Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
3 sources: 0 stale, 0 needing attention, 0 paused, 0 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
Once again, data shows an uncomfortable truth: the habit of choosing eminently hackable passwords is alive and well
First reported Jan 20, 2026 10:00 UTCCatalog metadata updated Oct 17, 2026 04:43 UTCOpen evidence recordESET researchers have investigated an ongoing attack by the ScarCruft APT group that targets the Yanbian region via backdoor-laced Windows and Android games
First reported May 05, 2026 08:55 UTCCatalog metadata updated Oct 17, 2026 04:43 UTCOpen evidence recordESET Research has discovered a new China-aligned APT group that we’ve named GopherWhisper, which targets Mongolian governmental institutions
First reported Apr 23, 2026 08:59 UTCCatalog metadata updated Oct 17, 2026 04:43 UTCOpen evidence recordWhether you’re a victim, the parent of a victim, or just concerned, here’s what you can do about fake nude images
First reported Sep 18, 2026 09:00 UTCCatalog metadata updated Oct 17, 2026 04:43 UTCOpen evidence recordAn overview of the activities of selected APT groups investigated and analyzed by ESET Research in Q4 2025 and Q1 2026
First reported May 28, 2026 08:45 UTCCatalog metadata updated Oct 17, 2026 04:43 UTCOpen evidence recordA complete decoupling from US technology is neither realistic nor necessary, but the changing environment does require nations and companies to reassess their relationships and dependencies
First reported May 19, 2026 08:50 UTCCatalog metadata updated Oct 17, 2026 04:43 UTCOpen evidence recordAI tutors can offer useful support, but their quality and safeguards vary widely. Here’s what parents should check before handing one to a child.
First reported Aug 10, 2026 09:00 UTCCatalog metadata updated Oct 17, 2026 04:43 UTCOpen evidence recordStart using a new app and you’ll often be asked to grant it permissions. But blindly accepting them could expose you to serious privacy and security risks.
First reported Feb 27, 2026 10:00 UTCCatalog metadata updated Oct 17, 2026 04:43 UTCOpen evidence recordv2.3.5 Features: Feature #2571 Enable transitive scanning for Python requirements.txt files using the deps.dev API. Feature #2649 Add ability to allow unsafe plugins, logging a warning when any unsafe plugin is enabled. Fixes: Bug #2630 Improve startup performance on Windows Terminal by updating lipgloss. Bug #2599 Ensure the package deprecation enricher respects the same configuration as other plugins. Bug #2600 Ensure the Java extractor plugin for call analysis respects the same configuration as other plugins. Misc: Update osv-scalibr from v0.4.2 to v0.4.5. Release notes: v0.4.3, v0.4.4, v0.4.5. Fix broken release workflow. New Contributors @gurusai-voleti made their first contribution in #2520 @hopkincame made their first contribution in #2564 @tobyhawker made their first contribution in #2639 Full Changelog: v2.3.3...v2.3.5
First reported Mar 25, 2026 00:23 UTCCatalog metadata updated Oct 17, 2026 04:41 UTCOpen evidence recordFeatures: Feature #2815 Add support for the CycloneDX 1.7 specification (bumps cyclonedx-go to v0.11.0). Feature #2799 Enable .csproj and Central Package Management (nugetcpm) source scanning plugins by default. Feature #2871 Extract and parse Alpine OS distro version (e.g. Alpine:v3.17, Alpine:edge) from PURL distro qualifiers to scan packages under their respective Alpine ecosystems. Feature #2801 Enable the swift/packageresolved plugin by default to support SwiftURL vulnerability scans. Feature #2666 Add a Docker-based variant of the pre-commit hook in .pre-commit-hooks.yaml to avoid local compilation. Feature #2637 Add a new configuration setting ScanGoModVersion (disabled by default) to avoid parsing toolchain version directives directly from go.mod, preventing misleading warnings. Feature #2772 Scan container images built with Canonical Chisel by enabling the os/chisel extractor plugin. Fixes: Bug #2807 Sanitize package name, source, and version fields in the vertical output format to prevent GitHub Actions workflow command injection vulnerabilities from crafted lock files. Bug #2876 Improve HTML scan report usability by supporting standard click modifiers (Ctrl/Cmd/middle click) to open vulnerabilities in new tabs, and preserving scroll position when switching tabs. Bug #2783 Keep transitive dependency scanning enabled when specifying the --offline-vulnerabilities flag. Bug #2808 Deduplicate equivalent OSV matcher requests before executing bulk queries to reduce API overhead. Bug #2837 Prevent panics during offline matcher scans (e.g. on unsupported GitHub Actions ecosystem) by avoiding parsing errors when checking version ranges. Bug #2836 Ensure the scanner returns an exit code of 0 when --help or -h is explicitly requested. Misc: Update Go version to 1.26.4. Update osv-scalibr to v0.4.6-0.20260612031204-164402d9140e. Tag built Docker and GitHub Action images with the major version (e.g. :v2) to allow users to pin to a major version (#2857). New Contributors @herdiyana256 made their first contribution in #2801 @zhijie-yang made their first contribution in #2772 @francose made their first contribution in #2837 @rohan-patnaik made their first contribution in #2808 @evilgensec made their first contribution in #2807 @gotgolem made their first contribution in #2783 @Khuzaimx made their first contribution in #2857 Full Changelog: v2.3.8...v2.4.0
First reported Jun 18, 2026 13:35 UTCCatalog metadata updated Oct 17, 2026 04:41 UTCOpen evidence recordWhat's Changed Features & Refactors: Full OSV-Scalibr pipeline: Migrated scanning, filtering, and matching in osv-scanner to use osv-scalibr end-to-end, so most plugins that's supported in osv-scalibr should be supported via the --experimental-plugins flag (#2935). New extractors and ecosystem support via osv-scalibr: Add javascript/vsix extractor to support scanning VS Code extension (.vsix) packages. Extend ecosystem mapping for: SUSE Azure Linux / Mariner Alpaquita Mageia openSUSE Leap Debian and Ubuntu PURL PURL Type Resolution: Updated osvscannerjson extractor to map ecosystem names to valid PURL types (golang, gem, cargo, npm, etc.). Fixes: Bug #2915 Fix issue where osv-scanner reported already-fixed advisories as unfixed for RHEL-family RPM packages (Red Hat, AlmaLinux, Rocky Linux) with epochs by sending epoch-qualified versions. Fix Python requirements.txt extractor in osv-scalibr, specifically regular expressions used to extract package names and per-requirement options (Fixes #2940, #2931) Fix NPM and Composer PURL generation in osv-scalibr, separating package namespace (scope) from package name New Contributors @Korulag made their first contribution in #2915 Full Changelog: v2.4.0...v2.5.0
First reported Aug 07, 2026 05:23 UTCCatalog metadata updated Oct 17, 2026 04:41 UTCOpen evidence recordWhat's Changed Fixes: Preserve package namespaces when querying osv.dev API (fixes #2978). Re-add support for the OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY environment variable (fixes #2983). Fix local vulnerability matching (--offline-vulnerabilities) not working when network capability is NetworkOnline. Full Changelog: v2.5.0...v2.5.1
First reported Aug 17, 2026 04:29 UTCCatalog metadata updated Oct 17, 2026 04:41 UTCOpen evidence recordfix: schrodinger's lint (#2780)
First reported May 07, 2026 00:34 UTCCatalog metadata updated Oct 17, 2026 04:41 UTCOpen evidence recordFixes: Fix installation issues with go install due to dependency conflicts (downgrade containerd/cgroups/v3, moby/buildkit and opencontainers/runtime-spec). (#2782) Bug #2762 Skip packages with short commit hashes instead of aborting scan. Bug #2781 Secure file path handling with os.OpenRoot. Bug #2766 Correct typos across docs, configs, and Go source. Misc: Update osv-scalibr to v0.4.6-0.20260504042738-9293bfa4f86f.
First reported May 08, 2026 05:28 UTCCatalog metadata updated Oct 17, 2026 04:41 UTCOpen evidence recordFeatures: Feature #2885 Include package URLs (purl) in JSON output when available. Feature #2589 Add shorter --x- flag aliases and deprecate --experimental- flags. Feature #3113 Include vulnerability severity and rating in CycloneDX output when available. Feature #3102 Enable Dart package_config.json (dart/packageconfig) extractor by default for lockfile scans (google/osv-scalibr#2295). Dependency scanning & lockfile improvements via osv-scalibr: Add best-effort Maven property pre-interpolation for dependency versions and in-memory caching for Maven resolution. Support scanning Bitnami container SPDX SBOMs (sbom/spdx) (google/osv-scalibr#2156). Add MinimOS ecosystem mapping to the APK extractor (os/apk) (google/osv-scalibr#2406). Apply --max-file-size limit to container image contents and tag container image layers with Buildpacks lifecycle metadata. New extractors and plugin support via osv-scalibr: Added zig/buildzigzon (build.zig.zon, google/osv-scalibr#1841), available via --x-plugins (--experimental-plugins). See "Supported Inventory Types" for the extractor name. Fixes: Bug #3137 Delegate package normalization to osv-scalibr's osvutil to preserve Maven group IDs in CycloneDX SBOMs so fixed versions are properly reported (fixes #3099). Bug #3135 Prevent network-requiring plugins (such as base image enrichment) from running when --offline is combined with --download-offline-databases. Bug #3134 Preserve call analysis information when diffing vulnerability results. Bug #3121 Wrap [[PackageOverrides]] ecosystem suffix alternatives in a non-capturing group so Ecosystem regex matching applies correctly to all variants (fixes #3120). Bug #3103 Sort packages by location before applying config annotations for deterministic log output order during recursive scans. Bug #3087 Group output packages by exact ecosystem name to prevent duplicate entries when ecosystems share a prefix (e.g. Alpine and Alpine:v3.18) (fixes #3086). Fixes via osv-scalibr: Skip OSV queries for local npm packages (file:, workspace, and local tarballs) and avoid extracting bogus versions or commits for file: and URL-based dependencies in bun.lock (google/osv-scalibr#2443, google/osv-scalibr#2444). Restrict #commit fragment extraction in JS lockfiles to Git-based dependency resolutions (google/osv-scalibr#2448). Prevent slice-bounds panic in javascript/pnpmlock on malformed scoped dependency paths (google/osv-scalibr#2263). Emit valid Hackage PURLs (pkg:hackage/...) and add Hackage OSV ecosystem mapping for Haskell (cabal and stack.yaml.lock) extractors (google/osv-scalibr#2419). Match Python setup.py package names containing -, ., and _ (google/osv-scalibr#2162). Reject invalid ZIP64 sizes and bound metadata reads in python/wheelegg (google/osv-scalibr#2012). Confine Maven registry disk cache writes with os.Root to prevent path traversal (google/osv-scalibr#2398). Compare PURL namespaces case-insensitively during OSV vulnerability matching (e.g. for Go modules with uppercase characters) (google/osv-scalibr#2456). Skip advisory affected entries with unrecognized ecosystems in local OSV matcher instead of aborting matching for the advisory (google/osv-scalibr#2429). Fix WordPress plugin name extraction from directory name and restrict scanning to immediate subdirectories of wp-content/plugins (google/osv-scalibr#2424, google/osv-scalibr#2445). Fix 32-bit statfs block size overflow when checking filesystem types on 32-bit architectures (google/osv-scalibr#2439). Misc: Update osv-scalibr to v0.5.4-0.20261009010329-5be78a00e3c2 (#3123, #3089, #3137). Remove unused root Dockerfile (#3130). New Contributors @sanjay20m made their first contribution in #3102 @manenim made their first contribution in #3133 Full Changelog: v2.6.0...v2.7.0
First reported Oct 12, 2026 01:32 UTCCatalog metadata updated Oct 17, 2026 04:41 UTCOpen evidence recordFeatures: Feature #2888 Publish multi-arch (linux/arm64) image for osv-scanner-action. Feature #3066 Configure retry policy with exponential backoff for transient gRPC errors in scalibr plugins. Dependency scanning & lockfile improvements via osv-scalibr: Extract Git repository URLs and support local OSV tag matching for Git-based dependencies in JavaScript lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lock). Assign pkg:git PURL type to Git commit-pinned dependencies across JS and Cargo lockfiles to avoid false positives against registry packages (#2863). Retain packages without a version or PURL in SPDX output (google/osv-scalibr#2375) and merge related packages based on lineage relationships. New extractors and plugin support via osv-scalibr: Many additional filetypes are supported. These are not enabled by default yet, so if you need a particular new filetype, use --experimental-plugins flag. See "Supported Inventory Types" for the extractor name. Fixes: Bug #3075 Ensure results property in JSON output is an empty array [] instead of null when scanning with --allow-no-lockfiles and no lockfiles are found. Bug #3071 Preserve valid UTF-8 sequences when truncating multibyte text in vertical output. Bug #2919 Add filter to show packages with license violations but no vulnerabilities in the HTML report. Bug #3049 Keep filter dropdown checklist open when clicking options in the HTML report. Bug #3023 Guard against panic on empty or whitespace-only license expressions in SPDX license evaluation. Bug #3032 Bound recursion depth when parsing SPDX license expressions to prevent stack overflow on deeply nested expressions. Bug #3061 Remove purl caching in scan filtering to avoid dropping SBOM packages without purls. Bug #3063 Log plugin and enricher errors during container scans instead of failing silently. Bug #2977 Return an error instead of aborting the process (log.Fatalf) when an rlib archive has no object file during Rust source analysis. Bug #3083 Return a descriptive error from DoContainerScan when ScannerActions.Image is empty instead of panicking. Fixes via osv-scalibr: Fix false-positive Go standard library matches for packages with module paths ending in /go (e.g. pkg:golang/github.com/json-iterator/go) (#3017). Secure guided remediation file operations with os.Root to prevent path traversal attacks (google/osv-scalibr#2363). Prevent OOM and disk exhaustion issues with tar bombs during archive extraction. Strip platform suffix from RubyGems versions in CycloneDX (google/osv-scalibr#2313). Ignore .deps.json files that don't have an object as their root in dotnet/depsjson extractor (google/osv-scalibr#2423). Misc: Update osv-scalibr to v0.5.3-0.20260911142458-3090dbb7aaa2 (#3079). Update Go to v1.27 and golangci-lint to v2.13 (#3046). This now supports call analysis on go v1.27 projects. Update google.golang.org/grpc to v1.83.2 (#3062). New Contributors @summerpan688 made their first contribution in #2919 @BenkiNew made their first contribution in #3038 @Amey-Thakur made their first contribution in #3032 @sl4x0 made their first contribution in #3023 @shubhransh-gupta made their first contribution in #3049 @kobihikri made their first contribution in #2977 @skialpine made their first contribution in #2888 @keeltrace made their first contribution in #3071 @Muszic made their first contribution in #3083 @knQzx made their first contribution in google/osv-scalibr#2313 @micrictor made their first contribution in google/osv-scalibr#2047 @srossross made their first contribution in google/osv-scalibr#2375 Full Changelog: v2.5.1...v2.6.0
First reported Sep 14, 2026 02:55 UTCCatalog metadata updated Oct 17, 2026 04:41 UTCOpen evidence recordUpdate changelog and snapshots in preparation for release. Required because data changes are causing tests to fail, and there are new changes since the last updates. Co-authored-by: Xueqin Cui 72771658+cuixq@users.noreply.github.com
First reported Mar 19, 2026 04:50 UTCCatalog metadata updated Oct 17, 2026 04:41 UTCOpen evidence recordFeatures: Feature #2658 Support regex matching for package name overrides. Feature #2510 Scan Homebrew inventory using git repository metadata. Fixes: Bug #2750 Sanitize \r/\n in default/table/vertical output to prevent GitHub Actions workflow command injection. Bug #2641 Correctly output packages from osv-scanner.json source in spdx format. Bug #2729 Increase color contrast of vulnerability stats. Bug #2664 Remove second newline at end of vertical output. Bug #2669 Sanitize \r in gh-annotations to prevent GitHub Actions workflow command injection. Misc: Update osv-scalibr to v0.4.6-0.20260428235529-7791e288d6c1. Update Go version to 1.26.2 (#2706). New Contributors @djvirus9 made their first contribution in #2669 @jonjensen made their first contribution in #2695 @dosisod made their first contribution in #2729 @ibondarenko1 made their first contribution in #2748 @sjhddh made their first contribution in #2744 @Mananshah237 made their first contribution in #2641 @majiayu000 made their first contribution in #2658 @hits313 made their first contribution in #2750 Full Changelog: v2.3.5...v2.3.6
First reported May 01, 2026 00:58 UTCCatalog metadata updated Oct 17, 2026 04:41 UTCOpen evidence recordSomewhere in your organization is a spreadsheet of certificate expiry dates, and someone who owns it. That is not a caricature. DigiCert’s 2026 research with Omdia surveyed more than 400 senior IT leaders and found that 47% still rely on manual tracking methods such as spreadsheets, and only 34% have a complete, current view of […] The post 47-Day Certificates Are Coming: Five Things to Do Before They Arrive appeared first on Blog.
First reported Oct 05, 2026 13:25 UTCCatalog metadata updated Oct 17, 2026 04:39 UTCOpen evidence recordAtlassian has released an out-of-band security advisory for CVE-2026-21589, a critical arbitrary file access vulnerability affecting a broad range of its Data Center products. The flaw carries a CVSS 4.0 score of 9.3 and can be exploited remotely without authentication or user interaction. Because vulnerable functionality is shared across the Atlassian product ecosystem, every previous […] The post CVE-2026-21589: Critical Pre-Authentication File Read Affects Atlassian Data Center Products appeared first on Blog.
First reported Oct 08, 2026 22:39 UTCCatalog metadata updated Oct 17, 2026 04:39 UTCOpen evidence recordTL;DR: CVE-2026-75650, dubbed StyleSmuggler, is a critical vulnerability affecting Adobe Commerce and Magento Open Source. The vulnerability allows an unauthenticated attacker to inject malicious PHP code into Magento’s template system and achieve remote code execution. Adobe assigned the vulnerability a CVSS score of 10.0 and released an emergency hotfix after exploitation was observed in the wild. Imperva Cloud WAF and On-Prem WAF […] The post Imperva Customers Protected Against StyleSmuggler (CVE-2026-75650) in Adobe Commerce and Magento Open Source appeared first on Blog.
First reported Sep 10, 2026 17:43 UTCCatalog metadata updated Oct 17, 2026 04:39 UTCOpen evidence recordReadiness is a visibility problem, and it’s one many organizations don’t know they have. Most security controls tell you when they’re broken. A bad firewall rule lets traffic through that shouldn’t be there. An expired certificate generates alerts. A misconfigured WAF starts blocking legitimate users and someone notices pretty quickly. DDoS protection is different. A […] The post Is Your DDoS Protection Actually On? appeared first on Blog.
First reported Oct 08, 2026 08:08 UTCCatalog metadata updated Oct 17, 2026 04:39 UTCOpen evidence recordSQL parsers are critical components of the modern data stack. They validate queries before they reach the database, transpile between dialects, and lint codebases for style violations. Increasingly, they also power AI-driven SQL generation in LLM-integrated data tools. Our research focused on two popular Python-based parsers: SQLGlot and SQLFluff, both with around 10k GitHub stars each. These libraries sit at the foundation […] The post The Hidden DoS Vector in SQL Parsers appeared first on Blog.
First reported Oct 06, 2026 06:09 UTCCatalog metadata updated Oct 17, 2026 04:39 UTCOpen evidence recordSomewhere in your estate right now, a certificate is counting down to its expiry date. Today you probably know which one, because renewals still come around annually and someone owns the calendar. The industry is taking that comfort away: the CA/Browser Forum has voted to cut the maximum TLS certificate lifespan to 47 days by […] The post Bring Your Own CA: Introducing the Thales Imperva SSL Integration Center, Featuring DigiCert Trust Lifecycle Manager appeared first on Blog.
First reported Aug 24, 2026 09:01 UTCCatalog metadata updated Oct 17, 2026 04:39 UTCOpen evidence recordThe public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.