Published file metadata, source observations, indicators, and research history in one bounded catalog.
2,400+Reachable catalog records
25 / 100Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
intelligence_src_732996d4d78decf6b7Recent successful batchLast successful batch: Last attempt:
intelligence_src_73ba0793d1fe5583a7Recent successful batchLast successful batch: Last attempt:
intelligence_src_76a89e0f44c80e7320Recent successful batchLast successful batch: Last attempt:
intelligence_src_76fb23c8e9cb17d5c8Recent successful batchLast successful batch: Last attempt:
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
2,400+ MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
Upgrade highlights: If you use plugins that are adding new endpoints to the API, you need to fix Resource imports before upgrade: What's changed New features and improvements: Support for Prometheus metrics (#908, Prometheus metrics docs) Refactored search engine to improve search performance for configs, attributes and file names (#906) UI: changed attribute adding modal to always show preview and make JSON values less concerning (#921) Limited default verbosity of logs (#909, see note about enable_debug_log) Added support for execute attribute that is passed to Karton to enable/disable execution in sandbox (#904, thanks @msm-cert) Flask-Limiter was replaced with direct use of limits library (#915) Dropped usage of Flask-Restful (#916) Bug fixes: Fix: installation issues on Debian 12 (bumped psycopg2-binary to 2.9.9, #922) Fix: ISE 500 on user removal (#913) Fix: Don't treat 0 number as an empty attribute value (#920) Fix: MWDB doesn't surrender on Karton when can't be loaded eagerly and tries to load it lazily (#919) Web: Fixed race condition with applying request_timeout value (#905) Full Changelog: v2.11.0...v2.12.0
First reported Mar 08, 2024 16:34 UTCCatalog metadata updated Oct 14, 2026 11:37 UTCOpen evidence record
This release contains minor frontend bugfixes. What's changed: Fixed CSS for relations graph tags (by @yankovs in #1054) Fix: set maxHeight to 100% for ConfirmationModal (set to 80% in v2.15.0) to keep compatibility with plugin modals that doesn't show correctly (#1055) Added ability to add custom content style to ConfirmationModal (by @yankovs in #1053) Thanks @yankovs for contributions! Full Changelog: v2.15.0...v2.15.1
First reported Jul 29, 2025 17:03 UTCCatalog metadata updated Oct 14, 2026 11:37 UTCOpen evidence record
This release contains major improvements of OpenID Connect integration, as well as further performance enhancements for objects with large numbers of relationships. Due to small changes in Karton API and transition to uv - please read What's changed section for v2.17.0 before upgrade New features: File.zip_file: support for custom password (by @psrok1 in #1099) OIDC: Optional administrator approval for new OIDC registrations (by @psrok1 in #1127) Improvements: Paginated Karton analyses list and optimized handling of object relationships (by @psrok1 in #1095) Use UV for package management (@yankovs in #1096) ZIP downloads doesn't load whole file into memory while zipping. ZIPs are compressed and streamed out in chunks internally (by @psrok1 in #1108) Web: memoizations in InjectAfter, RichAttributeValue and ObjectContext.object (by @psrok1 in #1120) Refactor: remove unused ObjectContext.objectError (by @psrok1 in #1121) Pending users: send mail without password link when passwords are disabled (by @psrok1 in #1131) Docs: better OpenID Connect documentation including recent changes (by @psrok1 in #1129) Bugfixes: Multiple bugfixes related to OpenID Connect (#1127 and #1130) Thanks @yankovs for contributing the transition to uv! Full Changelog: v2.16.1...v2.17.0
First reported Feb 10, 2026 11:07 UTCCatalog metadata updated Oct 14, 2026 11:37 UTCOpen evidence record
New features and improvements: Performance improvements: Set collation of some string fields to 'C' to better utilize btree index. Be aware that database migration may took a while (#959) Add index on comment.object_id column (#988) Open-ID Connect improvements: Fetching userinfo claims from userinfo endpoint, previously we assumed that they'll be send along with ID Token (#972) Plugin-customizable OpenIDProvider class (#982) OpenID Provider group is no longer a workspace and doesn't imply sharing objects within group (#974) Custom rate limit settings for specific group of users (#987) Allow to set limit of tags returned by TagListResource (#960) Bugfixes: Fix internal server error when querying without field (by @msm-cert in #957) Fix: 'mwdb-core configure web' command after transition to Vite (#966) Fix: 'Back' doesn't work in RecentView because of navigation loop (#975) Full Changelog: v2.13.0...v2.14.0
First reported Oct 07, 2024 10:51 UTCCatalog metadata updated Oct 14, 2026 11:37 UTCOpen evidence record
Highlights: Minimum supported Python version is 3.10 (#1070) New features and improvements: UI: Strings preview mode (by @KWMORALE in #1051) Rich attributes: added arrayIndex and isLastElement local variables in array sections (#1060) UI: Object actions are grouped in dropdown (by @KWMORALE in #1063) Performance improvement: objects are ordered by upload_time, not (only) by id, so index is better utilized (#1068) UI: Search field supports syntax coloring and autocompletion (by @psrok1 in #1072) Password-based login can be disabled (#1083) CLI: set-admin-password utility command to set admin password (by @psrok1 in #1084) Web plugins: InjectAfter - allow to inject component in the middle of the original children list (by @psrok1 in #1085) Bugfixes: Rich attribute: disable auto-URL rendering that breaks URLs and e-mail addresses (#1059) Consistent hooks calling (#1071) New Contributors @clin1234 made their first contribution in #1066 Full Changelog: v2.15.1...v2.16.0
First reported Dec 01, 2025 13:22 UTCCatalog metadata updated Oct 14, 2026 11:37 UTCOpen evidence record
New features: MWDB groups management with OpenID Connect (by @dev-cti in #1147) You can read more about this feature here: "Manage MWDB groups from OpenID Provider groups" documentation chapter Thanks for @dev-cti for contribution! Improvements: UI: Removed noisy toast 'You need to authenticate before accessing this page' after navigating to / (by @psrok1 in #1136) UI: Less confusing attribute uncollapse (replacement for three dots) (by @psrok1 in #1185) UI: Indicate in group settings that group is immutable (by @psrok1 in #1208) Optimized object deletion: database-level cascades and ObjectPermission.related_object_id index (by @psrok1 in #1174) UI (dev): Debug boxes to enhance discoverability of Extendable components (by @psrok1 in #1182) UI (dev): Add more Extendable wrappers to improve UI extensibility (by @psrok1 in #1183) Dev: Switch from python-ssdeep to simple ctypes wrapper over libfuzzy2 (by @psrok1 in #1151) Dev: Switch from black/isort to ruff for linting and formatting (by @psrok1 in #1155) Dev: Better SQL profiler - counting SQL queries, more context about emitted query by @psrok1 in #1210 Bugfixes: Fix: installation issues on setuptools<82 (by @psrok1 in #1137) Fix ISE 500 when too long password was provided during login (by @psrok1 in #1135) Fix e-mail address validation in UI that doesn't accept various gTLD (by @psrok1 in #1166) Fix deprecated datetime.utcnow() calls (17 instances across 9 files) (by @MichaelMVS in #1178) Fix: 'admin' initial private group should be immutable (as all private groups) (by @psrok1 in #1206) New Contributors @MichaelMVS made their first contribution in #1178 @dev-cti made their first contribution in #1147 Full Changelog: v2.17.0...v2.18.0
First reported Jun 02, 2026 14:50 UTCCatalog metadata updated Oct 14, 2026 11:37 UTCOpen evidence record
This release is focused on further improvements of search performance and bugfixes. It's recommended to upgrade your karton-system to v5.4.0 before applying this upgrade. New features and improvements: Improved performance of object lists in Web UI (#949) Improved performance of wildcard queries for JSONB fields by @psrok1 in #943 Karton is upgraded to v5.4.0 with much faster analysis status lookup method (#938) Tags are passed to Karton tasks (by @aBUDmdBQ in #934) Frontend: added warning banner when server version is different than client version, so user needs to clear cache (#950) Allow to set custom upload size limit via NGINX_MAX_UPLOAD_SIZE env var in mwdb-web Docker image (#930) Bugfixes: Fix: ISE 500 on concurrent tag addition (#926) Fix: ISE 500 when non-numerical value appears in range search in JSON column by @psrok1 in #953 Fix possible issues with plugins after replacing Flask-RESTful with own implementation (#937) Fix searching in diff mode (#941) Fix too eager schema for FileItemResponseSchema.latest_config field that affected performance of getting file items (#942) Fix unnecessary joined relationship for 'favorite' parameter affecting performance of searching and getting object lists (#948) New Contributors @aBUDmdBQ made their first contribution in #934 Full Changelog: v2.12.0...v2.13.0
First reported Jul 09, 2024 11:41 UTCCatalog metadata updated Oct 14, 2026 11:37 UTCOpen evidence record
⚠️ Security fixes: Fix: add proper authorization requirement to Remote API endpoints (by @psrok1 in #1247, GHSA-942c-r7qj-w895) Fix: remove undocumented and unintended POST method in legacy /config/<parent_dhash>, /blob/<parent_dhash> endpoints (by @psrok1 in #1248, GHSA-8fv8-wffg-4323) New features: Feature: support for Range request headers in file download (by @psrok1 in #1214) Improvements: UI: Load only first 20MiB of preview when file is bigger than that (by @psrok1 in #1218) web: Add Extendable to RecentFile view (by @dev-cti in #1235) web: Add Extendable to RecentView query buttons (by @dev-cti in #1237) Full Changelog: v2.18.0...v2.19.0
First reported Jul 29, 2026 13:18 UTCCatalog metadata updated Oct 14, 2026 11:37 UTCOpen evidence record
What's Changed CI Update actions/setup-node action to v6.5.0 by @renovate[bot] in #1635 Fixes fix(cli): flush piped output before exit by @azu in #1637 Full Changelog: v13.0.3...v13.0.4
First reported Jul 22, 2026 01:27 UTCCatalog metadata updated Oct 14, 2026 11:30 UTCOpen evidence record
What's Changed Performance fix(profiler): enable profiling only when --profile is specified by @azu in #1673 It will fix linting performance problems #1653 #1633 CI Update github/codeql-action action to v3.37.1 by @renovate[bot] in #1640 Update Minor updates by @renovate[bot] in #1643 Update github/codeql-action action to v3.37.2 by @renovate[bot] in #1645 Update github/codeql-action action to v3.37.3 by @renovate[bot] in #1646 Update github/codeql-action action to v3.37.4 by @renovate[bot] in #1657 Update github/codeql-action action to v3.37.5 by @renovate[bot] in #1661 Update github/codeql-action action to v3.37.6 by @renovate[bot] in #1664 Update github/codeql-action action to v3.37.7 by @renovate[bot] in #1667 Dependency Updates Update dependency p-map to ^7.0.6 by @renovate[bot] in #1641 Update dependency turbo to ^2.10.6 by @renovate[bot] in #1642 Update dependency turbo to ^2.10.7 by @renovate[bot] in #1644 Update dependency rollup to ^4.62.3 by @renovate[bot] in #1647 Update dependency turbo to ^2.10.8 by @renovate[bot] in #1648 Update Patch updates (patch) by @renovate[bot] in #1649 Update dependency tsx to ^4.23.4 by @renovate[bot] in #1651 Update dependency tsx to ^4.23.5 by @renovate[bot] in #1652 Update dependency tsx to ^4.23.6 by @renovate[bot] in #1655 Update dependency tsx to ^4.23.7 by @renovate[bot] in #1656 Update dependency tsx to ^4.23.8 by @renovate[bot] in #1658 Update dependency tsx to ^4.23.9 by @renovate[bot] in #1659 Update dependency tsx to ^4.23.10 by @renovate[bot] in #1660 Update Patch updates (patch) by @renovate[bot] in #1663 Update dependency turbo to ^2.10.9 by @renovate[bot] in #1662 Update dependency tsx to ^4.23.12 by @renovate[bot] in #1665 Update dependency turbo to ^2.10.10 by @renovate[bot] in #1666 Update dependency turbo to ^2.10.11 by @renovate[bot] in #1668 Update dependency vitest to ^4.1.11 by @renovate[bot] in #1669 Update dependency rollup to ^4.62.5 by @renovate[bot] in #1670 Update dependency @types/bun to ^1.4.0 by @renovate[bot] in #1671 Full Changelog: v13.0.4...v13.0.5
First reported Aug 27, 2026 00:23 UTCCatalog metadata updated Oct 14, 2026 11:30 UTCOpen evidence record
What's Changed 📝 v13.0.1 published as v13.0.2 Bug Fixes Fix secp256k1 private key detection to avoid false positives by @azu in #1564 CI ci: replace merge-gatekeeper with automerge-gate by @azu in #1543 Update github/codeql-action action to v3.35.3 by @renovate[bot] in #1546 ci(release): prevent cache poisoning by @azu in #1555 chore(CI): update to pkgdeps/automerge-gate@4.1 by @azu in #1557 Update rhysd/github-action-benchmark action to v1.22.1 by @renovate[bot] in #1558 Update github/codeql-action action to v3.35.4 by @renovate[bot] in #1563 Dependency Updates Update dependency turbo to ^2.9.8 by @renovate[bot] in #1542 Update dependency turbo to ^2.9.9 by @renovate[bot] in #1544 Update Patch updates (patch) by @renovate[bot] in #1545 Update pnpm to v10.33.4 by @renovate[bot] in #1551 Update dependency @types/node to ^25.6.1 by @renovate[bot] in #1552 Update dependency turbo to ^2.9.10 by @renovate[bot] in #1553 Update dependency @types/node to ^25.6.2 by @renovate[bot] in #1554 Update dependency turbo to ^2.9.12 by @renovate[bot] in #1556 Update textlint to ^15.6.1 by @renovate[bot] in #1559 Update dependency vitest to ^4.1.6 by @renovate[bot] in #1561 Update dependency @types/node to ^25.7.0 by @renovate[bot] in #1562 Other Changes Reorganize CLI options and update glob syntax documentation by @azu in #1540 Full Changelog: v13.0.0...v13.0.2
First reported May 15, 2026 14:45 UTCCatalog metadata updated Oct 14, 2026 11:30 UTCOpen evidence record
What's Changed Bug Fixes fix(database-connection): Ignore database connection strings with identical example credentials by @azu in #1631 Refactoring Configure TypeScript module output to NodeNext in rollup configs by @azu in #1567 CI ci(release): build docker images on native runners (no QEMU) by @azu in #1568 Update github/codeql-action action to v3.35.5 by @renovate[bot] in #1584 Update Minor updates by @renovate[bot] in #1588 Update Patch updates by @renovate[bot] in #1602 Update docker/setup-buildx-action action to v4.2.0 by @renovate[bot] in #1621 Update github/codeql-action action to v3.36.3 by @renovate[bot] in #1620 Update github/codeql-action action to v3.37.0 by @renovate[bot] in #1628 Dependency Updates Update dependency @types/bun to ^1.3.14 by @renovate[bot] in #1573 Update textlint to ^15.7.0 by @renovate[bot] in #1574 Update dependency tsx to ^4.22.0 by @renovate[bot] in #1575 Update dependency turbo to ^2.9.14 by @renovate[bot] in #1576 Update Patch updates (patch) by @renovate[bot] in #1577 Update dependency tsx to ^4.22.1 by @renovate[bot] in #1579 Update dependency tsx to ^4.22.2 by @renovate[bot] in #1581 Update dependency @types/node to ^25.9.0 by @renovate[bot] in #1582 Update dependency tsx to ^4.22.3 by @renovate[bot] in #1583 Update dependency @types/node to ^25.9.1 by @renovate[bot] in #1585 Update dependency vitest to ^4.1.7 by @renovate[bot] in #1586 Update dependency turbo to ^2.9.15 by @renovate[bot] in #1589 Update dependency turbo to ^2.9.16 by @renovate[bot] in #1591 Update pnpm to v10.34.1 by @renovate[bot] in #1590 Update dependency @rollup/plugin-commonjs to ^29.0.3 by @renovate[bot] in #1592 Update Patch updates to ^4.22.4 by @renovate[bot] in #1593 Update Minor updates to ^4.2.0 by @renovate[bot] in #1594 Update vitest monorepo to ^4.1.8 by @renovate[bot] in #1595 Update Minor updates to ^4.61.0 by @renovate[bot] in #1596 Update Patch updates to ^4.61.1 by @renovate[bot] in #1597 Update Patch updates to ^25.9.2 by @renovate[bot] in #1598 Update turbo monorepo to ^2.9.17 by @renovate[bot] in #1600 Update Patch updates (patch) by @renovate[bot] in #1601 Update turbo monorepo to ^2.9.18 by @renovate[bot] in #1603 Update Patch updates to v10.34.3 by @renovate[bot] in #1604 Update Minor updates to ^4.62.0 by @renovate[bot] in #1605 Update vitest monorepo to ^4.1.9 by @renovate[bot] in #1606 Update Patch updates to v10.34.4 by @renovate[bot] in #1607 Update Patch updates (patch) by @renovate[bot] in #1608 Update dependency turbo to ^2.10.0 by @renovate[bot] in #1610 Update dependency bn.js to ^5.2.4 by @renovate[bot] in #1611 Update dependency js-yaml to ^4.3.0 by @renovate[bot] in #1612 Update dependency p-map to ^7.0.5 by @renovate[bot] in #1613 Update dependency turbo to ^2.10.1 by @renovate[bot] in #1614 Update dependency turbo to ^2.10.2 by @renovate[bot] in #1615 Update Patch updates (patch) by @renovate[bot] in #1616 Update dependency tsx to ^4.23.0 by @renovate[bot] in #1617 Update dependency turbo to ^2.10.3 by @renovate[bot] in #1618 Update dependency vitest to ^4.1.10 by @renovate[bot] in #1619 Update dependency turbo to ^2.10.4 by @renovate[bot] in #1622 Update Patch updates (patch) by @renovate[bot] in #1623 Update Patch updates (patch) by @renovate[bot] in #1627 Update dependency tsx to ^4.23.1 by @renovate[bot] in #1629 Update dependency turbo to ^2.10.5 by @renovate[bot] in #1630 Other Changes Update Node.js to v24.16.0 by @renovate[bot] in #1587 Full Changelog: v13.0.2...v13.0.3
First reported Jul 21, 2026 14:34 UTCCatalog metadata updated Oct 14, 2026 11:30 UTCOpen evidence record
What's Changed Bug Fixes fix(secretlint): do not follow symlinks while searching files by @azu in #1694 CI Update docker/setup-buildx-action action to v4.3.0 by @renovate[bot] in #1675 Update github/codeql-action action to v3.37.8 by @renovate[bot] in #1677 Update github/codeql-action action to v3.37.9 by @renovate[bot] in #1686 ci(docker): suppress hadolint DL3064 false positives by @azu in #1695 Dependency Updates Update dependency picomatch to ^4.0.7 by @renovate[bot] in #1676 Update dependency rollup to ^4.63.0 by @renovate[bot] in #1678 Update dependency turbo to ^2.10.12 by @renovate[bot] in #1679 Update dependency js-yaml to ^4.3.2 by @renovate[bot] in #1680 Update dependency p-map to ^7.0.7 by @renovate[bot] in #1682 Update dependency rollup to ^4.63.1 by @renovate[bot] in #1683 Update dependency tsx to ^4.23.13 by @renovate[bot] in #1684 Update dependency ignore to ^7.0.7 by @renovate[bot] in #1685 Update dependency ignore to ^7.0.8 by @renovate[bot] in #1687 Full Changelog: v13.0.5...v13.0.6
First reported Sep 25, 2026 13:28 UTCCatalog metadata updated Oct 14, 2026 11:30 UTCOpen evidence record
What's Changed Features feat(@secretlint/secretlint-rule-github): support new GitHub App installation token format (ghs_) by @azu in #1520 CI Update github/codeql-action action to v3.35.2 by @renovate[bot] in #1515 Dependency Updates Update dependency rollup to ^4.60.2 by @renovate[bot] in #1513 Update dependency node-sarif-builder to ^4.1.0 by @renovate[bot] in #1516 Update dependency vitest to ^4.1.5 by @renovate[bot] in #1517 Update pnpm to v10.33.1 by @renovate[bot] in #1519 Update dependency @types/bun to ^1.3.13 by @renovate[bot] in #1521 Full Changelog: v12.2.0...v12.3.0
First reported Apr 26, 2026 02:01 UTCCatalog metadata updated Oct 14, 2026 11:30 UTCOpen evidence record
What's Changed Bug Fixes fix(binary): respect --cwd and existing config in --init by @azu in #1709 fix(config-loader): keep package name as is when baseDirectory is empty by @azu in #1710 CI Update rhysd/github-action-benchmark action to v1.22.2 by @renovate[bot] in #1693 Update Minor updates by @renovate[bot] in #1690 CI: wait for npm packages before building Docker image by @azu in #1697 Update github/codeql-action action to v3.38.1 by @renovate[bot] in #1700 Update github/codeql-action action to v3.38.2 by @renovate[bot] in #1705 Dependency Updates Update Patch updates (patch) by @renovate[bot] in #1689 Update dependency ignore to ^7.0.10 by @renovate[bot] in #1698 Update dependency turbo to ^2.11.3 by @renovate[bot] in #1699 Update dependency rollup to ^4.63.5 by @renovate[bot] in #1701 Update dependency turbo to ^2.11.4 by @renovate[bot] in #1702 Update dependency turbo to ^2.11.5 by @renovate[bot] in #1704 Update pnpm to v10.34.6 by @renovate[bot] in #1706 Full Changelog: v13.0.6...v13.0.7
First reported Oct 03, 2026 01:07 UTCCatalog metadata updated Oct 14, 2026 11:30 UTCOpen evidence record
Highlights v13 changes how files are discovered on disk and adds three credential detection rules. .gitignore is respected by default Nested .gitignore files now apply to file discovery with ripgrep semantics: rules from each directory cascade into its subtree, and a negation rule in a deeper file can flip an earlier verdict. Files excluded by any .gitignore on the path are no longer scanned. Repositories that previously relied on Secretlint scanning ignored files (such as dist/ or generated artefacts) will see fewer files in the output. .secretlintignore is unchanged and continues to apply alongside .gitignore. To restore the v12 behaviour: secretlint --no-gitignore "**/*" If a file is matched by a .gitignore rule but still appears in Secretlint's output, please open an issue at https://github.com/secretlint/secretlint/issues. Glob-shaped paths that exist on disk are treated literally --no-glob and "globs by default" both existed in v12. What changed in v13 is the fallback for inputs that contain glob metacharacters but resolve to a real file or directory. In v12, an input like src/(group)/page.tsx was always parsed as a glob, so SvelteKit / Next.js routes whose names contain (), [], {}, or ? required --no-glob. v13 runs a single stat per glob-shaped input: if it exists, the input is treated literally; otherwise it stays a glob. Pattern On disk v12 default v13 default src/(group)/page.tsx exists parsed as glob, no match matched literally src/(missing)/page.tsx absent parsed as glob parsed as glob src/[a-z]ormal.tsx normal.tsx exists matched via glob matched via glob Pass --no-glob to skip the probe and force literal interpretation. New and promoted rules Added to preset-recommend: Rule Detects @secretlint/secretlint-rule-tailscale Tailscale API keys (new package) @secretlint/secretlint-rule-stripe Stripe API keys (new package) @secretlint/secretlint-rule-cloudflare Cloudflare API tokens (promoted from preset-canary) What's Changed Breaking Changes feat!: respect .gitignore by default via @secretlint/walker by @azu in #1530 feat(secretlint-rule-preset-recommend): promote cloudflare, stripe, tailscale from canary by @azu in #1538 Features Add Tailscale API key detection rule by @azu in #1536 feat(secretlint-rule-stripe): add Stripe API key detection rule by @azu in #1537 CI Update actions/setup-node action to v6.4.0 by @renovate[bot] in #1527 Dependency Updates Update pnpm to v10.33.2 by @renovate[bot] in #1525 Update dependency ajv to ^8.20.0 by @renovate[bot] in #1528 Update textlint to ^15.6.0 (minor) by @renovate[bot] in #1529 Update dependency picomatch to ^4.0.4 by @renovate[bot] in #1534 Update dependency turbo to ^2.9.7 by @renovate[bot] in #1535 Other Changes Update Node.js to v24.15.0 by @renovate[bot] in #1514 Update dependency Bun to v1.3.13 by @renovate[bot] in #1526 Full Changelog: v12.3.1...v13.0.0
First reported May 04, 2026 12:39 UTCCatalog metadata updated Oct 14, 2026 11:30 UTCOpen evidence record
What's Changed Features Add Cloudflare API token detection rule by @azu in #1508 Documentation docs: Update README and CONTRIBUTING with new rules and corrections by @azu in #1507 chore(docker): add OCI image source label by @nozomiishii in #1511 New Contributors @nozomiishii made their first contribution in #1511 Full Changelog: v12.1.0...v12.2.0
First reported Apr 21, 2026 16:48 UTCCatalog metadata updated Oct 14, 2026 11:30 UTCOpen evidence record
What's Changed Important ⭐ These below fix CVE-2026-33691: fix(933111): prevent whitespace padding bypass in PHP double-extension upload by @fzipi in #4547 fix(933110): prevent whitespace padding bypass in PHP upload detection by @fzipi in #4546 fix(944140): prevent whitespace padding bypass in JSP file upload detection by @fzipi in #4548 🆕 New features and detections 🎉 feat(930130,930140): expand AI-based paths by @Elnadrion in #4540 feat: add aws security agent in scanners-user-agents.data by @S0obi in #4562 feat(932390): add shell fork bomb detection rule at PL2 by @fzipi in #4563 🧰 Other Changes refactor: create 941250 .ra file by @fzipi in #4520 refactor: create 942220 .ra file by @fzipi in #4511 refactor: create rule 931100 and 931110 .ra files by @Xhoenix in #4489 feat: Adding critical ai dirs that previously not exist by @HackingRepo in #4535 refactor: create 933140 and 933180 .ra files by @Xhoenix in #4488 fix(944110,944120,944130,944150,944151,944200,944210,..): don't inspect cookies twice by @touchweb-vincent in #4526 refactor: create 943120 .ra file by @fzipi in #4506 fix: false negative 932236 by @franbuehler in #4544 feat: update list of unix commands by @EsadCetiner in #4446 fix(932180): prevent whitespace padding bypass in restricted file upload detection by @fzipi in #4549 fix: harden GitHub Actions workflows by @fzipi in #4553 refactor: create 941310 .ra files by @fzipi in #4522 docs: update README by @fzipi in #4556 refactor: create 941120 .ra file by @fzipi in #4498 fix(920540): allow rule exclusions for specific targets by @EsadCetiner in #4405 fix(931130): ensure correct target is logged by @EsadCetiner in #4577 Full Changelog: v4.24.1...v4.25.0
First reported Mar 28, 2026 22:19 UTCCatalog metadata updated Oct 14, 2026 11:29 UTCOpen evidence record
What's Changed 🔒 Security fix: inspect REQUEST_FILENAME in RCE (932) rules to close path-based command injection bypass — GHSA-575j-qr6p-9763 fix: lowercase the charset parameter name so mixed-case CHARSET= cannot skip the allow-list (920480) — GHSA-89h9-2j8h-9gp2 fix: collect every _charset_ value so a second value cannot shadow a disallowed charset (922100) — GHSA-qmx4-jfcv-fgww ⭐ Important changes fix: Skip Checking Responses feature is broken by @azurit in #4807 🆕 New features and detections 🎉 feat(932380): detect Active Directory DS command-line tools by @fzipi in #4768 feat(934200): detect Velocity and FreeMarker directive syntax by @Yeagerist0 in #4774 feat(unix): detect common selinux command usage by @EsadCetiner in #4724 feat: Add Mozilla/6.0 used by scanner tools by @HackingRepo in #4784 feat: Add .claude into restricted files by @azurit in #4809 feat: Expand Restricted Files data (v3) by @HackingRepo in #4816 🪦 Rule removals feat: refactoring of response rules skipping by @azurit in #4806 🧰 Other Changes fix(913100): substring false positive with veganism.social user-agent by @EsadCetiner in #4777 fix(932270): require boundary before tilde expansion patterns by @zoutjebot in #4596 fix(956100): FP with keyword 'EOFError' inside RESPONSE_BODY by @azurit in #4752 fix(951230): FP with too broad regex for RESPONSE_BODY by @azurit in #4747 fix: close trailing-slash bypass of upload extension check (V29-260924) by @fzipi in #4815 fix(932180): enforce boundaries for high-risk false positives entries by @EsadCetiner in #4632 feat: allow application/*+json and AWS JSON content types by default by @fzipi in #4775 fix(901370): allow + inside the subtype before the +json suffix by @fzipi in #4828 fix(libmodsecurity3/coraza): substring false positive with json key named profiledata by @EsadCetiner in #4812 New Contributors @Yeagerist0 made their first contribution in #4774 Full Changelog: v4.29.0...v4.30.0
First reported Oct 03, 2026 17:49 UTCCatalog metadata updated Oct 14, 2026 11:29 UTCOpen evidence record
What's Changed ⚠️ Breaking Change Requires libmodsecurity v3.0.16 or later when running on nginx/libmodsecurity v3. The XML attribute injection fix (ctl:ruleRemoveTargetByTag=...;XML://@* in rule 901181) depends on owasp-modsecurity/ModSecurity#3589, which fixes the lexer's rejection of @ in ctl:ruleRemoveTarget* actions. On libmodsecurity v3 versions older than v3.0.16, this ctl action fails to parse, breaking config load. Fully opting out of XML attribute inspection (tx.crs_xml_attr_inspect) requires ModSecurity v2 >= v2.9.14, once owasp-modsecurity/ModSecurity#3591 is fixed upstream. Until then, ctl:ruleRemoveTargetByTag cannot remove the XML://@* target on ModSecurity v2, so rule 901181 cannot disable attribute inspection on that engine. ⭐ Important changes fix: R7U-260618 v3 by @fzipi in 4665b6d (GHSA: GHSA-f5qm-3h4p-8qhg) fix: N7Y-260316 v3 by @fzipi in 635cecf (GHSA: GHSA-6jp8-c2w2-x7wr) Full Changelog: v3.3.9...v3.3.10
First reported Jul 03, 2026 15:38 UTCCatalog metadata updated Oct 14, 2026 11:29 UTCOpen evidence record
The public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.