.13)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Sumo Logic is a cloud-native machine data analytics platform that collects, searches, and analyzes logs and metrics for security monitoring, troubleshooting, and operational insights.
Sumo Logic adds user metrics dashboards to the GitHub Copilot app and migrates its C2C source to current endpoints with user metrics support.
Sumo Logic's GitHub Copilot app (v1.0.1) now adds user metrics dashboards and reflects the updated data schema.
Sumo Logic's GitHub Copilot C2C source (v2.0.0) migrates from legacy endpoints and adds user metrics support.
CVE-2024-48911: OpenCanary Executes Commands From Potentially Writable Config File (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.8, affects < 0.9.5)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
A complete Sigma detection engineering toolkit: parser, linter, evaluator, correlation engine, conversion framework, streaming daemon, MCP and LSP servers
rsigma v0.26.0 adds strict rule-load validation with a new parse-error gauge, and reshapes how EVTXEVTXWindows XML-based binary log format used by the Event Log service to store system, application, and security events; cyber tools parse it to extract forensic artifacts from live systems or offline disk images. records are presented to rules to match Windows' native rendering more closely.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
└──▷ WHAT SHIPPED ·
2 FEATURES1 OF 2 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0101
EVTX record shape now matches Windows renderingbreaking85how completely this was documenteddepth35/40specificity28/30actionability22/3085 / 100
engine eval -e @file.evtx now passes EVTX records to rules closer to how Windows renders them: GUIDs are lowercase and wrapped in braces (e.g.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ {54849625-5478-4994-a5ba-3e3b0328c30d}), unset Data, Binary, and optional System fields are omitted instead of present-and-empty, consecutive Data elements with the same name collapse into an array with a numbered suffix for later duplicates (e.g. LogonGuid_1), and bool fields with values other than 0 and 1 now arrive as integers instead of true. Rules matching whole unbracketed GUIDs, empty field values, or boolean truthiness on non-0/1 values must be updated.
— Concrete before/after examples but no migration command given.v0.26.0
0200
Strict rule-load validation and parse-error gaugebreaking84how completely this was documenteddepth32/40specificity27/30actionability25/3084 / 100
A new --strict-rules flag (config key daemon.engine.strict_rules) makes rsigma refuse a rule load where every rule fails to parse, exiting with code 2 at startup or keeping the current rules on reload; a new rsigma_rule_parse_errors gauge counts skipped rules during partial-failure loads. RuntimeEngine::load_rules now returns an error when every rule fails to parse or when any parse error occurs after RuntimeEngine::set_strict_rules(true), and EngineStats gains a new parse_errors field that struct-literal callers must set.
— Names flag, config key, exit code, gauge, and API changes precisely.v0.26.0
└──▷ BREAKING ON UPGRADE
!
RuntimeEngine::load_rules now returns an error when every rule fails to parse, or when any parse error occurs after RuntimeEngine::set_strict_rules(true). Code that relied on a silent empty engine must handle the new error path.
!
EngineStats gains a new parse_errors field; code that constructs EngineStats with a struct literal must set it.
!
EVTX bool fields with values other than 0 and 1 now reach rules as integers instead of true.
!
EVTX GUIDs are now lowercase and in braces (e.g. {54849625-5478-4994-a5ba-3e3b0328c30d}); rules that match a whole GUID without braces must be updated.
!
Unset Data, Binary, and optional System EVTX fields are now omitted rather than present and empty; rules that match on empty values for these fields will no longer fire.
!
Consecutive Data elements with the same name in EVTX records now become a single array field; a later occurrence gets a numbered suffix (e.g. LogonGuid_1).
Tines lets teams put AI to work across their most sensitive systems, data, and processes, with the security and governance to do it safely.
Tines now lets tenant owners configure automatic fallback models for their default AI models, improving resilience when a primary model is unavailable.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
└──▷ WHAT SHIPPED ·
1 FEATURE0 OF 1 FEATUREmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Tenant-wide fallback models for default AInew55how completely this was documenteddepth20/40specificity20/30actionability15/3055 / 100
Tenant owners can set an ordered list of up to five fallback models for the tenant's default smart and fast AI models, so requests automatically fall back if the primary model is unavailable.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Jamf Pro, enterprise-level Mobile Device Management (MDM) software, manages and secures Apple devices with advanced tools and integrations.
Jamf Pro introduces declarative, vendor-direct deployment and auto-updating of non-App Store Mac apps through a new App Lifecycle Management Engine (ALME), removing the need for manual repackaging.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
└──▷ WHAT SHIPPED ·
3 FEATURES1 OF 3 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0101
Declarative Mac app deployment via ALM Enginenew90how completely this was documenteddepth35/40specificity30/30actionability25/3090 / 100
Jamf Pro can deploy and automatically update non-App Store Mac apps by declaring them in blueprints through the App Lifecycle Management Engine (ALME), eliminating manual repackaging for third-party apps.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Apps are downloaded directly from vendors over TLS with checksum and signature verification before install. The ALME binary ships inside Self Service+ 2.33.0 at /Applications/Self Service+.app/Contents/MacOS/ALME.app (bundle ID com.jamf.alme), launched via /Library/LaunchDaemons/com.jamf.alme.plist and /Library/LaunchAgents/com.jamf.alme.agent.plist, and signed by JAMF Software team ID 483DWKW443.
Add a third-party Mac app to a blueprint so ALME installs and keeps it current automatically, without repackaging.
📍In Jamf Pro, go to Blueprints › select a blueprint › App Catalog › search for the app › add it to the blueprint. Set a maintenance window to control when downloads occur, then deploy.
— Names blueprints, binary paths, bundle ID, team ID, and gives UI steps.launch-20261030-0de4af72
0200
Automatic Full Disk Access for ALME via PPPC profilenew60how completely this was documenteddepth25/40specificity25/30actionability10/3060 / 100
Jamf Pro 11.33.0 automatically delivers Full Disk Access for ALME via a Privacy Preferences Policy Control (PPPC) profile for Self Service+, enabling updates to apps stored in Desktop, Documents, and Downloads folders.
Maintenance windows for ALME app updatesnew45how completely this was documenteddepth20/40specificity15/30actionability10/3045 / 100
Admins can control when app updates download and install using maintenance windows, with default notifications alerting users when an update is waiting for an app to close.
CVE-2026-103264: Unauthenticated iOS/iPadOS device API access via non-secret host identifiers (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.1, affects < 4.87.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
11 more releases in this issue
· 2026-03-27 → 2026-09-15
CVE-2026-48786: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects < 4.87.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-54245: SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. in Okta conditional access policy evaluation allows an enrolled host to compromise the Fleet database (affects < 4.86.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-41262: Cross-Team Policy Data Exposure via Global Policy Read Endpoint (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.3, affects < 4.85.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-46371: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. commands endpoint (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects <= 4.84.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-46356: IP spoofing allows bypassing API rate limiting (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects < 4.80.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-26191: OS command injectionOS command injectionAn attack that makes an application execute operating-system commands supplied through untrusted input. It often happens when input is passed unsafely to a shell. in software packages (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.8, affects < 4.81.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-34391: Windows MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. cross-device command disclosure (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects < 4.81.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-34388: Denial of Service via unhandled gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. log type in launcher endpoint (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects < 4.81.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-29180: Team maintainer can transfer hosts from any team via missing source team authorization (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.8, affects < 4.81.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-34386: SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. in MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. bootstrap package by authenticated team or global admin (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.8, affects < 4.81.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-34385: Second-order SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. in Fleet's Apple MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. profile delivery can compromise the database (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.1, affects < 4.81.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Sophos Mobile is an enterprise mobile device management (MDM) and unified endpoint management tool that secures, configures, and monitors smartphones and tablets against threats and policy violations.
Sophos Mobile adds Android EnterpriseAndroid EnterpriseA Google program that gives organizations APIs and management modes to enroll, configure, and enforce policy on Android devices through an EMM platform. restrict-assist and kiosk Home button settings, EAS proxy version display, and removes the Intune App Protection Policy integration.
Restrict assist content sharing with privileged apps (such as Google Assistant) via the 'Allow assist content sharing with privileged apps' setting in Android Enterprise Restrictions configuration.
Control kiosk navigation with the Allow Home button setting in Android Enterprise Kiosk mode configuration for use with custom launchers.
View the EAS proxy version on the EAS proxy tab of the Sophos setup page for troubleshooting.
The Microsoft Intune App Protection Policy integration has been removed; manage Intune App Protection Policies directly in the Microsoft Intune admin center.
!The Microsoft Intune App Protection Policy integration has been removed from Sophos Mobile. Admins who used it to view or edit Intune App Protection Policies must now manage those policies directly in the Microsoft Intune admin center.
CVE-2026-92764: Organization API ignores org-scoped token on /api/organizations (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.3, affects ≥ 2.4.0, < 3.1.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
1 more release in this issue
· 2026-06-25 → 2026-09-19
CVE-2026-62282: Server-Side Request Forgery (SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly.) in notifications (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects < 3.0.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
syzkaller is an unsupervised coverage-guided kernel fuzzer
syzkaller's executor cover filter now uses a hash table, removing the 8-region PC limit; aflow separates impact analysis from root cause.
syzkaller's executor now uses an open-addressed hash table instead of a fixed 3-level region table in cover_filter.h, removing the previous limit of 8 distinct 1 GB PC regions.
syzkaller's aflow package now separates impact analysis from root cause analysis.
CVE-2026-94613: Denial of Service via Malformed SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. Messages (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects <= 2026.8.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
23 more releases in this issue
· 2024-11-21 → 2026-09-09
CVE-2026-94611: Certain stored credentials readable with view permission alone (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.1, affects <= 2026.2.6)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-94612: Authentication bypass in SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. Sources via assertion confusion and replay (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.4, affects <= 2026.2.6)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-94609: Privilege escalationPrivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. via delegated group and user management (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.8, affects <= 2026.5.6)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-94606: MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. bypass via recipient override in the email authenticator (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.9, affects <= 2026.8.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-61574: RAC endpoints and their stored credentials are exposed to any authenticated user, and connections can cross application boundaries (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.8, affects <= 2026.5.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-57580: Account Takeover via SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. NameID Comment Truncation (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.7, affects <= 2026.5.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-55106: LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. Source debug endpoint accessible without authorization (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects <= 2026.2.5)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-49443: UserSourceConnection.user and GroupSourceConnection.group are changeable through the API (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.8, affects <=2025.12.5)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-49448: SourceStage bypass via empty POST (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.8, affects <=2025.12.5)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-47201: XML Signature Wrapping in SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. Source ACS allows authentication as arbitrary federated user (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.5, affects <= 2025.12.5)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-41569: WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.1, affects <= 2026.2.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-42849: Reflected XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. in SFE (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.3, affects <= 2026.2.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-41577: SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. source does not validate Conditions, timing, or audience on assertions (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects <= 2025.2.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-40166: Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/ (affects <= 2026.2.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-25227: Authenticated Remote Code Execution via Policy/Property Mapping test endpoint (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.1, affects >= 2021.3.1, < 2025.8.6)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-25748: Forward authentication bypass with malformed session cookie on Traefik and Caddy (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.6, affects <= 2025.10.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-64708: Invitation expiry is delayed by at least 5 minutes (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.8, affects <= 2025.10.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-64521: Deactivated service account can authenticate to OAuth (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.8, affects <= 2025.10.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-53942: Insufficient check for account active status when authenticating with OAuth/SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. Sources (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.4, affects < 2025.6.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-52553: Insufficient Session verification for Remote Access Control endpoint access (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.6, affects < 2025.6.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-29928: Deletion of sessions did not revoke sessions when using database session storage (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.0, affects < 2025.2.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2024-52307: Timing attack due to a lack of constant time comparison for metrics view (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.6, affects < 2024.10.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
A high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.
CVE-2026-61709: OpenFGA Improper Policy Enforcement (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects <= 1.18.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
1 more release in this issue
· 2023-09-26 → 2026-07-16
CVE-2023-43645: DoS from circular relationship definitions (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.9, affects <1.3.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
JumpCloud makes it simple to manage Windows, Apple, Linux, and Android devices and to deliver secure access with SSO, MFA, Zero Trust, RADIUS, and more.
JumpCloud shipped new REST APIsREST APIsA convention for building HTTP-based interfaces where resources are addressed by URL and manipulated with standard verbs like GET, POST, and DELETE, giving cyber tools a predictable way to integrate with external services. for managing AI agent identities, agent uninstall protection with maintenance tokens, and a batch of User Portal, policy, and JumpCloud Go improvements.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
└──▷ WHAT SHIPPED ·
6 FEATURES0 OF 6 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Agent Uninstall Protection for managed devicesnew95how completely this was documenteddepth35/40specificity30/30actionability30/3095 / 100
Blocks unauthorized removal of the JumpCloud agent, on by default for agent v2.179.2 or later on macOS, Windows, and Linux, requiring a per-device maintenance token to authorize uninstall.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Admins manage exemptions using the Disable Agent Uninstall Protection policy and view protection status (On, Off, or Failed) from device details or the Devices list.
Retrieve a device's maintenance token to authorize agent uninstall on a specific managed device during maintenance.
📍In the Admin Portal, go to Device Management › Devices, select the device, open device details, and under Settings › Agent Uninstall Protection, click View Maintenance Token.
New Windows user-level MDM and registry policiesnew80how completely this was documenteddepth30/40specificity30/30actionability20/3080 / 100
Two new Windows user-level policies: the User Level Custom Windows MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. (OMA-URI) Policy for configuring custom MDM settings on a user's profile, assignable to users or user groups on MDM-enrolled devices, and the User Level Windows Custom Registry Keys Policy for managing Windows registry values under HKEY_CURRENT_USER for an assigned user's profile at sign-in, requiring no MDM enrollment or device restart.
Custom login banners and announcements in User Portalnew75how completely this was documenteddepth25/40specificity25/30actionability25/3075 / 100
Admins can create login dialogs and announcement banners for users in the User Portal, targeted by user group with configurable severity and message type, via the new Custom Messaging feature under Settings > User Portal > Custom Messaging.
Automatic device registration and browser discovery in JumpCloud Goimproved75how completely this was documenteddepth30/40specificity25/30actionability20/3075 / 100
JumpCloud Go now automatically registers managed Windows, macOS, and Linux devices after user sign-in, with admin control over device eligibility via device exclusion groups. It also enables browser discovery deployment for AI and SaaS ManagementSaaS ManagementA category of software that tracks, governs, and optimises an organisation's portfolio of SaaS subscriptions, covering spend, access, and licence utilisation from a single control plane. through third-party MDM by copying the Client ID and Client secret from Settings into the JumpCloud Go extension distribution policy.
Personal folders for applications in User Portalnew60how completely this was documenteddepth20/40specificity20/30actionability20/3060 / 100
Users can create personal folders to organize assigned applications on the All Applications page in the User Portal, accessible at All Applications > Folders.
CVE-2023-36811: Pre-1.2.5 archives spoofing vulnerability (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.7, affects <1.2.5)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2020-3996: Restored PersistentVolumes may be bound to wrong PersistentVolumeClaims (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.5, affects v0.*, v1.*)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Kopia is an open-source backup tool for Windows, macOS, and Linux with incremental snapshots, client-side end-to-end encryption, compression, and deduplication, with both a CLI and a GUI.
CVE-2026-45695: RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. via SSH ProxyCommand Injection (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.8, affects <= 0.22.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Automatically provision and manage TLS certificates in Kubernetes
CVE-2026-62290: Direct ACMEACMEAn IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.3, affects >= 1.18.0, <= 1.20.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
1 more release in this issue
· 2026-02-02 → 2026-06-25
CVE-2026-25518: cert-manager-controller DoS via Specially Crafted DNS Response (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.9, affects v1.18.0,v1.18.1,v1.18.2,v1.18.3,v1.18.4,v1.19.0,v1.19.1,v1.19.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Let's Encrypt/ACME client and library written in Go
CVE-2026-40611: Arbitrary File Write via Path Traversal in Webroot HTTP-01HTTP-01An ACME protocol challenge type, defined by the IETF, where a CA verifies domain ownership by fetching a token over plain HTTP on port 80. Cyber tools use it to automate TLS certificate issuance. Provider (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.8, affects all)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
1 more release in this issue
· 2025-08-06 → 2026-04-15
CVE-2025-54799: github.com/go-acme/lego/v4/acme/api does not enforce HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. (affects <=4.25.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.
CVE-2026-30836: Authorization bypass in SCEPSCEPSimple Certificate Enrollment Protocol, an IETF-standardized protocol for automating X.509 certificate issuance and renewal over HTTP, letting cyber tools request PKI certificates from a CA without manual intervention. provisioner (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 10.0, affects < v0.30.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
1 more release in this issue
· 2025-12-03 → 2026-03-19
CVE-2025-66406: Improper Authorization Check for SSH Certificate Revocation (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.0, affects <= v0.28.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Open source smart card tools and middleware. PKCS#11/MiniDriver
CVE-2023-5992: Side-channel leaks while removing encryption RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. PKCS#1 v1.5 padding in OpenSC (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.9, affects 0.24.0 and before)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Cryptomator for Windows, macOS, and Linux: Secure client-side encryption for your cloud storage, ensuring privacy and control over your data.
CVE-2026-33472: Bypass of CVE-2026-32303 fix: getAuthority() port-based scheme confusion allows HTTP downgrade of Hub token exchangetoken exchangeAn OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user. (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.8, affects = 1.19.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
4 more releases in this issue
· 2023-08-07 → 2026-04-16
CVE-2026-32310: Unverified masterkeyfile key IDs can access arbitrary local or UNC paths (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.1, affects >= 1.6.0, <= 1.19.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-32303: Tampered vault configuration allows MITM attack on Hub API (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.6, affects < 1.19.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-32309: Hub unlocking accepts plaintext HTTP and unvalidated endpoint schemes (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects <= 1.19.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2023-39520: MSI installer allows Local Elevation of Privileges #2 (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.8, affects <=1.9.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
A scalable overlay networking tool with a focus on performance, simplicity and security
CVE-2026-25793: Blocklist Bypass possible via ECDSAECDSAThe elliptic-curve signature algorithm behind most TLS certificates, blockchains and many hardware keys. It is one of the algorithms post-quantum signatures are meant to replace. Signature Malleability (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.1, affects >= 1.7.0, <= 1.10.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Tailscale creates private WireGuard-based mesh networks with centralized identity and access controls.
CVE-2023-28436: Non-interactive Tailscale SSH sessions on FreeBSD may use the effective group ID of the tailscaled process (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.7, affects >=1.34.0, <1.38.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
1 more release in this issue
· 2022-11-21 → 2023-03-22
CVE-2022-41924: Tailscale Windows daemon is vulnerable to RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. via CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session. (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.6, affects <1.32.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
The easiest, and most secure way to access and protect all of your infrastructure.
CVE-2025-49825: Remote authentication bypass (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.8, affects <17.5.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2021-44716: Unbounded memory usage on exposed HTTP/2 (non-gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication.) endpoints (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects Before 1.0.3 and 1.1.x before 1.1.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
2 more releases in this issue
· 2021-03-04 → 2022-01-07
CVE-2021-27099: Path Normalization issue in aws_iid Node Attestor (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.8, affects <0.8.4, <0.9.4, <0.10.2, <0.11.3, <0.12.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2021-27098: Legacy Node API Allows Impersonation (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.1, affects 0.8.1-0.8.4, <0.9.4, <0.10.2, <0.11.3, <0.12.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
easy, fast, programmable and local-first microVM runtime and library
CVE-2026-61669: Snapshot Import Symlink Traversal Arbitrary File Write (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.1, affects >= 0.4.4, < 0.5.8)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
2 more releases in this issue
· 2026-06-23 → 2026-10-09
CVE-2026-103034: Guest-controlled symlinks in msb copy allow arbitrary file write on the host (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.1, affects >= 0.5.3, < 0.6.7)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-61670: Secret values exposed in world-readable process arguments (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects >= 0.3.0, < 0.5.10)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
SkillSpector's latest release adds configurable scan-performance limits alongside new detections for npx-based MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. configs, agent-memory file writes, ransomware-like file behavior, Pipenv dependencies, and credentials flowing through urllib request headers.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
└──▷ WHAT SHIPPED ·
9 FEATURES0 OF 9 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Configurable batch, workflow and LLM concurrency limitsnew90how completely this was documenteddepth30/40specificity30/30actionability30/3090 / 100
Control the tool-description comparison batch limit with SKILLSPECTOR_TP4_MAX_BATCHES (default 256), the workflow deadline with SKILLSPECTOR_MAX_WORKFLOW_SECONDS (default 1,080 seconds), and LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. concurrency with SKILLSPECTOR_MAX_LLM_CONCURRENCY.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Run a large skill collection scan without hitting the default 256-batch or 18-minute limits by raising both caps for a provider with high throughput.
— Named env vars with defaults and a runnable examplev2.13.3
thinner coverage below
0200
npx inspection and credential filename recognition in MCP configsnew50how completely this was documenteddepth20/40specificity20/30actionability10/3050 / 100
SkillSpector now inspects npx commands in JSON MCP configurations and recognizes additional Claude, Cline, and Roo Code credential and configuration filenames.
— Names targets but no flag or command shownv2.13.3
0300
Bounded YARA signal for ransomware-like behaviornew45how completely this was documenteddepth25/40specificity15/30actionability5/3045 / 100
SkillSpector adds a bounded YARA signal for nearby directory walking, encryption, and binary writes across lines to surface potential ransomware-like behavior alongside existing stronger rules.
— Explains detection logic, no user-facing controlv2.13.3
0400
Report destination overwrite protectionnew45how completely this was documenteddepth20/40specificity15/30actionability10/3045 / 100
SkillSpector now rejects baseline and recursive report destinations that would overwrite the primary input or a discovered child skill's input, including file aliases.
— Describes the safety check's exact conditionsv2.13.3
0500
Detection of writes to agent-memory filesnew40how completely this was documenteddepth20/40specificity15/30actionability5/3040 / 100
SkillSpector now detects writes to known agent-memory files and directories from automatically run test carriers, including raw Windows paths.
— Describes mechanism but no configurable surfacev2.13.3
0600
Pipenv dependency extraction and locked version checksnew40how completely this was documenteddepth20/40specificity15/30actionability5/3040 / 100
SkillSpector now extracts Pipenv dependencies and checks locked versions, preserving incomplete coverage for malformed or unsupported dependency declarations.
— States scope and caveat but no command shownv2.13.3
0700
Non-English findings included in batch-scan verdictsimproved40how completely this was documenteddepth20/40specificity15/30actionability5/3040 / 100
Non-English gap-fill findings are now included in contributed batch-scan scores, recommendations, and exit status instead of retaining a stale SAFE verdict.
— Describes the fix but no reproduction stepsv2.13.3
0800
Tracks credentials through urllib request headersimproved35how completely this was documenteddepth15/40specificity15/30actionability5/3035 / 100
SkillSpector now follows credential reads nested in urllib request headers into network sinks.
Incomplete-inspection reporting for missing YARA rule directoryimproved35how completely this was documenteddepth15/40specificity15/30actionability5/3035 / 100
SkillSpector now reports incomplete inspection when a requested custom YARA rule directory is unavailable.
Giskard tests and evaluates LLM applications for performance, bias, and security issues.
CVE-2026-40319: Regular Expression Denial of Service (ReDoSReDoSA denial-of-service attack that exploits catastrophically backtracking regular expressions, causing a regex engine to consume exponential CPU time on crafted input; tools use detection of vulnerable patterns to flag risky code.) in RegexMatching Check (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.5, affects <= 1.0.1b1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
3 more releases in this issue
· 2024-11-14 → 2026-04-13
CVE-2026-40320: Unsandboxed Jinja2 Template Rendering in ConformityCheck (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.8, affects <= 1.0.1b1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-34172: Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.8, affects <= 0.3.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2024-52524: ReDoSReDoSA denial-of-service attack that exploits catastrophically backtracking regular expressions, causing a regex engine to consume exponential CPU time on crafted input; tools use detection of vulnerable patterns to flag risky code. in Giskard Scan text perturbation (affects <= 2.15.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Open-source AI agent firewall for MCP security and agent egress. Scans mediated HTTP, MCP, A2A, and WebSocket traffic for exfiltration, SSRF, and prompt injection, and emits mediator-signed action receipts: verifiable audit evidence from outside the agent.
CVE-2026-91179: hostile-model preset: shell-profile destination-write bypass via MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. move_file (equivalent-operation coverage gap) (affects <= 3.5.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
3 more releases in this issue
· 2026-08-20 → 2026-10-03
CVE-2026-91180: Pipelock media policy bypass through mismatched response content types (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects >= 2.2.0, < 3.5.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-91178: URL DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Scanner Bypass via Path-Query Secret Splitting (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.8, affects < 3.4.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
The nono runtime runs AI agents in isolated environments with policy-controlled filesystem, network, and credential access.
CVE-2026-47128: nono: Sandbox escape on Linux via D-Bus: systemd-run --user (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.1, affects < 0.55.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
The code-oss project is an open-source code editor combining editing, debugging, and extensibility for developers across Windows, macOS, and Linux.
CVE-2026-78461: Security Feature Bypass via Notebooks (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.4, affects < 1.136.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
7 more releases in this issue
· 2026-08-11 → 2026-10-13
CVE-2026-69370: Remote Code Execution via Workspace-injected Error Notification Link (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.8, affects < 1.141.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-102229: Information Disclosure via Remote Webview Resource Path Traversal (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.8, affects < 1.141.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-102233: Workspace Trust Bypass via Terminal Relaunch and Reuse (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.8, affects < 1.141.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-81380: Information Disclosure through Automatic Remote Image Fetch in Chat (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects < 1.136.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-81377: Visual Studio Code MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. gallery metadata path traversal (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects >= 1.0.0, < 1.136.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-81381: Azure DevOps access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. disclosure through GitHub Copilot Chat workspace settings (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects < 1.136.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-69320: Visual Studio Code web deployments - environmentService.ts - RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. via NODE_OPTIONS--import from URL payload (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.8, affects < 1.132.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-105785: Password reset accepts any valid per-user token including CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session. tokens and email-confirmation tokens because the token store has no purpose/type field, enabling full account takeover from a leaked CSRF token or a scanned confirmation-email link (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.8, affects 3.7.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-105783: Any website open in the browser can trigger and win Joplin's Web Clipper pairing dialog, stealing the permanent full-access API token, because the local server has no Origin/Referer restriction and the confirmation dialog shows no identifying information (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.0, affects 3.7.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-105784: Whiteboard note content is rendered into the main application document, bypassing the note-viewer origin isolation and allowing CSS injection with a remote-controlled exfiltration channel (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.6, affects current dev)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-46649: SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint (affects <= 3.3.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-46650: Stored XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. in public share viewer via javascript: URL bypass in isAcceptedUrl (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.4, affects <= 3.5.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-49450: Joplin desktop Windows auto-updater accepts signed installer from any publisher because app-update.yml has no publisherName (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.1, affects <= 3.6.14)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-49453: Path traversal in resource sync — silent arbitrary file write outside the resource directory (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.0, affects <=3.7.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-55105: Fountain embeds allow arbitrary script execution in published notes and the note viewer (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.7, affects <=3.7.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-55210: SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties. account takeover via email-based account linking (missing is_external check in ssoLogin) (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.4, affects <= 3.7.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-55179: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects <=3.7.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-55456: Path traversal vulnerability in sync logic allows a malicious sync target to create and overwrite arbitrary files (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.8, affects <=3.7.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-59814: Stored XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. via inline-served note attachment on published shares (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.6, affects <= 3.7.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-59816: Path traversal in transcribe proxy endpoint via URL-encoded slash (CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-22) (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.3, affects <= 3.7.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-59815: Pending share recipients can write items into shared folders before accepting invitations (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.3, affects <= v3.6.15)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-57798: Denial of Service (DoS) via Uncontrolled Resource Allocation in Joplin Title Input (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.5, affects < 3.3.13)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-27409: Path traversal in Joplin Server (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects <= 3.3.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-24028: XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. in Rich Text Editor allows arbitrary code execution (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.8, affects 3.2.6 - 3.2.11)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2024-53268: Lack of validation on openExternal allows XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.2, affects <3.0.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2024-49362: XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. on <a> Link in markdown preview (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.7, affects 3.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2024-40643: Parsing error leading to XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.6, affects 3.0.13)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2023-39517: XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. when clicking on an untrusted <map> link (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.3, affects < 2.12.8)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-59831: Connecting to a malicious Codespace via gh codespace jupyter could allow command execution on the user's computer (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.4, affects >= v2.10.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-48501: Incorrect authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.4, affects <= v2.92.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-25204: gh attestation verify returns incorrect exit code during verification when predicate types mismatch (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.3, affects >= v2.49.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2024-53858: Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects <= 2.62.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
A customizable and powerful penetration testing reporting platform for offensive security professionals. Simplify, customize, and automate your pentest reports with ease.
CVE-2026-81182: Unauthorized file disclosure by broken access control in writable shared notes (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.2, affects <=2026.61)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
6 more releases in this issue
· 2024-05-21 → 2026-08-20
CVE-2026-81180: Authenticated RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. by insecure image processing (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.8, affects <=2026.55)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-81179: Host header injection might allow account takeover (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.1, affects <=2026.55)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-42291: Read-write access to personal notes by sharing-link creation with no authorization in SysReptor Professional (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.8, affects >=2026.4;<2026.27)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-66561: Authenticated Stored Cross-Site Scripting (XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session.) (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.3, affects <=2025.96)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-59945: Privilege Escalation by Authenticated Users (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.1, affects 2024.74-2025.81)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2024-36076: Cross-Site Websocket Hijacking in SysReptor (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.8, affects >= 2024.28 <= 2024.30)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Feature-rich single-binary file server for red teamers and developers. HTTP/S · WebDAV · FTP/SFTP · SMB · LDAP/S · NTLM hash capture · DNS/SMTP callbacks · TLS · Auth · Share links.
CVE-2026-114518: Unauthenticated attackers can bypass basic auth via the ConPtyShell route exemption (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.8, affects >= 2.1.1, <= 2.1.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
2 more releases in this issue
· 2026-07-27 → 2026-07-29
CVE-2026-114504: goshs --no-delete/--upload-only bypass: PUT/POST overwrite of existing files destroys contents (HTTP and WebDAV) (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.1, affects <= 2.1.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-66063: Path Traversal (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects <= 2.1.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
A generic and extendable WebDAV server based on WSGI
CVE-2026-55560: FilesystemProvider: follow_symlinks=false guard is leaf-only — root escape via intermediate symlink (read/write/delete) (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.4, affects <= 4.3.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
3 more releases in this issue
· 2022-11-11 → 2026-06-27
CVE-2026-55509: Blind SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. in WsgiDAV MySQL provider (affects <= 4.3.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-48099: Encoded dot segments can escape WsgiDAV filesystem share roots (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.1, affects <= 4.3.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2022-41905: Cross Site Scripting vulnerability in wsgidav when directory browsing is enabled (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.2, affects >=3.0.0a1,<4.1.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-35206: Helm Chart extraction output directory collapse via Chart.yaml name dot-segment (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.4, affects <=3.20.1,<=4.1.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
16 more releases in this issue
· 2020-04-22 → 2026-04-09
CVE-2026-35204: Path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.6, affects >=4.0.0,<=4.1.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2026-35205: Plugin verification fails open when .prov is missing, allowing unsigned plugin install (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.8, affects >=4.0.0,<=4.1.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-55198: Incorrect YAML Content Leads To Panic (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects <= 3.18.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-55199: Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects <= 3.18.4)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-53547: Chart Dependency Updating With Malicious Chart.yaml Content And Symlink (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.5, affects <= 3.17.3, >= 3.18.0, <= 3.18.3 )︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-32386: Specially Crafted Chart Archive Can Cause Out Of Memory Termination (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects < 3.17.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2025-32387: Specially Crafted JSON Schema Can Cause Stack Overflow (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects < 3.17.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2024-25620: Dependency management path traversal (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.4, affects < 3.14.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2023-25165: getHostByName Function Information Disclosure (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.3, affects v3.0.0 - v3.11.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2022-23524: Denial of service through string value parsing (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects <= v3.10.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2021-32690: Repository credentials passed to alternate domain (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.6, affects <=3.6.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2021-21303: Unsanitized data displayed directly to user's terminal (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.8, affects >3.0 and < 3.5.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2020-15187: plugin.yaml file allows for duplicate entries (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.7, affects 2.0.0-2.16.10, 3.0.0-3.3.1)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2020-4053: Plugin archive directory traversal (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.8, affects 3.0.0-3.2.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2020-7919: CVE-2020-7919 (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects 2.0.0-2.16.7,3.0.0-3.0.3)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2020-11013: lookup Function Information Discolosure (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.0, affects 3.1.0-3.1.2)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
A complete implementation of the MS-NLMP documents as a GSSAPI mechanism
CVE-2023-25566: Memory leak when parsing usernames (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects <= 1.1.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
CVE-2023-25567: Out-of-bounds read when decoding target information (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects <= 1.1.0)︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
bpf-linker v0.13.0 adds support for the static relocation model and speeds up BTFBTFBPF Type Format, a metadata format in the Linux kernel that embeds type and debug information directly into eBPF programs, letting cyber tools inspect kernel structures safely without kernel headers at runtime. sanitization by reusing LLVM metadata.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
BPF static linker
bpf-linker v0.13.0 adds support for the static relocation model and speeds up BTFBTFBPF Type Format, a metadata format in the Linux kernel that embeds type and debug information directly into eBPF programs, letting cyber tools inspect kernel structures safely without kernel headers at runtime. sanitization by reusing LLVM metadata.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
└──▷ WHAT SHIPPED ·
2 FEATURES0 OF 2 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Faster BTF sanitization via LLVM metadata reuseimproved35how completely this was documenteddepth20/40specificity10/30actionability5/3035 / 100
bpf-linker's BTF sanitizer now reuses LLVM metadata, reducing redundant processing during BTF generation.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
— Explains mechanism but no numbers or config surface.v0.13.0
0200
Static relocation model supportnew10how completely this was documenteddepth5/40specificity5/30actionability0/3010 / 100
bpf-linker adds the static relocation model, per the release summary, though no further mechanism or usage detail is given.
— Named only in summary, no detail provided.v0.13.0
THE CYBER TOOLCHAIN
NO. 128