Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
2 sources: 0 stale, 0 needing attention, 0 paused, 2 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
The Citizen Lab submitted a response to the Research Directorate at the Immigration and Refugee Board of Canada. The post Submission to the Immigration and Refugee Board of Canada appeared first on The Citizen Lab.
First reported Sep 22, 2026 15:32 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence recordU.S. lawmakers call for sanctions on hack-for-hire companies, citing Citizen Lab report. The post Group of Bipartisan Lawmakers Ask US Government to Ban Several Hack-for-Hire Firms appeared first on The Citizen Lab.
First reported Sep 10, 2026 17:19 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence recordPsiphon, a software company that helps internet users under oppressive regimes evade online censorship, plans to leave Canada if the lawful-access bill passes. The post Toronto-Based VPN Provider Plans to Quit Canada Over Lawful-Access Bill appeared first on The Citizen Lab.
First reported Oct 06, 2026 18:13 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence recordTwo UN reports that the Citizen Lab submitted recommendations to have been published this month. The post UN Reports Citing Citizen Lab Submissions Published appeared first on The Citizen Lab.
First reported Sep 22, 2026 16:15 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence recordApple customers in 110 countries received threat notifications recently alerting them to suspected spyware attacks targeting their devices. The post ‘Unprecedented’ Number of Apple Users Received Recent Spyware Alert appeared first on The Citizen Lab.
First reported Aug 20, 2026 17:52 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence recordSenior research fellow Jon Penney spoke with Tech Policy Press about how rising surveillance is causing people to self-censor. The post A Roadmap for Confronting the Chilling Effects of Censorship, Surveillance and New Technology appeared first on The Citizen Lab.
First reported Aug 04, 2026 18:28 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence recordLast month, the Supreme Court of the United Kingdom issued a highly anticipated decision in The Kingdom of Bahrain v. Shehabi and another (Shehabi). The claimants, two Bahraini dissidents living in the U.K., allegedly suffered psychological harm after Bahrain used FinSpy spyware to hack into their devices. In an important step towards accountability, the court […] The post U.K. Supreme Court Opens
First reported Sep 02, 2026 14:14 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence recordCitizen Lab director Ron Deibert is quoted in the Guardian about Sheikh Tahnoon bin Zayed Al Nahyan’s increasing influence on AI dominance. The post Fixer, Financier, Spymaster: How the UAE’s Sheikh Tahnoon is Setting His Sights on AI Dominance appeared first on The Citizen Lab.
First reported Oct 05, 2026 13:28 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence recordJournalists and civil society are being silenced by accusations of copyright infringement, says Alberto Fittarelli in a report by the OCCRP. The post Inside the Fake Copyright Racket Silencing News Outlets appeared first on The Citizen Lab.
First reported Aug 07, 2026 15:22 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence recordCitizen Lab researchers write that restrictive immigration policies are incompatible with attempts to counter transnational repression. The post Immigration Policy: The Backdoor to Transnational Repression appeared first on The Citizen Lab.
First reported Aug 05, 2026 13:45 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence recordIndicator published by the cited source.
First reported Aug 31, 2026 17:07 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence recordIndicator published by the cited source.
First reported Aug 31, 2026 17:07 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence recordIndicator published by the cited source.
First reported Aug 10, 2026 16:35 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence recordIndicator published by the cited source.
First reported Aug 10, 2026 16:35 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence recordControl iD iDSecure Multiple Denial of Service Vulnerabilities Control iD iDSecure is an on-premises access control and time attendance management application for Windows. Version 4.8.1.0 is affected by multiple vulnerabilities:CVE-2026-92625 :Unauthenticated Service Restart Denial of Service (High): The /api/license/restartService endpoint is reachable without authentication and invokes an intern
First reported Aug 12, 2026 19:50 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence recordIndicator published by the cited source.
First reported Aug 31, 2026 17:07 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence recordScadaLTS Multiple Vulnerabilities ScadaLTS is an open-source, web-based SCADA/HMI application. Version 2.8.1-release-candidate build 0 is affected by multiple vulnerabilities:CVE-2026-84858: Authenticated Remote Code Execution via Scripting Sandbox Bypass (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)The DWR "DataSourceEditDwr" class exposes the "validateScript" method that compiles and executes attacker-s
First reported Sep 16, 2026 14:20 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence recordGogs - Authentication Bypass via Unvalidated Reverse Proxy Headers When 'ENABLE_REVERSE_PROXY_AUTHENTICATION' is enabled, Gogs accepts the configured authentication header (default: 'X-WEBAUTH-USER') directly from client requests without validating that the request originated from a trusted reverse proxy.Any remote attacker who can reach the Gogs service can forge this header to impersonate any us
First reported Jun 19, 2026 06:41 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence recordSnipe-IT Checkout Request Cancellation IDOR Snipe-IT is an open-source IT asset management application developed by Grokability, Inc. The endpoint that cancels asset checkout requests, POST /account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?}, trusts two user-controlled URL path parameters without performing a server-side authorization check. The cancel_by_admin segment is tre
First reported Aug 11, 2026 20:26 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence recordWordPress Loops & Logic - Reflected XSS A Reflected Cross-Site Scripting vulnerability exists in the Wordpress plugin 'Loops & Logic' The ‘name’ parameter of the ‘tangible_fields_fetch’ and ‘tangible_fields_store’ actions is used in the response without any filtering, resulting in a reflected XSS vulnerability. curl http://WORDPRESS/wp-admin/admin-ajax.php?action=tangible_fields_fetch&name=%3cimg+
First reported Aug 28, 2026 06:39 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence recordIndicator published by the cited source.
First reported Aug 12, 2026 19:17 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence recordIndicator published by the cited source.
First reported Aug 31, 2026 17:07 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence recordWordPress - Kubio AI Website Builder DoS The REST endpoint `GET /wp-json/kubio/v1/enable-theme` passes the client-supplied `name` parameter directly and without validation into WordPress core's `switch_theme()`:// lib/api/colibri.php function kubio_enable_theme( WP_REST_Request $data ) { switch_theme( $data['name'] ); // $data['name'] ) ); }Because `$data['name']` is not type-checked, an authorize
First reported Aug 31, 2026 15:42 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence recordGoogle Cloud Platform (GCP) Apigee Cross-Tenant Data Exfiltration via Confused Deputy Tenable Research has identified and responsibly disclosed a critical cross-tenant data exfiltration vulnerability in Google Cloud Apigee. This flaw allowed an attacker to abuse a "confused deputy" in Apigee's internal analytics infrastructure to read arbitrary Google Cloud Storage (GCS) objects across different t
First reported Aug 10, 2026 16:35 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence recordThe public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.