Published file metadata, source observations, indicators, and research history in one bounded catalog.
2,400+Reachable catalog records
89 / 100Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
intelligence_src_729691005ff8747ae3Recent successful batchLast successful batch: Last attempt:
intelligence_src_732996d4d78decf6b7Recent successful batchLast successful batch: Last attempt:
intelligence_src_73ba0793d1fe5583a7Recent successful batchLast successful batch: Last attempt:
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
2,400+ MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
Highlights v13 changes how files are discovered on disk and adds three credential detection rules. .gitignore is respected by default Nested .gitignore files now apply to file discovery with ripgrep semantics: rules from each directory cascade into its subtree, and a negation rule in a deeper file can flip an earlier verdict. Files excluded by any .gitignore on the path are no longer scanned. Repositories that previously relied on Secretlint scanning ignored files (such as dist/ or generated artefacts) will see fewer files in the output. .secretlintignore is unchanged and continues to apply alongside .gitignore. To restore the v12 behaviour: secretlint --no-gitignore "**/*" If a file is matched by a .gitignore rule but still appears in Secretlint's output, please open an issue at https://github.com/secretlint/secretlint/issues. Glob-shaped paths that exist on disk are treated literally --no-glob and "globs by default" both existed in v12. What changed in v13 is the fallback for inputs that contain glob metacharacters but resolve to a real file or directory. In v12, an input like src/(group)/page.tsx was always parsed as a glob, so SvelteKit / Next.js routes whose names contain (), [], {}, or ? required --no-glob. v13 runs a single stat per glob-shaped input: if it exists, the input is treated literally; otherwise it stays a glob. Pattern On disk v12 default v13 default src/(group)/page.tsx exists parsed as glob, no match matched literally src/(missing)/page.tsx absent parsed as glob parsed as glob src/[a-z]ormal.tsx normal.tsx exists matched via glob matched via glob Pass --no-glob to skip the probe and force literal interpretation. New and promoted rules Added to preset-recommend: Rule Detects @secretlint/secretlint-rule-tailscale Tailscale API keys (new package) @secretlint/secretlint-rule-stripe Stripe API keys (new package) @secretlint/secretlint-rule-cloudflare Cloudflare API tokens (promoted from preset-canary) What's Changed Breaking Changes feat!: respect .gitignore by default via @secretlint/walker by @azu in #1530 feat(secretlint-rule-preset-recommend): promote cloudflare, stripe, tailscale from canary by @azu in #1538 Features Add Tailscale API key detection rule by @azu in #1536 feat(secretlint-rule-stripe): add Stripe API key detection rule by @azu in #1537 CI Update actions/setup-node action to v6.4.0 by @renovate[bot] in #1527 Dependency Updates Update pnpm to v10.33.2 by @renovate[bot] in #1525 Update dependency ajv to ^8.20.0 by @renovate[bot] in #1528 Update textlint to ^15.6.0 (minor) by @renovate[bot] in #1529 Update dependency picomatch to ^4.0.4 by @renovate[bot] in #1534 Update dependency turbo to ^2.9.7 by @renovate[bot] in #1535 Other Changes Update Node.js to v24.15.0 by @renovate[bot] in #1514 Update dependency Bun to v1.3.13 by @renovate[bot] in #1526 Full Changelog: v12.3.1...v13.0.0
First reported May 04, 2026 12:39 UTCCatalog metadata updated Oct 17, 2026 02:16 UTCOpen evidence record
What's Changed Features Add Cloudflare API token detection rule by @azu in #1508 Documentation docs: Update README and CONTRIBUTING with new rules and corrections by @azu in #1507 chore(docker): add OCI image source label by @nozomiishii in #1511 New Contributors @nozomiishii made their first contribution in #1511 Full Changelog: v12.1.0...v12.2.0
First reported Apr 21, 2026 16:48 UTCCatalog metadata updated Oct 17, 2026 02:16 UTCOpen evidence record
What's Changed Important ⭐ These below fix CVE-2026-33691: fix(933111): prevent whitespace padding bypass in PHP double-extension upload by @fzipi in #4547 fix(933110): prevent whitespace padding bypass in PHP upload detection by @fzipi in #4546 fix(944140): prevent whitespace padding bypass in JSP file upload detection by @fzipi in #4548 🆕 New features and detections 🎉 feat(930130,930140): expand AI-based paths by @Elnadrion in #4540 feat: add aws security agent in scanners-user-agents.data by @S0obi in #4562 feat(932390): add shell fork bomb detection rule at PL2 by @fzipi in #4563 🧰 Other Changes refactor: create 941250 .ra file by @fzipi in #4520 refactor: create 942220 .ra file by @fzipi in #4511 refactor: create rule 931100 and 931110 .ra files by @Xhoenix in #4489 feat: Adding critical ai dirs that previously not exist by @HackingRepo in #4535 refactor: create 933140 and 933180 .ra files by @Xhoenix in #4488 fix(944110,944120,944130,944150,944151,944200,944210,..): don't inspect cookies twice by @touchweb-vincent in #4526 refactor: create 943120 .ra file by @fzipi in #4506 fix: false negative 932236 by @franbuehler in #4544 feat: update list of unix commands by @EsadCetiner in #4446 fix(932180): prevent whitespace padding bypass in restricted file upload detection by @fzipi in #4549 fix: harden GitHub Actions workflows by @fzipi in #4553 refactor: create 941310 .ra files by @fzipi in #4522 docs: update README by @fzipi in #4556 refactor: create 941120 .ra file by @fzipi in #4498 fix(920540): allow rule exclusions for specific targets by @EsadCetiner in #4405 fix(931130): ensure correct target is logged by @EsadCetiner in #4577 Full Changelog: v4.24.1...v4.25.0
First reported Mar 28, 2026 22:19 UTCCatalog metadata updated Oct 17, 2026 02:14 UTCOpen evidence record
What's Changed 🔒 Security fix: inspect REQUEST_FILENAME in RCE (932) rules to close path-based command injection bypass — GHSA-575j-qr6p-9763 fix: lowercase the charset parameter name so mixed-case CHARSET= cannot skip the allow-list (920480) — GHSA-89h9-2j8h-9gp2 fix: collect every _charset_ value so a second value cannot shadow a disallowed charset (922100) — GHSA-qmx4-jfcv-fgww ⭐ Important changes fix: Skip Checking Responses feature is broken by @azurit in #4807 🆕 New features and detections 🎉 feat(932380): detect Active Directory DS command-line tools by @fzipi in #4768 feat(934200): detect Velocity and FreeMarker directive syntax by @Yeagerist0 in #4774 feat(unix): detect common selinux command usage by @EsadCetiner in #4724 feat: Add Mozilla/6.0 used by scanner tools by @HackingRepo in #4784 feat: Add .claude into restricted files by @azurit in #4809 feat: Expand Restricted Files data (v3) by @HackingRepo in #4816 🪦 Rule removals feat: refactoring of response rules skipping by @azurit in #4806 🧰 Other Changes fix(913100): substring false positive with veganism.social user-agent by @EsadCetiner in #4777 fix(932270): require boundary before tilde expansion patterns by @zoutjebot in #4596 fix(956100): FP with keyword 'EOFError' inside RESPONSE_BODY by @azurit in #4752 fix(951230): FP with too broad regex for RESPONSE_BODY by @azurit in #4747 fix: close trailing-slash bypass of upload extension check (V29-260924) by @fzipi in #4815 fix(932180): enforce boundaries for high-risk false positives entries by @EsadCetiner in #4632 feat: allow application/*+json and AWS JSON content types by default by @fzipi in #4775 fix(901370): allow + inside the subtype before the +json suffix by @fzipi in #4828 fix(libmodsecurity3/coraza): substring false positive with json key named profiledata by @EsadCetiner in #4812 New Contributors @Yeagerist0 made their first contribution in #4774 Full Changelog: v4.29.0...v4.30.0
First reported Oct 03, 2026 17:49 UTCCatalog metadata updated Oct 17, 2026 02:14 UTCOpen evidence record
What's Changed ⚠️ Breaking Change Requires libmodsecurity v3.0.16 or later when running on nginx/libmodsecurity v3. The XML attribute injection fix (ctl:ruleRemoveTargetByTag=...;XML://@* in rule 901181) depends on owasp-modsecurity/ModSecurity#3589, which fixes the lexer's rejection of @ in ctl:ruleRemoveTarget* actions. On libmodsecurity v3 versions older than v3.0.16, this ctl action fails to parse, breaking config load. Fully opting out of XML attribute inspection (tx.crs_xml_attr_inspect) requires ModSecurity v2 >= v2.9.14, once owasp-modsecurity/ModSecurity#3591 is fixed upstream. Until then, ctl:ruleRemoveTargetByTag cannot remove the XML://@* target on ModSecurity v2, so rule 901181 cannot disable attribute inspection on that engine. ⭐ Important changes fix: R7U-260618 v3 by @fzipi in 4665b6d (GHSA: GHSA-f5qm-3h4p-8qhg) fix: N7Y-260316 v3 by @fzipi in 635cecf (GHSA: GHSA-6jp8-c2w2-x7wr) Full Changelog: v3.3.9...v3.3.10
First reported Jul 03, 2026 15:38 UTCCatalog metadata updated Oct 17, 2026 02:14 UTCOpen evidence record
What's Changed 🆕 New features and detections 🎉 feat: Add WhatWAF to the scanner list by @HackingRepo in #4566 feat: Add ghauri to scanner list by @HackingRepo in #4570 feat: Expand Scanner User Agents List (v2) by @HackingRepo in #4572 feat: Expanded os files list by @HackingRepo in #4536 feat(933100): all HTTP headers should be checked by @touchweb-vincent in #4603 fix(lfi-os-files): add .dockerenv, .DS_Store, META-INF/, WEB-INF/ by @zoutjebot in #4601 feat(934200): detect Server-Side Template Injection (SSTI) attacks by @zoutjebot in #4600 🧰 Other Changes fix(lfi-os-files): require path prefix for .profile by @zoutjebot in #4586 fix(933150): remove is_int from PHP function names list by @zoutjebot in #4585 fix(932370): remove url from Windows LOLBIN command list by @zoutjebot in #4587 fix(920539): prefer a bypass on a named rule rather than n+1 bypass by @touchweb-vincent in #4610 fix(942290): add word boundary to MongoDB operator detection by @zoutjebot in #4588 fix: false positive with parameter name .history by @EsadCetiner in #4614 fix(942410): use common exceptions instead of rule by @fzipi in #4617 fix(942200): reduce false positives on payloads with comments by @EsadCetiner in #4608 fix(unix): exclude pg command from pl-1 by @EsadCetiner in #4613 fix(930130): comment out false positive prone entries by @EsadCetiner in #4607 fix(920100): drop HTTP/0.9 GET support from request line validation by @fzipi in #4621 fix: Update restricted files to include Perl subdirectories by @HackingRepo in #4620 New Contributors @zoutjebot made their first contribution in #4586 Full Changelog: v4.25.0...v4.26.0
First reported May 04, 2026 01:41 UTCCatalog metadata updated Oct 17, 2026 02:14 UTCOpen evidence record
v4.25.1 - 2026-07-01 Breaking Changes Requires libmodsecurity v3.0.16 or later. The XML attribute injection fix (ctl:ruleRemoveTargetByTag=...;XML://@* in rule 901181) depends on owasp-modsecurity/ModSecurity#3589, which fixes the lexer's rejection of @ in ctl:ruleRemoveTarget* actions. On ModSecurity v3 versions older than v3.0.16, this ctl action fails to parse, breaking config load. Fully opting out of XML attribute inspection (tx.crs_xml_attr_inspect) requires ModSecurity v2 >= v2.9.14, once owasp-modsecurity/ModSecurity#3591 is fixed upstream. Until then, ctl:ruleRemoveTargetByTag cannot remove the XML://@* target on ModSecurity v2, so rule 901181 cannot disable attribute inspection on that engine. Security Fixes Backport fix for 4RI-250413 via hardening of JSON-encoded key/variable-assignment noise handling across LDAP injection, RCE, generic attack, and SQL injection detection rules (Esad Cetiner, cherry-pick of #4672) Backport ReDoS hardening fix removing exponential backtracking in the PHP function-call comment/whitespace suffix (rules 933160, 933161) (Felipe Zipitría, cherry-pick of #4666) Backport ReDoS hardening fix removing exponential backtracking in the PHP variable-function noise suffix (rule 933180) (Felipe Zipitría, cherry-pick of #4669) Backport ReDoS hardening fix removing exponential backtracking in CSS url(javascript:...) detection (rule 941140) (Felipe Zipitría, cherry-pick of #4670) Bug Fixes Backport false positive fix for payloads with commas but no whitespace in SQL comment detection (rule 942200) (Esad Cetiner, cherry-pick of #4608) Backport false positive fix excluding the pg command from PL1 Unix command detection (Esad Cetiner, cherry-pick of #4613) Backport false positive fix for parameter names containing .history (rule 930120) (Esad Cetiner, cherry-pick of #4614) Backport fix dropping HTTP/0.9 GET support from request line validation for RFC 9110 compliance (rule 920100) (Felipe Zipitría, cherry-pick of #4621) Backport fix so rules 920240 and 920400 use REQBODY_PROCESSOR instead of relying solely on the Content-Type header (Esad Cetiner, cherry-pick of #4639) Other Changes Add default SecDefaultAction for phases 3-5 in crs-setup.conf.example for consistent logging behavior across engines (Prateek Saini, cherry-pick of #4675) Full Changelog: v4.25.0...v4.25.1
First reported Jul 03, 2026 15:38 UTCCatalog metadata updated Oct 17, 2026 02:14 UTCOpen evidence record
What's Changed 🔒 Security fix: inspect XML attribute values across attack-detection rules — GHSA-6jp8-c2w2-x7wr fix: remove catastrophic backtracking in unix-shell-evasion prefix — GHSA-f5qm-3h4p-8qhg 🆕 New features and detections 🎉 feat: enable crs_validate_utf8_encoding by default by @fzipi in #4647 feat: added detection for quote evasion by @Xhoenix in #3813 feat(934): detect ORM lookup operator injection by @fzipi in #4659 fix(932): detect uninitialized variable spacer in RCE evasion prefix by @fzipi in #4652 🧰 Other Changes refactor: create 941170 .ra file by @fzipi in #4493 fix: Update restricted-files.data to include NPM subdirectories without causing FPs by @HackingRepo in #4653 fix: remove exponential backtracking in 933160/933161 comment suffix by @fzipi in #4666 fix(941140): remove exponential backtracking in CSS url(javascript) detection by @fzipi in #4670 fix(933180): remove exponential backtracking in variable-function noise suffix by @fzipi in #4669 fix(942390): move to regex-assembly by @fzipi in #4011 feat(crs-setup): add default actions for phases 3-5 by @Prateeksaini12 in #4675 fix(942522): avoid excessive backtracking by @EsadCetiner in #4676 fix: 4RI-250413 by @EsadCetiner in #4672 fix: FPs related to RESPONSE_BODY by @azurit in #4684 New Contributors @Prateeksaini12 made their first contribution in #4661 Full Changelog: v4.27.0...v4.28.0
First reported Jul 02, 2026 08:20 UTCCatalog metadata updated Oct 17, 2026 02:14 UTCOpen evidence record
What's Changed 🆕 New features and detections 🎉 fix(932): add backslash-prefix evasion to shell command detection by @zoutjebot in #4599 feat(unix): detect basic quote evasion attempts against known unix commands by @EsadCetiner in #4649 feat(unix): detect stat command at pl-2+ by @EsadCetiner in #4735 feat: Expand web shells (v1) by @HackingRepo in #4626 🧰 Other Changes fix: allow optional json. prefix in rule 932171 ARGS_NAMES pattern by @fzipi in #4703 fix(942190): require operator or quote after '!' to cut natural-language FPs by @fzipi in #4704 fix(942200): tighten comma branch to cut UA/Referer false positives by @fzipi in #4665 fix(942390): remove bypassable length bound on quoted/unary literals by @fzipi in #4713 fix(953100): more FPs related to RESPONSE_BODY ("(inclusive)" and "must be a valid") by @azurit in #4697 fix(932): remove w from Unix no-arguments command list by @zoutjebot in #4592 fix(932): require arguments for base64, lastlog, lastlogin by @zoutjebot in #4593 fix(953100): FP with '> in all' in RESPONSE_BODY by @azurit in #4736 feat(930120): restore node_modules coverage by @Prateeksaini12 in #4681 fix(942190): Fix the message to reflect that the rule applies to all SQL DBs by @aryehb in #4671 Full Changelog: v4.28.0...v4.29.0
First reported Aug 17, 2026 18:07 UTCCatalog metadata updated Oct 17, 2026 02:14 UTCOpen evidence record
v4.25.2 - 2026-10-02 Security Fixes Backport fix for [GHSA-575j-qr6p-9763] via adding REQUEST_FILENAME to the targets of the RCE rules, so command injection payloads placed in the URL path are inspected like those in ARGS (rules 932125-932390, except 932200, where every URL path contains the / it requires) (Max Leske) Backport fix for [GHSA-89h9-2j8h-9gp2] via lowercasing the charset parameter name before matching, so an uppercase or mixed-case CHARSET= in Content-Type can no longer skip the charset allow-list check (rule 920480) (Felipe Zipitría) Backport fix for [GHSA-qmx4-jfcv-fgww] via collecting every _charset_ value so a second multipart part or a query-string _charset_ can no longer shadow a disallowed charset (rule 922100) (Ervin Hegedüs) Backport fix removing a bypassable length bound in the SQL (X)OR injection detection (rule 942390) (Felipe Zipitría, cherry-pick of #4713) Backport fix for [V29-260924] via tolerating trailing slashes as well as dots after the extension, so a PHP or JSP upload filename ending in / can no longer bypass the upload extension checks (rules 933110, 944140) (Felipe Zipitría, cherry-pick of #4815) Bug Fixes Backport false positive fix for the vega scanner user agent substring matching veganism.social (rule 913100) (Esad Cetiner, cherry-pick of #4777) Backport fix so tx.crs_skip_response_analysis also skips the phase 4 response body rules; previously only the phase 3 header rules were skipped (new rule 950022) (Jozef Sudolský, cherry-pick of #4807) Other Changes Backport allowing and JSON-parsing application/*+json content types (including subtypes that contain a +, such as application/vc+ld+json) and the AWS application/x-amz-json-1.0/1.1 content types by default, so these JSON request bodies are no longer blocked by the content-type allow-list or left uninspected (new rules 901360, 901370) (Felipe Zipitría, cherry-pick of #4775 and #4828) Formalize rule 932171 (Shellshock, CVE-2014-6271) into a regex-assembly file and apply the standard [\s\x0b] whitespace-class normalization; the json. ARGS_NAMES prefix detection itself was already present on this branch via an untracked fix, so this is a maintainability/consistency change, not a functional fix (partial cherry-pick of #4703)
First reported Oct 03, 2026 17:48 UTCCatalog metadata updated Oct 17, 2026 02:14 UTCOpen evidence record
The USGA's premier event demands excellence on the green and off — Cisco’s AI-powered full-stack advantage wins for players and fans alike.More RSS Feeds: https://newsroom.cisco.com/c/r/newsroom/en/us/rss-feeds.html
First reported Jul 01, 2026 12:00 UTCCatalog metadata updated Oct 17, 2026 02:12 UTCOpen evidence record
Trust, not raw intelligence, will drive AI adoption as Cisco and NVIDIA build context-aware, distributed controls for safe enterprise agents at scale.More RSS Feeds: https://newsroom.cisco.com/c/r/newsroom/en/us/rss-feeds.html
First reported Sep 28, 2026 12:00 UTCCatalog metadata updated Oct 17, 2026 02:12 UTCOpen evidence record
Scale AI by mastering tokenomics. Align high-velocity innovation with budget oversight to mitigate risk and ensure sustainable production.More RSS Feeds: https://newsroom.cisco.com/c/r/newsroom/en/us/rss-feeds.html
First reported Jul 29, 2026 12:00 UTCCatalog metadata updated Oct 17, 2026 02:12 UTCOpen evidence record
With key announcements around Cisco Cloud Control, Cisco IQ, Live Protect, and more, Cisco solidifies its critical role in driving AI transformation.More RSS Feeds: https://newsroom.cisco.com/c/r/newsroom/en/us/rss-feeds.html
First reported Jun 05, 2026 12:00 UTCCatalog metadata updated Oct 17, 2026 02:12 UTCOpen evidence record
New research from Cisco and Foundry affirms that for security, visibility, and meeting the spiraling demands of AI, it all comes back to the network.More RSS Feeds: https://newsroom.cisco.com/c/r/newsroom/en/us/rss-feeds.html
First reported Jun 15, 2026 13:00 UTCCatalog metadata updated Oct 17, 2026 02:12 UTCOpen evidence record
Notre Dame, Auburn, and Georgetown show how AI and other new technologies can transform the university experience. Cisco networks and security make it possible.More RSS Feeds: https://newsroom.cisco.com/c/r/newsroom/en/us/rss-feeds.html
First reported Oct 15, 2026 12:00 UTCCatalog metadata updated Oct 17, 2026 02:12 UTCOpen evidence record
Cisco delivers new Splunk innovations that give customers the ability to safely and cost-efficiently scale AI wherever their data already lives.More RSS Feeds: https://newsroom.cisco.com/c/r/newsroom/en/us/rss-feeds.html
First reported Sep 15, 2026 14:30 UTCCatalog metadata updated Oct 17, 2026 02:12 UTCOpen evidence record
Cisco’s Galaxy Mode for AI Assistant showed how IT can interact with agentic teammates in a fun, natural way. But the real magic is in the innovation behind it.More RSS Feeds: https://newsroom.cisco.com/c/r/newsroom/en/us/rss-feeds.html
First reported Jul 21, 2026 12:00 UTCCatalog metadata updated Oct 17, 2026 02:12 UTCOpen evidence record
Cisco Cloud Control brings together human operators and trusted AI agents together to run the world's most critical systems More RSS Feeds: https://newsroom.cisco.com/c/r/newsroom/en/us/rss-feeds.html
First reported Jun 02, 2026 13:00 UTCCatalog metadata updated Oct 17, 2026 02:12 UTCOpen evidence record
AB and Kamal Hathi explore how Cisco and Splunk infrastructure powers the AI era, from scaling operations to driving agentic action.More RSS Feeds: https://newsroom.cisco.com/c/r/newsroom/en/us/rss-feeds.html
First reported Sep 30, 2026 07:00 UTCCatalog metadata updated Oct 17, 2026 02:12 UTCOpen evidence record
In iconic venues around the world, Cisco Wi-Fi, AI, and security support the most bandwidth-hungry, future-facing fan interactions.More RSS Feeds: https://newsroom.cisco.com/c/r/newsroom/en/us/rss-feeds.html
First reported Jul 15, 2026 12:00 UTCCatalog metadata updated Oct 17, 2026 02:12 UTCOpen evidence record
Cisco’s Yuri Kramarz, on coordinating cutting-edge technology and human expertise in the critical hours after a cyberattack.More RSS Feeds: https://newsroom.cisco.com/c/r/newsroom/en/us/rss-feeds.html
First reported Oct 13, 2026 12:00 UTCCatalog metadata updated Oct 17, 2026 02:12 UTCOpen evidence record
The public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.