Published file metadata, source observations, indicators, and research history in one bounded catalog.
2,400+Reachable catalog records
25 / 100Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
intelligence_src_38b0e6fc664f770c9aRecent successful batchLast successful batch: Last attempt:
intelligence_src_38cd5eb41edb3f75cdRecent successful batchLast successful batch: Last attempt:
intelligence_src_38fc32838f99f6297cRecent successful batchLast successful batch: Last attempt:
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
2,400+ MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
Today, we are publishing the 1.5.2 and 1.4.4 security patch versions. The release files for the patch versions are available for download on the ClamAV downloads page, on the GitHub Release page, and through Docker Hub with both Alpine and Debian containers. The images on Docker Hub may not be immediately available on release day. Continue reading to learn what changed in each version. 1.5.2 ClamAV 1.5.2 is a patch release with the following fixes: CVE-2026-20031: Fixed an error handling bug in the HTML file parser that may crash the program and cause a denial-of-service (DoS) condition. This issue was introduced in version 1.1.0. The fix is included in 1.5.2 and 1.4.4. Fixed a possible infinite loop when scanning some JPEG files by upgrading affected ClamAV dependency, a Rust image library. Unfortunately, this change requires a newer Rust compiler for ClamAV. The minimum Rust version for ClamAV 1.4.3 was 1.85.1. The minimum Rust version for ClamAV 1.4.4 is now 1.87.0. Fixed a possible crash on Windows when scanning some files while using the LeaveTemporaryFiles and TemporaryDirectory features. The CVD verification process will now ignore certificate files in the CVD certs directory when the user lacks read permissions. Freshclam: Fix CLD verification bug with PrivateMirror option. Upgraded the Rust bytes dependency to a newer version to resolve RUSTSEC-2026-0007 advisory. Fixed a possible crash caused by invalid pointer alignment on some platforms. This fix is courtesy of Hsuan-Ming Chen at Synology PSIRT. 1.4.4 ClamAV 1.4.4 is a patch release with the following fixes: CVE-2026-20031: Fixed an error handling bug in the HTML file parser that may crash the program and cause a DoS condition. This issue was introduced in version 1.1.0. The fix is included in 1.5.2 and 1.4.4. Fixed a possible crash when scanning some TIFF files by upgrading the affected ClamAV dependency, a Rust image library. Unfortunately, this change requires a newer Rust compiler for ClamAV. The minimum Rust version for ClamAV 1.4.3 was 1.85.1. The minimum Rust version for ClamAV 1.4.4 is now 1.87.0. Upgraded the Rust bytes dependency to a newer version to resolve RUSTSEC-2026-0007 advisory. Fixed a possible crash caused by invalid pointer alignment on some platforms. This fix is courtesy of Hsuan-Ming Chen at Synology PSIRT.
First reported Mar 04, 2026 18:32 UTCCatalog metadata updated Oct 13, 2026 20:51 UTCOpen evidence record
We are excited to announce the ClamAV 1.3.0 release candidate.You can find the source code and installers for this release on the clamav.net/downloads page or the ClamAV GitHub release page.Tip: If you are downloading the source from the GitHub release page, the package labeled "clamav-1.3.0-rc2.tar.gz" does not require an internet connection to build. All dependencies are included in this package. But if you download the ZIP or TAR.GZ generated by GitHub, located at the very bottom, then an internet connection will be required during the build to download additional Rust dependencies.For Docker users, there is no specific Docker tag for the release candidate, but you can use these tags:clamav/clamav:unstableclamav/clamav:unstable_base clamav/clamav-debian:unstableclamav/clamav-debian:unstable_base This release candidate phase is expected to last two weeks before we publish the stable release. Please take this time to evaluate ClamAV 1.3.0. Please help us validate this release by providing feedback via the ClamAV mailing list or our Discord.Changes since the first release candidate include:Improved support for decrypting PDFs with empty passwords.GitHub pull requestClamOnAcc: Fixed an infinite loop when a file has been deleted before a scan. Patch courtesy of gsuehiro.GitHub pull requestClamConf: Fixed an issue printing `MaxScanSize` introduced with the change to allow a `MaxScanSize` greater than 4 GB. Fix courtesy of teoberi.GitHub pull requestFixed an issue building a ClamAV RPM in some configurations. The issue was caused by faulty CMake logic that intended to create an empty database directory during the installation.GitHub pull requestYou can find the full list of changes and improvements in the blog post for the first release candidate.
First reported Jan 24, 2024 20:31 UTCCatalog metadata updated Oct 13, 2026 20:51 UTCOpen evidence record
Today, we are releasing the following critical patch versions for ClamAV: 1.1.1 1.0.2 0.103.9 ClamAV 0.105 and 0.104 have reached end-of-life according to the ClamAV’s End of Life (EOL) policy and will not be patched.The release files are available for download on ClamAV.net, on the Github Release page, and through Docker Hub.Note: We observed an issue building ClamAV on Windows using the recently released libjson-c version 0.17. If you are building ClamAV for Windows, you should use libjson-c version 0.16 or prior. 1.1.1 ClamAV 1.1.1 is a critical patch release with the following fixes: CVE-2023-20197 Fixed a possible denial of service vulnerability in the HFS+ file parser. This issue affects versions 1.1.0, 1.0.1 through 1.0.0, 0.105.2 through 0.105.0, 0.104.4 through 0.104.0, and 0.103.8 through 0.103.0. Thank you to Steve Smith for reporting this issue. Fixed a build issue when using the Rust nightly toolchain, which was affecting the oss-fuzz build environment used for regression tests.GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/997 Fixed a build issue on Windows when using Rust version 1.70 or newer. GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/994 CMake build system improvement to support compiling with OpenSSL 3.x on macOS with the Xcode toolchain. The official ClamAV installers and packages are now built with OpenSSL 3.1.1 or newer. GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/972 Removed a warning message showing the HTTP response codes during the Freshclam database update process. GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/939 Special thanks to the following people for code contributions and bug reports: Steve Smith 1.0.2 ClamAV 1.0.2 is a critical patch release with the following fixes: CVE-2023-20197 Fixed a possible denial of service vulnerability in the HFS+ file parser. This issue affects versions 1.1.0, 1.0.1 through 1.0.0, 0.105.2 through 0.105.0, 0.104.4 through 0.104.0, and 0.103.8 through 0.103.0. Thank you to Steve Smith for reporting this issue. CVE-2023-20212 Fixed a possible denial of service vulnerability in the AutoIt file parser. This issue affects versions 1.0.1 and 1.0.0. This issue does not affect version 1.1.0. Fixed a build issue when using the Rust nightly toolchain, which was affecting the oss-fuzz build environment used for regression tests. GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/996 Fixed a build issue on Windows when using Rust version 1.70 or newer.GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/993 CMake build system improvement to support compiling with OpenSSL 3.x on macOS with the Xcode toolchain. The official ClamAV installers and packages are now built with OpenSSL 3.1.1 or newer. GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/973 Fixed an issue where ClamAV does not abort the signature load process after partially loading an invalid signature. The bug would later cause a crash when scanning certain files. GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/952 Fixed an issue so that ClamAV correctly removes temporary files generated by the VBA and XLM extraction modules so that the files are not leaked in patched versions of ClamAV where temporary files are written directly to the temp-directory instead of writing to a unique subdirectory.GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/900 Set Git attributes to prevent Git from altering line endings for bundled Rust libraries. Third-party Rust libraries are bundled in the ClamAV release tarball. We do not commit them to our own Git repository, but community package maintainers may now store the tarball contents in Git. The Rust build system ver
First reported Aug 15, 2023 21:39 UTCCatalog metadata updated Oct 13, 2026 20:51 UTCOpen evidence record
The ClamAV 1.5.0 is now available. You may find the source code and installers for this release at clamav.net/downloads or on the ClamAV GitHub release page. IMPORTANT: A major feature of the 1.5 release is a FIPS-mode compatible method for verifying the authenticity of CVD signature database archives and CDIFF signature database patch files. This feature relies on “.cvd.sign” signature files for the daily, main, and bytecode databases. The Freshclam with 1.5.0 will download these files as will the latest version of CVDUpdate. When they are not present, ClamAV will fall back to using the legacy MD5-based RSA signature check.Tip: If you are downloading the source from the GitHub release page, the package labeled "clamav-1.5.0.tar.gz" does not require an internet connection to build. All dependencies are included in this package. However, if you download the ZIP or TAR.GZ generated by GitHub, located at the very bottom, then an internet connection will be required during the build to download additional Rust dependencies. ClamAV 1.5.0 includes the following improvements and changes: Major changesAdded checks to determine if an OLE2-based Microsoft Office document is encrypted.GitHub pull requestAdded the ability to record URIs found in HTML if the generate-JSON-metadata feature is enabled. Also adds an option to disable this in case you want the JSON metadata feature but do not want to record HTML URIs. The ClamScan command-line option is --json-store-html-uris=no. The clamd.conf config option is JsonStoreHTMLURIs no. The libclamav general scan option is CL_SCAN_GENERAL_STORE_HTML_URISGitHub pull request #1GitHub pull request #2GitHub pull request #3Added the ability to record URIs found in PDFs if the generate-JSON-metadata feature is enabled. Also adds an option to disable this in case you want the JSON metadata feature but do not want to record PDF URIs. The ClamScan command-line option is --json-store-pdf-uris=no. The clamd.conf config option is JsonStorePDFURIs no. The libclamav general scan option is CL_SCAN_GENERAL_STORE_PDF_URISGitHub pull request #1GitHub pull request #2GitHub pull request #3GitHub pull request #4Added regex support for the clamd.conf OnAccessExcludePath config option. This change courtesy of GitHub user b1tg.GitHub pull requestAdded CVD signing/verification with external .sign files.Freshclam will now attempt to download external signature files to accompany existing .cvd databases and .cdiff patch files. Sigtool now has commands to sign and verify using the external signatures.ClamAV now installs a 'certs' directory in the app config directory (e.g., <prefix>/etc/certs). The install path is configurable. The CMake option to configure the CVD certs directory is -D CVD_CERTS_DIRECTORY=PATHNew options to set an alternative CVD certs directory:The command-line option for Freshclam, ClamD, ClamScan, and Sigtool is --cvdcertsdir PATHThe environment variable for Freshclam, ClamD, ClamScan, and Sigtool is CVD_CERTS_DIRThe config option for Freshclam and ClamD is CVDCertsDirectory PATHAdded two new APIs to the public clamav.h header:cl_error_t cl_cvdverify_ex( const char *file, const char *certs_directory, uint32_t dboptions); cl_error_t cl_cvdunpack_ex( const char *file, const char *dir, const char *certs_directory, uint32_t dboptions); The original cl_cvdverify and cl_cvdunpack are deprecated.Added a cl_engine_field enum option CL_ENGINE_CVDCERTSDIR. You may set this option with cl_engine_set_str and get it with cl_engine_get_str, to override the compiled in default CVD certs directory.Thank you to Mark Carey at SAP for inspiring work on this feature with an initial proof of concept for external-signature FIPS compliant CVD signing.GitHub pull request #1GitHub pull request #2GitHub pull r
First reported Oct 07, 2025 13:35 UTCCatalog metadata updated Oct 13, 2026 20:51 UTCOpen evidence record
The ClamAV 0.103 LTS release is nearing end-of-life (EOL) with regards to security vulnerability fix support from our team. This end of life date will be Sept. 14, 2024. ClamAV 0.103 users will be able to update signatures from the official database mirror for an additional one year after the EOL date. After Sept. 14, 2025, we may block ClamAV 0.103 from downloading signature updates. We recommend that users update to the newest LTS release, ClamAV 1.0.6. For users that want to upgrade to the newest non-LTS release, use ClamAV 1.3.1. The most recent version of ClamAV can be found here: https://www.clamav.net/downloads The following is a list of major changes available to users in the newest versions of ClamAV. Since ClamAV 0.103, ClamAV 1.0 LTS adds: · A new detection capability based on comparing image fuzzy hashes. · [Windows] A feature to start clamd and freshclam as Windows services. · [Windows] A feature to scan process memory with either clamscan or clamdscan. · Signature database load progress bars for clamscan. · Support for extracting images from OLE2-based Excel documents. · The ability to use *.cat files with CRB signature rules to trust signed Windows executables. · Support for decrypting read-only OLE2-based XLS files that are encrypted with the default password. · Significant reliability improvements to the All-Match scanning mode. · Multiple libclamav API improvements. · And more! Since ClamAV 1.0 LTS, ClamAV 1.3.1 adds: · Support for extracting Universal Disk Format (UDF) partitions. · Support for extracting ALZ archives. · Support for extracting LHA/LZH archives. · Support for extracting images embedded in HTML CSS<style> blocks. · Support for extracting attachments found in Microsoft OneNote files. · An option to customize the size of ClamAV's clean file cache. · Effective removal of the MaxScanSize limit so the total amount of data scanned when scanning a file or archive may exceed 4 gigabytes. Note: This
First reported Aug 07, 2024 13:55 UTCCatalog metadata updated Oct 13, 2026 20:51 UTCOpen evidence record
Today, we are publishing the 1.4.3 and 1.0.9 security patch versions. We have also added Linux aarch64 (aka ARM64) RPM and DEB installer packages for the 1.4 LTS release.The release files for the patch versions are available for download on the ClamAV downloads page, on the GitHub Release page, and through Docker Hub. The images on Docker Hub may not be immediately available on release day. Continue reading to learn what changed in each version.1.4.3ClamAV 1.4.3 is a patch release with the following fixes: CVE-2025-20260: Fixed a possible buffer overflow write bug in the PDF file parser that could cause a denial-of-service (DoS) condition or enable remote code execution.This issue only affects configurations where both:The max file-size scan limit is set greater than or equal to 1024MB.The max scan-size scan limit is set greater than or equal to 1025MB.The code flaw was present prior to version 1.0.0, but a change in version 1.0.0 that enables larger allocations based on untrusted data made it possible to trigger this bug.This issue affects all currently supported versions. It will be fixed in:1.4.31.0.9Thank you to Greg Walkup at Sandia National Labs for identifying this issue.CVE-2025-20234: Fixed a possible buffer overflow read bug in the UDF file parser that may write to a temp file and thus disclose information, or it may crash and cause a denial-of-service (DoS) condition.This issue was introduced in version 1.2.0. It will be fixed in 1.4.3.Thank you to volticks (@movx64 on Twitter/X), working with Trend Micro Zero Day Initiative, for identifying this issue.Fixed a possible use-after-free bug in the Xz decompression module in the bundled lzma-sdk library.This issue was fixed in the lzma-sdk version 18.03. ClamAV bundles a copy of the lzma-sdk with some performance changes specific to libclamav, plus select bug fixes like this one in lieu of a full upgrade to newer lzma-sdk.This issue affects all ClamAV versions at least as far back as 0.99.4. It will be fixed in:1.4.31.0.9Thank you to OSS-Fuzz for identifying this issue.Windows: Fixed a build install issue when a DLL dependency such as libcrypto has the exact same name as one provided by the Windows operating system.1.0.9ClamAV 1.0.9 is a patch release with the following fixes:CVE-2025-20260: Fixed a possible buffer overflow write bug in the PDF file parser that could cause a denial-of-service (DoS) condition or enable remote code execution.This issue only affects configurations where both:The max file-size scan limit is set greater than or equal to 1024MB.The max scan-size scan limit is set greater than or equal to 1025MB.The code flaw was present prior to version 1.0.0, but a change in version 1.0.0 that enables larger allocations based on untrusted data made it possible to trigger this bug.This issue affects all currently supported versions. It will be fixed in:1.4.31.0.9Thank you to Greg Walkup at Sandia National Labs for identifying this issue.Fixed a possible use-after-free bug in the Xz decompression module in the bundled lzma-sdk library.This issue was fixed in the lzma-sdk version 18.03. ClamAV bundles a copy of the lzma-sdk with some performance changes specific to libclamav, plus select bug fixes like this one in lieu of a full upgrade to newer lzma-sdk.This issue affects all ClamAV versions at least as far back as 0.99.4. It will be fixed in:1.4.31.0.9Thank you to OSS-Fuzz for identifying this issue.Windows: Fixed a build install issue when a DLL dependency such as libcrypto has the exact same name as one provided by the Windows operating system.
First reported Jun 18, 2025 14:41 UTCCatalog metadata updated Oct 13, 2026 20:51 UTCOpen evidence record
The ClamAV 1.2.0 feature release is now stable and available for download on the ClamAV downloads page, on the Github Release page, and through Docker Hub.Today, we are also publishing the 1.1.2, 1.0.3, and 0.103.10 security patch versions. You may be surprised about the impromptu patch release. Indeed, we just published patch versions earlier this month. Unfortunately, a recent CVE for the UnRAR* library has prompted us to prepare these additional updates. We strongly encourage everyone to upgrade to one of these versions. The release files for the patch versions are also available for download on the ClamAV downloads page, on the Github Release page, and through Docker Hub. Because ClamAV 1.2.0 is now the latest release, the release files for version 1.1.2 will be found under the "Previous Stable Releases" section of the ClamAV.net downloads page.*UnRAR is an open source library by the makers of WinRAR which we bundle with ClamAV under the name "libclamunrar". We are concerned that ClamAV may be affected by CVE-2023-40477. Special thanks to Jan Pokorny, at St. Anne's University Hospital, for identifying its potential impact on ClamAV and reporting it to us.Continue reading to learn what changed in each version.1.2.0ClamAV 1.2.0 includes the following improvements and changes:Major changesAdded support for extracting Universal Disk Format (UDF) partitions.Specifically, this version adds support for the Beginning Extended Area Descriptor (BEA01) type of UDF files.GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/941Added an option to customize the size of ClamAV's clean file cache.Increasing the size of the clean file cache may improve scan performance but will require more RAM. The cache size value should be a square number or will be rounded up to the nearest square number.The cache size option for clamd and clamscan is --cache-size. Alternatively, you can customize the cache size for ClamD by setting CacheSize in clamd.conf.Patch courtesy of Craig Andrews.GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/882Introduced a SystemD timer for running Freshclam updates, without sending Freshclam into the background. This takes the "burden of timing the updates" from Freshclam and puts it onto SystemD. The timer can be activated, audited, and the logs inspected:sudo systemctl enable --now clamav-freshclam-once.timer sudo systemctl list-timers sudo systemctl status clamav-freshclam-once.timer sudo systemctl status clamav-freshclam-once.service journalctl -u clamav-freshclam-once.service If you want a different update interval you can edit the timer unit file:sudo systemctl edit clamav-freshclam-once.timer Patch courtesy of Nils Werner.GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/962Raised the MaxScanSize limit so the total amount of data scanned when scanning a file or archive may exceed 4 gigabytes.Introduced the ability to suffix the MaxScanSize and other config file size options with a "G" or "g" for the number of gigabytes. For example, for ClamD you may now specify MaxScanSize 10G in clamd.conf. And for ClamScan, you may now specify --max-scansize=10g.The MaxFileSize is still limited internally in ClamAV to 2 gigabytes. Any file, or embedded file, larger than 2GB will be skipped. You may use clamscan --alert-exceeds-max, or the clamd.conf option AlertExceedsMax yes to tell if a scan is not completed because of the scan limits.Patch courtesy of matthias-fratz-bsz.GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/945Added ability for Freshclam to use a client certificate PEM file and a private key PEM file for authentication to a private mirror by setting the following environment variables:FRESHCLAM_CLIENT_CERT: May be set to the path of a file (PEM) containing the client certificate.FRESHCLAM_CLIENT_KEY: May be set to the pa
First reported Aug 28, 2023 21:15 UTCCatalog metadata updated Oct 13, 2026 20:51 UTCOpen evidence record
ClamAV version 0.103 will reach its end of life (EOL) for database updates on September 14, 2025. After this date, this version will no longer receive the latest virus definitions. To ensure your systems remain protected, please upgrade to the latest supported version of ClamAV before the end-of-life date. This will provide continued access to essential security updates and features. We recommend that users update to the newest release, ClamAV 1.4 LTS. For users that are unable to upgrade to version 1.4, you may find that ClamAV 1.0 LTS is more suitable. The most recent version of ClamAV can be found on the ClamAV Downloads page, on the ClamAV GitHub Releases page, and through Docker Hub. Information about how to install ClamAV is available in our online documentation. The following is a list of major changes available to users in the newest versions of ClamAV. ClamAV 1.0 LTS improves upon ClamAV 0.103 with features such as: A new detection capability based on comparing image fuzzy hashes [Windows] A feature to start ClamD and Freshclam as Windows services [Windows] A feature to scan process memory with either ClamScan or ClamDScan Signature database load progress bars for ClamScan Support for extracting images from OLE2-based Excel documents The ability to use *.cat files with CRB signature rules to trust signed Windows executables Support for decrypting read-only OLE2-based XLS files that are encrypted with the default password Significant reliability improvements to the All-Match scanning mode Multiple libclamav API improvementsClamAV 1.4 LTS improves upon ClamAV 1.0 with features such as: Support for extracting Universal Disk Format (UDF) partitionsSupport for extracting ALZ archives Support for extracting LHA/LZH archives Support for extracting images embedded in HTML CSS style-blocks Support for extracting attachments found in Microsoft OneNote files An option to customize the size of ClamAV's clean file cache Effective removal of the MaxScanSize limit so the total amount of data scanned when scanning a file or archive may exceed 4GB. Note: This does not allow individual file size to exceed the 2GB limit The ability for Freshclam to use a client certificate PEM file and a private key PEM file for authentication to a private mirror A new ClamScan and ClamD option to fail to load if the provided signature database is older than a given number of days Multiple libclamav API improvements You can learn more about ClamAV's End of Life policy here. If you have any questions, please ask on our mailing list or in the ClamAV Discord. Thank you for your continued support.
First reported Mar 27, 2025 10:00 UTCCatalog metadata updated Oct 13, 2026 20:51 UTCOpen evidence record
Today, we are publishing the 1.5.4 and 1.4.6 security patch versions. The release files for the patch versions are available for download on the ClamAV downloads page, on the GitHub Release page, and through Docker Hub with both Alpine and Debian containers. The images on Docker Hub may not be immediately available on release day. Continue reading to learn what changed in each version. 1.5.4ClamAV 1.5.4 is a patch release with the following fixes:CVE-2026-20337: Fixed ZIP catalogue capacity tracking that could write beyond a heap allocation while indexing local file headers.This issue affects ClamAV 1.5.0 through 1.5.3. The fix is included in 1.5.4.Thank you to Kevin Stubbings of the GitHub Security Lab team for identifying this issue.CVE-2026-20345: Fixed an indexing error while converting GPT partition names that could read or write beyond a stack-allocated partition entry.This issue affects ClamAV 0.98.2 through 1.5.3. The fix is included in 1.4.6 and 1.5.4.Thank you to Atuin - Automated Vulnerability Discovery Engine, Tianchu Chen of Tencent Xuanwu Lab for identifying this issue.CVE-2026-20339: Fixed an integer overflow in the PESpin unpacker that could allocate an undersized buffer and then write beyond it while rebuilding a PE file.This issue affects ClamAV 0.90 through 1.5.3. The fix is included in 1.4.6 and 1.5.4.Thank you to Feng Xue and, independently, Yazdan Soltani for identifying this issue.CVE-2026-20338: Fixed ownership handling while merging ZIP catalogue records that could cause an invalid free while scanning a malformed archive.This issue affects ClamAV 1.5.0 through 1.5.3. The fix is included in 1.5.4.Thank you to Daggolu Rakesh and, independently, Yazdan Soltani for identifying this issue.CVE-2026-20346: Fixed an integer underflow in the PDF parser that could cause a crash while reading a malformed hex string.This issue affects ClamAV 1.4.5 and earlier, and ClamAV 1.5.0 through 1.5.3. The fix is included in 1.4.6 and 1.5.4.Thank you to Tristan (@TristanInSec) for identifying this issue.CVE-2026-20347: Fixed undefined behavior and integer overflow in the Mach-O parser that could cause a crash while scanning a malformed Mach-O file.This issue affects ClamAV 1.4.5 and earlier, and ClamAV 1.5.0 through 1.5.3. The fix is included in 1.4.6 and 1.5.4.Thank you to Tristan (@TristanInSec) for identifying this issue.CVE-2026-20348: Fixed XAR parser size handling that could request an excessive allocation or exceed scan limits while decompressing a malformed table of contents.This issue affects ClamAV 0.98.1 through 1.5.3. The fix is included in 1.4.6 and 1.5.4.Thank you to leduckhuong for identifying this issue.CVE-2025-8088: Adopted the upstream UnRAR project fix in ClamAV's bundled UnRAR library. The fix rejects path separators in NTFS alternate data stream names to prevent extraction outside ClamAV's temporary scan directory on Windows.This issue affects ClamAV 0.101.0 through 1.5.3. The fix is included in 1.4.6 and 1.5.4.Thank you to Yazdan Soltani for identifying that this issue affects ClamAV.Fixed thread-safety issues in the clamd STATS command that could disclose process memory or crash the daemon while scans and STATS requests run concurrently. Also fixed partial socket-write handling used for large STATS responses.This issue affects ClamAV 0.95 through 1.5.3. The fix is included in 1.4.6 and 1.5.4.FreeBSD: Restored support for safe quarantine move and remove actions while preserving protection against source-path replacement races.This issue affects ClamAV 1.4.5 and 1.5.3. The fix is included in 1.4.6 and 1.5.4.Fixed an OpenSSL library-context leak in legacy hashing helpers when a requested message digest cannot be fetched, such as when the default provider is unavailable in a FIPS-enabled environment.This issue affects ClamAV 1.5.0 through 1.5.3. The fix is included in 1.5.4.Upgraded the Rust crossbeam-epoch dependency to resolve the RUSTSEC-2026-0204 advisory.1.4.6ClamAV 1.4.6 is a patch r
First reported Aug 07, 2026 15:45 UTCCatalog metadata updated Oct 13, 2026 20:51 UTCOpen evidence record
Enhancements: #18307 feat(Fintel): Simply the ExportHTML to PDF so that it generates directly the Fintel in PDF #17889 feat(accessibility): Update the BulkRelationDialog to be a more accessible design #17341 feat(backend): expose lock acquisition wait metrics to detect lock contention #14716 feat(security-coverage): multi-OpenAEV security coverage results Bug Fixes: #18321 fix(frontend): alerts page is blank since the news feed page extraction #18288 fix(frontend): investigation graph crashes when a relationship is nested on both ends #18285 fix(ci): doc ci is broken #18277 fix(integration-tests): the dates of the reports used in filterGroup-test.js are outdated, and it fails the tests #18273 fix(scope): mislaignment of delete button on tasks page #17694 fix(scope): Redis cluster mode: fixed TLS servername prevents using per-node certificates #17395 Missing-reference retry sleeps ~2s while the dependency race resolves in <0.3s #9838 fix(knowledge-view): table and bar counters don't refresh on add/delete element in knowledge tab Pull Requests: fix(i18n): update regex to handle t_i18n calls with multiple arguments (#16887) by Mathieu Cartaud (@mcartaud) in #16888 feat(client-python): opt-in exponential retry schedule for worker missing-reference waits (#17395) by Olivier SOTIN (@T0t1n) in #17398 fix(engine): retry failed bulk items selectively on partial failures (#17134) by Olivier SOTIN (@T0t1n) in #17141 fix(test): changed date management in filterGoup test (#18277) by MTorbay-Filigran in #18278 fix(redis): support per-node TLS certificates in clusters (#17694) by Laurent Bonnet (@labo-flg) in #17903 feat(telemetry): expose lock acquisition wait and contention metrics (#17341) by Olivier SOTIN (@T0t1n) in #17343 fix(ci): mkdocs build requires fetch-depth: 0 (#18285) by A. Jard (@aHenryJard) in #18286 feat(security-coverage): multi-OpenAEV security coverage results (#14716) by MTorbay-Filigran in #16072 feat(workflow): Make workflow publish create/resolve Status (#17898) by Florian DeLemarre (@delemaf) in #17927 fix(frontend): render both sides of a relationship nested on both ends in the knowledge graph (#18288) by Gabriele Bonadiman (@gabrielebonadiman) in #18290 feat(vulnerability): land SSVC risk-based prioritization metrics behind FF (#17045) by Marie Flores (@marieflorescontact) in #18074 feat(merge-users): dry-run/run framework, handler registry and coverage manifest (#17494) by Ludovic Bouges (@ludovic) in #17535 feat(merge-users): Scalar user references and public sharing user rewrite (#17495) by Ludovic Bouges (@ludovic) in #17577 feat(merge-users): RBAC rights merge and union/strict option (#17496) by Ludovic Bouges (@ludovic) in #17892 fix(security-coverage): show duration and affinity fields in both creation modes (#18301) by nvk (@nvkhope) in #18302 fix(deps): update dependency marked to v18.0.13 by renovate[bot] in #18297 fix(deps): update dependency react-intl to v10.2.2 by renovate[bot] in #18270 fix(deps): update dependency zod to v4.6.4 by renovate[bot] in #18265 fix(deps): update dependency convert to v8.0.2 - autoclosed by renovate[bot] in #18264 fix(deps): update dependency compression to v1.8.2 by renovate[bot] in #18263 feat(accessibility): Update the BulkRelationDialog to be a more accessible design (#17889) by scarletmerlin123 in #17916 fix(ui): alignment of delete button on tasks page (#18273) by Céline Sèbe (@CelineSebe) in #18300 feat(dx): add back-end rebuild + back+front GraphQL rebuild on save (#13402) by Octave (@OctaveLaventure) in #13857 chore(deps): lock file maintenance by renovate[bot] in #18254 fix(deps): update aws-sdk-js-v3 monorepo to v3.1130.0 by renovate[bot] in #18266 fix(deps): update dependency @langchain/openai to v1.5.13 by renovate[bot] in #18296 fix(deps): update dependency @langchain/core to v1.2.11 by renovate[bot] in #18295 fix(knowledge-view): table and bar counters don't refresh on add/delete element in knowledge tab (#9838) by Florian DeLemarre (@delemaf) in
First reported Sep 17, 2026 15:30 UTCCatalog metadata updated Oct 13, 2026 20:48 UTCOpen evidence record
Critical & security fixes: #18652 fix(organization): improvement of organization segregation #18813 chore(deps): security updates #18637 fix(ingestion): confine feed execution identity to its creator rights #18096 fix(backend): escaping in templates #18159 fix(ci): replace deprecated circleci/node:current image with cimg/node #18528 fix(publicdashboard): enforce capability checks for publicdashboards #17742 fix(user): improve org admin #18144 fix(user): improve userEdit #18446 fix(user): improve user service account edition #18423 chore(deps): LTS security update #18423 chore(deps): LTS security updates #18238 chore(dev): replace the MinIO image by pgsty/silo in the development + fix mkdoc build #17705 fix(email): Improve email verification #17754 fix(search): Update of search query processing #17756 fix(access): minor refactor of access utils #17678 fix(backend): improve emails #18075 fix(user): normalize email to avoid duplicate #17750 chore(lts03): update dependencies #17818 fix(notifiers): improve notifier connection query #17761 chore(lts03): update CI/CD and skills #17772 fix(theme): refactor themes #17618 fix(case-template): improvement of capability for case template relation mutations Direct security updates: compression updated from 1.8.1 to 1.8.2 nodemailer updated from 9.0.5 to 10.0.10 sanitize-html updated from — to 2.17.6 @types/sanitize-html updated from — to 2.16.1 seroval updated from — to 1.6.3 pycti updated from 7.260309.0.7 to 7.260309.0.8 starlette updated from — to 1.3.1 @graphql-tools/merge updated from — to 9.2.3 @graphql-tools/schema updated from — to 10.1.0 @graphql-tools/utils updated from — to 11.2.2 content-type updated from 2.0.0 to 2.1.0 zod updated from — to 4.5.4 Indirect (transient) security updates: @babel/generator updated from 7.29.7 to 7.29.8 @babel/parser updated from — to 7.29.8 @babel/traverse updated from 7.29.7 to 7.29.8 @babel/types updated from — to 7.29.8 @envelop/core updated from — to 5.6.0 @graphql-tools/executor-legacy-ws updated from 1.1.28 to 1.1.33 @graphql-tools/graphql-file-loader updated from 8.1.14 to 8.1.19 @graphql-tools/import updated from 7.1.14 to 7.1.19 @graphql-tools/json-file-loader updated from 8.0.28 to 8.0.33 @graphql-tools/load updated from 8.1.10 to 8.1.16 @graphql-tools/url-loader updated from 9.1.2 to 9.1.7 @repeaterjs/repeater updated from 3.0.6 to 3.1.0 @xmldom/xmldom updated from 0.8.13 to 0.8.15 dayjs updated from — to 1.11.21 deepmerge updated from — to 4.3.1 destroy updated from — to 1.2.0 dom-serializer updated from — to 2.0.0 dom-serializer updated from — to 3.1.1 domelementtype updated from — to 2.3.0 domelementtype updated from — to 3.0.0 domhandler updated from — to 5.0.3 domhandler updated from — to 6.0.1 domutils updated from — to 3.2.2 domutils updated from — to 4.0.2 entities updated from — to 4.5.0 entities updated from — to 7.0.1 entities updated from — to 8.0.0 fast-uri updated from 3.1.5 to 3.1.8 htmlparser2 updated from — to 10.1.0 htmlparser2 updated from — to 12.0.0 iconv-lite updated from — to 0.7.3 ip-address updated from — to 10.7.0 is-plain-object updated from — to 5.0.0 js-yaml updated from 4.1.1 to 4.3.2 launder updated from — to 1.7.1 nanoid updated from — to 3.3.18 parse-srcset updated from — to 1.0.2 picomatch updated from 4.0.4 to 4.0.7 postcss updated from — to 8.5.26 proxy-addr updated from 2.0.7 to 2.0.8 qs updated from — to 6.16.0 side-channel updated from 1.1.0 to 1.1.1 side-channel-list updated from 1.0.0 to 1.0.1 undici updated from 6.27.0 to 6.29.0 @grpc/grpc-js updated from 1.14.3 to 1.14.5 undici updated from 7.22.0 to 7.30.0 Pull Requests: fix(case-template): improvement of capability for case template relation mutations (#17618) by Céline Sèbe (@CelineSebe) in #17692 fix(theme): refactor themes (#17772) by Jeremy Cloarec (@JeremyCloarec) in #17780 chore(lts03): update CI/CD and skills (#17761) by A. Jard (@aHenryJard) in #17762 fix
First reported Oct 07, 2026 20:02 UTCCatalog metadata updated Oct 13, 2026 20:48 UTCOpen evidence record
Enhancements: #18238 chore(dev): replace the MinIO image by pgsty/silo in the development and CI stacks #17648 feat(platform): configurable keep-alive/headers timeout for ALB/ECS to prevent intermittent 502s #17403 feat(ci): backend test jobs rebuild from scratch 3x instead of reusing a pre-built image Bug Fixes: #18142 fix(tests): the telemetry collector clears the Redis gauges while the integration tests run (flaky test) #18133 fix(tests): the integration test wait budgets are unmeasured (flaky tests) #17947 fix(report): Report updates silently dropped when published is the epoch placeholder (1970-01-01) #17576 fix(segregation): Live stream share objects' stix IDs contained in container even though they do not meet the filter of the stream #17472 fix(backend): pingConnector echoes stale connector_state under ES latency (read-after-write race) #17226 fix(scope): Attack Patterns list (kill chain) view fails on large entities - "An unknown error occurred" (StixDomainObjectAttackPatternsKillChainQuery) Pull Requests: feat(platform): configurable keep-alive timeout for deployments behind a load balancer (#17648) by Xavier Fournet (@xfournet) in #17943 fix(segregation): ids of entities that do not meet the filter of the stream are no longer shared in the object_ref list (#17576) by MTorbay-Filigran in #17949 test(backend): do not start the telemetry manager during the tests (flaky test) (#18142) by Xavier Fournet (@xfournet) in #18161 fix(deps): update graphql-tools monorepo by renovate[bot] in #18225 fix(deps): update dependency marked to v18.0.12 by renovate[bot] in #18223 fix(deps): update dependency nodemailer to v10.0.1 by renovate[bot] in #18224 fix(deps): update dependency maplibre-gl to v6.8.0 by renovate[bot] in #18227 test(backend): set the wait budgets from measured timings (#18133) by Xavier Fournet (@xfournet) in #18134 fix(backend): pingConnector echoes stale connector_state under ES latency read-after-write race (#17472) by Gabriele Bonadiman (@gabrielebonadiman) in #18196 refactor(news-feed): extract news feed components to a specific page (#18085) by Valentin (@Kroustille) in #18150 fix(report): preserve published date when set to epoch placeholder (#17947) by Ludovic Bouges (@ludovic) in #18221 chore(dev): replace the MinIO image by pgsty/silo in the development and CI stacks (#18238) by Xavier Fournet (@xfournet) in #18239 fix(deps): update dependency @mistralai/mistralai to v2.7.0 by renovate[bot] in #18241 docs(deployment): finish the MinIO to Silo rename after #18239 - FIPS, map and configuration pages (#18244) by Samuel Hassine (@SamuelHassine) in #18245 fix(deps): update dependency openai to v7.13.0 by renovate[bot] in #18237 fix(deps): update rjsf monorepo to v6.10.0 by renovate[bot] in #18246 docs(fips): point the MinIO FIPS images to Quay.io (#18242) by Xavier Fournet (@xfournet) in #18243 fix(deps): update aws-sdk-js-v3 monorepo by renovate[bot] in #18252 fix(deps): update dependency zod to v4.6.1 by renovate[bot] in #18253 fix(deps): update dependency @langchain/openai to v1.5.12 by renovate[bot] in #18249 fix(deps): update dependency @langchain/core to v1.2.10 by renovate[bot] in #18248 fix(ap): batch nested connections to prevent list view errors (#17226) by nvk (@nvkhope) in #17954 fix(ci): reuse builder-back image across backend test jobs instead of rebuilding 3x (#17403) by Gabriele Bonadiman (@gabrielebonadiman) in #17860 refactor(backend): refactor engine mapping generation (#13635) by Souad Hadjiat (@SouadHadjiat) in #15857 Full Changelog: 7.260910.0...7.260914.0
First reported Sep 14, 2026 13:44 UTCCatalog metadata updated Oct 13, 2026 20:48 UTCOpen evidence record
Enhancements: #17824 feat(security-coverage): Creating a manual security coverage entity - allowing selection of entities #15492 feat(security-coverage): manually re-link behaviors (TTPs), vulnerabilities and related entities to assess coverage #8920 feat(ingestion): provide TAXII Client errors within UI Bug Fixes: #18594 fix(xtm-one): open XTM One in the browser on the identity it publishes, not on its internal URL #18564 fix(xtm-one): trust and address XTM One by its published identity when it is reached on an internal URL #18528 fix(publicdashboard): improve dashboard created by admin #18468 fix(scope): Custom theme does not expose color setting for blue custom fields after v7.260921.0 upgrade #18293 fix(data-sharing): Embedded image in report description not synced via live stream Pull Requests: fix(publicdashboard): enforce capability checks for restricted user contexts (#18528) by Marie Flores (@marieflorescontact) in #18534 feat(merge-users): disable the source, emit the merge trace and gate the source deletion (#17499) by Ludovic Bouges (@ludovic) in #18039 chore(deps): bump @filigran/chatbot to 3.11.0 (#18549) by Samuel Hassine (@SamuelHassine) in #18551 feat(catalog): reload catalog when manifest has changed on backend (#18280) by esrevi in #18465 chore(deps): bump @filigran/chatbot to 3.11.1 (#18560) by Samuel Hassine (@SamuelHassine) in #18561 fix(graphql-upload): align multipart GraphQL filed size limit with JSON body limit (#18293) by esrevi in #18538 fix(front): let a custom theme reach the design system tokens (#18468) by Sandy Ghs (@sandyghs) in #18544 fix(xtm-one): trust and address XTM One by its published identity when it is reached on an internal URL (#18564) by Samuel Hassine (@SamuelHassine) in #18585 fix(deps): update dependency csv-parse to v7.0.3 by renovate[bot] in #18589 fix(xtm-one): open XTM One in the browser on the identity it publishes, not on its internal URL (#18594) by Samuel Hassine (@SamuelHassine) in #18595 fix(xtm-one): read XTM One's identity for the browser only when XTM One is configured (#18594) by Samuel Hassine (@SamuelHassine) in #18596 feat(backend): merge users: close the accesses the merged-away account keeps (#17500) by Ludovic Bouges (@ludovic) in #18041 test(merge): raise the filterTargetByExisting growth threshold from 10 to 15 (#18592) by Xavier Fournet (@xfournet) in #18593 fix(deps): update dependency ws to v8.22.0 by renovate[bot] in #18598 fix(deps): update dependency re2 to v1.27.0 by renovate[bot] in #18597 chore(deps): update yarn to v4.18.1 by renovate[bot] in #18588 feat(catalog): add min_version and max_version fields to V1 catalog schema (#18545) by Sébastien Wauquier (@fellowseb) in #18546 test(e2e): wait for each dashboard date clear to be saved before typing the next date (#18601) by Xavier Fournet (@xfournet) in #18602 fix(deps): update dependency jsonpath-plus to v11 by renovate[bot] in #18509 Full Changelog: 7.260928.1...7.260930.0
First reported Sep 30, 2026 07:46 UTCCatalog metadata updated Oct 13, 2026 20:48 UTCOpen evidence record
Enhancements: #18485 feat(xtm-one): verify the Filigran-signed XTM license returned by XTM One registration #18399 feat(datamodel): add number_seen and max_distinct_count counters to Observed Data #18233 docs(news-feed): update XTM Hub docs with new page #17938 feat(accessibility): Update use of MenuList to List to resolve keyboard navigation issues #17407 feat(accessibility): Resolve high accessibility issues #17350 feat(logs): Add ingestion logs on all ingestion type #17045 feat(vulnerability): SSVC risk-based prioritization metrics (CISA BOD 26-04) #11940 feat(datamodel): support "sighting" between an Indicator and a "Security Platform" Bug Fixes: #18492 fix(ai): route Ask AI container report generation through XTM One #18476 fix(merge-users): the dry/real divergence refusal never says what diverged #18462 fix(ip-accesslist): admin config token is not excluded from access list check #18432 fix(perf): improve buildChanges time complexity #18405 fix(connector): prevent connector managed deployment #18318 fix(frontend): Pagination returns no results on page 2 when combining filters #18230 fix(playbooks): Update Knowledge reports successful patch but does not persist the change #18144 fix(User): improve userEdit #17913 [Merge] Merged entity does not set the acting user as creator #17742 fix(user): improve org admin #17740 fix(user): improve service account edition #17694 fix(scope): Redis cluster mode: fixed TLS servername prevents using per-node certificates #16148 fix(notifications): notifications are still sent to expired or inactive accounts #13752 fix(decay-rules): decay exclusions should set valid_until much later and not get revoked Community Contributions Highlight: feat(accessibility): update components to use List and ListItemButton instead of MenuList and MenuItem (#17938) by scarletmerlin123 in #17941 Pull Requests: fix(deps): update dependency lru-cache to v11.5.3 by renovate[bot] in #18409 fix(deps): update dependency canonicalize to v5.1.0 by renovate[bot] in #18411 fix(deps): update dependency react-intl to v12.1.1 by renovate[bot] in #18410 chore(deps): update rabbitmq docker tag to v4.3.6 by renovate[bot] in #18408 fix(deps): update dependency openai to v7.19.0 by renovate[bot] in #18412 feat(observed-data): add number_seen and max_distinct_count counters (#18399) by Samuel Hassine (@SamuelHassine) in #18400 fix(deps): update dependency js-base64 to v3.9.4 by renovate[bot] in #18420 fix(deps): update dependency react-intl to v12.1.2 by renovate[bot] in #18421 fix(deps): update dependency openai to v7.20.0 by renovate[bot] in #18422 fix(notifications): filter out inactive users in notifications (#16148) by Jeremy Cloarec (@JeremyCloarec) in #17826 feat(vulnerability): SSVC risk-based prioritization metrics (#17045) by Marie Flores (@marieflorescontact) in #18367 fix(connector): prevent deploy connector without EE license (#18405) by esrevi in #18406 fix(ingestion): remove ingestion logs feature flag and fix JSON log status (#17350) by Marie Flores (@marieflorescontact) in #18369 feat(accessibility): Resolve high accessibility issues (#17407) by scarletmerlin123 in #17505 docs(news-feed): update XTM Hub docs with new page (#18233) by Valentin (@Kroustille) in #18234 fix(redis): always default to redis__hostname for tls servername if no tls__servername set (#17694) by Jeremy Cloarec (@JeremyCloarec) in #18416 chore(migration): introduce opencti_api_migration_duration metric (#16263) by Sébastien Wauquier (@fellowseb) in #16379 fix(case): fix typing issue in TaskPopover (#18431) by Sébastien Wauquier (@fellowseb) in #18433 fix(deps): update dependency eventsource to v5.1.2 by renovate[bot] in #18443 fix(deps): update dependency @lezer/javascript to v1.5.5 by renovate[bot] in #18442 perf(notification): build the update event context once per event (#18444) by Xavier Fournet (@xfournet) in #18445 perf(markdown): collect embedded image paths in a single pass per node (#18454) by Xavier Fournet (@xfournet)
First reported Sep 28, 2026 14:08 UTCCatalog metadata updated Oct 13, 2026 20:48 UTCOpen evidence record
Enhancements: #18328 News Feed OCTI for OCTI Integrations (except connectors) #18216 Enforce dependency declarations in CI #15604 feat(fintel): column selection for entity attributes Bug Fixes: #18355 fix(ci): the minio host port 35300 collides with the runner ephemeral port range #18326 test(e2e): the dashboard restriction test runs with a user missing its seeded group and cannot be retried #18325 fix(tests): the raw stream test flips between 15 and 16 report updates since workflow publish creates statuses #18112 fix(draft): exiting a draft does not always clear the draft context #18026 fix(pycti): Invalid STIX bundle produced by pycti get_stix_bundle_or_object_from_entity_id when entity creator organization is TLP-restricted for the requesting user #15021 fix(export): wide tables embedded in report content are cut off in PDF exports Pull Requests: feat(fintel): column selection for entity attributes (#15604) by Gwendoline-FAVRE-FELIX in #18143 refactor(health): expose health and storage metrics through the prometheus subsystem (#17770) by Sébastien Bocahu (@sbocahu) in #17417 fix(deps): update dependency nodemailer to v10.0.9 by renovate[bot] in #18250 fix(tests): patch the legacy status to a status different from the current one (#18325) by Xavier Fournet (@xfournet) in #18327 test(e2e): fail the seeding on error and keep the admin session across the dashboard restriction test (#18326) by Xavier Fournet (@xfournet) in #18329 fix(deps): update dependency file-type to v22.1.0 by renovate[bot] in #18268 fix(deps): update dependency zod to v4.6.5 by renovate[bot] in #18316 fix(deps): update dependency maplibre-gl to v6.9.1 by renovate[bot] in #18240 fix(deps): update dependency content-type to v3.1.0 by renovate[bot] in #18267 fix(deps): update dependency nodemailer to v10.0.10 by renovate[bot] in #18342 fix(deps): update dependency canonicalize to v5 by renovate[bot] in #18236 chore(deps): update devdependencies (non-major) by renovate[bot] in #18251 fix(deps): update dependency openai to v7.15.0 by renovate[bot] in #18269 chore(ci): enforce dependency declarations in CI, and fix the drift it surfaced (#18216) by Xavier Fournet (@xfournet) in #18217 test(e2e): assert the page the restoring login actually displays (#18343) by Xavier Fournet (@xfournet) in #18344 fix(deps): update dependency @mui/types to v7.4.12 by renovate[bot] in #18347 chore(deps): update dependency knip to v6.35.1 by renovate[bot] in #18349 fix(deps): update dependency undici to v6.28.1 by renovate[bot] in #18346 fix(deps): update dependency undici to v8 by renovate[bot] in #18348 fix(ci): stop publishing the unused minio host port 35300 (#18355) by Xavier Fournet (@xfournet) in #18356 fix(backend): preserve standard id when building a restricted entity (#18026) by Gabriele Bonadiman (@gabrielebonadiman) in #18147 fix(deps): update dependency moment to v2.31.0 by renovate[bot] in #18359 chore(deps): update codecov/codecov-action action to v7.1.0 by renovate[bot] in #18358 docs(exclusion-lists): clarify CIDR usage and indicator-only scope (#18333) by Gabriele Bonadiman (@gabrielebonadiman) in #18330 docs(saml): add information on signing requests (#17893) by A. Jard (@aHenryJard) in #17895 fix(deps): update dependency eventsource-parser to v4.1.1 by renovate[bot] in #18370 chore(tooling): move the tooling to TypeScript and lint every source file (#18350) by Xavier Fournet (@xfournet) in #18351 fix(deps): update dependency maplibre-gl to v6.10.0 by renovate[bot] in #18373 fix(deps): update dependency markdown-to-jsx to v9.10.3 by renovate[bot] in #18374 fix(deps): update dependency react-router to v7.18.4 by renovate[bot] in #18371 fix(deps): update dependency react-intl to v12 by renovate[bot] in #18372 fix(deps): update dependency react-intl to v12.0.2 by renovate[bot] in #18377 fix(deps): update rjsf monorepo to v6.10.1 by renovate[bot] in #18380 fix(deps): update dependency graphql-ws to v6.2.2 by renovate[bot] in #18379 chore(deps): update devdepe
First reported Sep 21, 2026 18:42 UTCCatalog metadata updated Oct 13, 2026 20:48 UTCOpen evidence record
Pull Requests: fix(connector): await initial auto-upgrade run when answering to Composer (#18508) by Sébastien Wauquier (@fellowseb) in #18510 Full Changelog: 7.260928.0...7.260928.1
First reported Sep 28, 2026 15:27 UTCCatalog metadata updated Oct 13, 2026 20:48 UTCOpen evidence record
Critical & security fixes: #18462 fix(ip-whitelist): fix incorrect exclusion of bypass tokens #18528 fix(publicdashboard): enforce capability checks for publicdashboard #18096 fix(backend): escaping in templates #17742 fix(user): improve org admin #18144 fix(user): improve userEdit #18446 fix(user): improve user service account edition #17754 fix(search): Update of search query processing #17756 fix(access): minor refactor of access utils #17678 fix(backend): improve emails #18075 fix(user): normalize email to avoid duplicate #17818 fix(notifiers): improve notifier connection query #17705 fix(email): Improve email verification #17772 fix(theme): refactor themes #17618 fix(case-template): improvement of capability for case template relation mutations Direct security updates: nodemailer updated from 9.0.5 to 10.0.10 compression updated from 1.8.1 to 1.8.2 @filigran/rich-text-editor updated from 1.2.0 to 1.2.1 Indirect (transient) security updates: @xmldom/xmldom updated from 0.8.13 to 0.8.15 brace-expansion updated from 1.1.16 to 1.1.21 brace-expansion updated from 2.1.2 to 2.1.7 brace-expansion updated from 5.0.8 to 5.0.12 fast-uri updated from 3.1.4 to 3.1.8 fast-uri updated from 4.1.1 to 4.2.1 ip-address updated from 10.2.0 to 10.7.2 undici updated from 6.28.0 to 6.28.1 undici updated from 8.9.0 to 8.10.2 @tiptap/core updated from 3.23.1 to 3.30.5 js-yaml updated from 3.15.0 to 3.15.1 nanoid updated from 3.3.16 to 3.3.18 nanoid updated from 3.3.17 to 3.3.19 postcss updated from 8.5.22 to 8.5.28 Pull Requests: fix(case-template): improvement of capability for case template relation mutations (#17618) by Céline Sèbe (@CelineSebe) in #17693 fix(theme): refactor themes (#17772) by Jeremy Cloarec (@JeremyCloarec) in #17779 fix(email): Improve email verification (#17705) by Sarah Bocognano (@SarahBocognano) in #17776 fix(notifiers): improve notifier connection query (#17818) by Sarah Bocognano (@SarahBocognano) in #17822 fix(user): normalize email to avoid duplicate (#18075) by Marie Flores (@marieflorescontact) in #18104 fix(backend): improve emails (#17678) by Landry Trebon (@lndrtrbn) in #18146 fix(access): minor refactor of access utils (#17756) by Florian DeLemarre (@delemaf) in #18164 fix(search): Update of search query processing (#17754) by Florian DeLemarre (@delemaf) in #18166 chore(dev): replace the MinIO image by pgsty/silo in the development + fix mkdoc build (#18238) by A. Jard (@aHenryJard) in #18309 chore(deps): security updates (#18426) by Laurent Bonnet (@labo-flg) in #18429 fix(user): improve user service account edition (#18446) by Jeremy Cloarec (@JeremyCloarec) in #18402 chore(docker): remove the now unused libmagic native dependency (#17911) by A. Jard (@aHenryJard) in #18517 fix(user): improve userEdit (#18144) by Marie Flores (@marieflorescontact) in #18521 fix(user): improve org admin (#17742) by Jeremy Cloarec (@JeremyCloarec) in #18467 feat(docker): adopt the FIPS 140-3 validated base image (#17908) by A. Jard (@aHenryJard) in #18527 fix(publicdashboard): enforce capability checks for publicdashboard (#18528) by Marie Flores (@marieflorescontact) in #18540 fix(backend): escaping in templates (#18096) by A. Jard (@aHenryJard) in #18531 fix(ci): replace deprecated circleci/node:current image with cimg/node (#18159) by A. Jard (@aHenryJard) in #18529 fix(ip-whitelist): fix incorrect exclusion of bypass tokens (#18462) by Landry Trebon (@lndrtrbn) in #18536 feat(platform): replace external map tile server with local PMTiles rendering (#17254) by A. Jard (@aHenryJard) in #18520 fix(dep): update dependencies for LTS (#18547) by A. Jard (@aHenryJard) in #18550 fix(dep): update dependencies for LTS (#18547) by A. Jard (@aHenryJard) in #18591 Full Changelog: 7.260811.0...7.260811.0-lts.1
First reported Sep 30, 2026 15:01 UTCCatalog metadata updated Oct 13, 2026 20:48 UTCOpen evidence record
Enhancements: #18737 feat(settings): redesign the Parameters page with a balanced layout and a scannable managers grid #18710 feat(platform): the hubs own the page of every Defense area and Curation tab #18478 feat(platform): make the country boundaries file replaceable like the map tiles #18036 feat(accessibility): add dialog role to drawers that function like dialogs #16707 feat(scope): See only used Techniques in MITRE Matrix view in security coverages #16526 feat(sbom): Build rolling docker image with github workflow #15738 fix: in high-concurrency scenarios, denormalized relationship indexing can lead to version conflict errors #15605 feat(fintel): entity deep-link column #12062 feat(dashboards): allow switching AND/OR in dynamic filter of dashboard queries #7053 feat(ux): display relationships in a Report/container as a list, not only in the graph Bug Fixes: #18851 fix(connector): active derived field is mistakenly computed from updated_at #18798 fix(frontend): sort catalog contracts without a title on Integrations page #18796 fix(backend): detect already deleted errors in rule manager clean #18784 fix(backend): do not resolve service accounts as notification recipients #18739 fix(frontend): main content editor cannot be scrolled when its content is taller than the editor #18735 fix(settings): name every manager of the Parameters page in all languages #18712 fix(provenance): provenance tracking adds an Elasticsearch write to every upsert #18703 Platform start fails with 'Limit of total fields [3000] has been exceeded' on long-lived indices when the schema grows #18695 fix(client-python): ingest observed data number_seen and max_distinct_count counters #18664 fix(investigation): editing a selected label or marking node crashes the edit drawer #18659 fix(security-coverage): bundle fails with "No relation converter_2_1 available" when container holds a contains link #18652 Improvement of organization segregation #18637 fix(ingestion): improve ingestion #18516 fix(ui): Bad Design and UX when creating a relation from a relationship #18515 fix(ui): Double scrollbar in Indicator creation from observable #18513 fix(error): fix manager error level to have error only when it's a platform issue. #18353 fix(frontend): tooltips anchored on a React Fragment never open #18179 fix(ui): Pop-up wrong size in User overviews #17793 fix(connectors): when an enrichment connector is stopped it continues to receive bundles in its queue #17515 fix(frontend): no "Equals/not equal" operator on numeric filters for Autonomous System Number #17333 Ctrl+click does not open integrations catalog and deployed links in a new tab #16650 fix(global-search): Erasing search text and then selecting filters does not remove the search text from query #16127 fix(playbook): "apply to" labels are not translated into other languages #15498 fix(rbac): export panel, non-admin users can see exports from other users/organizations #14247 fix(notifications): marking not present in the email notification #10553 fix(csv-mapper): lack of control over Opinion values Pull Requests: feat(connector): pass version and slug at registration (#18038) by Sébastien Wauquier (@fellowseb) in #18086 fix(ui): double scrollbar in indicator creation from entity (#18515) by Archidoit in #18649 fix(playbook): add translations for "apply to" labels (#16127) by Céline Sèbe (@CelineSebe) in #18650 chore(deps): update prom/prometheus docker tag to v3.15.0 by renovate[bot] in #18590 feat(catalog): show unmanaged connectors and platform compatibility (#18299) by esrevi in #18584 fix(deps): update rjsf monorepo to v6.11.0 by renovate[bot] in #18669 fix(deps): update dependency openai to v7.25.0 by renovate[bot] in #18668 fix(deps): update dependency react-force-graph-3d to v1.29.2 by renovate[bot] in #18667 fix(deps): update dependency react-force-graph-2d to v1.29.2 by renovate[bot] in #18666 fix(deps): update dependency nodemailer to v10.0.13 by renovate[bot] in #18670 fix(client-python):
First reported Oct 09, 2026 09:08 UTCCatalog metadata updated Oct 13, 2026 20:48 UTCOpen evidence record
Enhancements: #18605 feat(chatbot): show quota, prompts and persisted message feedback in the embedded chat #18453 feat(perf): improve findRemovedEmbeddedStoragePathsFromMarkdownFields usage #18449 refactor(notifications): split alerts and triggers in notifications page #13041 feat(investigation): allow 1-click duplication of investigations Bug Fixes: #18630 fix(history): history and activity managers replay the stream backlog from where it started at startup after a stream interruption upon resume #18612 fix(merge-users): userMerge-restrictedMembers-test races the history record of its own case #18607 refactor(user): migrate user to module #18599 fix(stream): stream processor waits after every batch, even when more events are pending #18567 fix(health): s3_used_size collection times out on buckets holding many files #18555 fix(scope): Running OpenAEV enrichment on a manual Security Coverage hides existing coverage results until page refresh #18552 Publisher manager leaks SMTP sockets #18460 fix(security-coverage): coverage results wiped after triggering enrichment #18446 fix(user): improve service account edition port to LTS #18436 fix(perf): improve cachemanager pubsub usage #18435 fix(fintel): fix issues related to introduction of the shortcut for fintel generation #18404 fix(error): improve management of "Http call interceptor fail" #18291 fix(scope): CVSS3 enum values trigger INTERNAL_SERVER_ERROR instead of validation error #18180 fix(ui): (+) button instead of 'create X' button #17952 fix(dashboards): Date attribute selection in step 4 shows attributes irrelevant to the selected perspective Pull Requests: fix(perf): in cache manager, only sub to relevant topics (#18436) by Jeremy Cloarec (@JeremyCloarec) in #18437 feat(chatbot): show quota, prompts and persisted message feedback in the embedded chat (#18605) by Samuel Hassine (@SamuelHassine) in #18606 feat(perf): only call findRemovedEmbeddedStoragePathsFromMarkdownFields when necessary (#18453) by Jeremy Cloarec (@JeremyCloarec) in #18464 fix(security-coverage): keep coverage results id in enrichment fragment (#18460) by nvk (@nvkhope) in #18461 fix(widget): Date attribute input values according to widget perspective (#17952) by Archidoit in #18456 fix(smtp): set a default SMTP connection timeout (#18552) by nvk (@nvkhope) in #18553 test(merge-users): stop racing the history record of the restricted members case (#18612) by Ludovic Bouges (@ludovic) in #18613 fix(redis): fix tls_cluster_node_mode conf name (#17694) by Jeremy Cloarec (@JeremyCloarec) in #18616 fix(deps): update dependency react-router to v8 by renovate[bot] in #18176 fix(stream): read again right away after a full stream batch (#18599) by Xavier Fournet (@xfournet) in #18600 fix(deps): update dependency amqplib to v2.1.0 by renovate[bot] in #18627 fix(deps): update dependency @langchain/core to v1.2.13 by renovate[bot] in #18624 fix(deps): update dependency nodemailer to v10.0.11 by renovate[bot] in #18625 fix(deps): update dependency @langchain/openai to v1.6.0 by renovate[bot] in #18626 feat(notifications): merge alerts and notifications page (#18449) by hervyt in #18457 fix(error): update error level for http bad formatted requests (#18404) by A. Jard (@aHenryJard) in #18414 fix(fintel): fix issues related to introduction of the shortcut for fintel generation (#18435) by Florian DeLemarre (@delemaf) in #18518 feat(workflow): make Status a workflowDefinition projection (#17899) by Florian DeLemarre (@delemaf) in #18152 refactor(user): migrate user backend code to module architecture (#18607) by Marie Flores (@marieflorescontact) in #18621 fix(ui): Replace remaining (+) buttons by Create button (#18180) by Archidoit in #18511 fix(fintel): allow column customization for related entities in Fintel templates (#12861) by Gwendoline-FAVRE-FELIX in #18533 fix(deps): update dependency react-pdf to v11 by renovate[bot] in #18271 fix(history): resume history and activity managers from last indexed event
First reported Oct 02, 2026 10:01 UTCCatalog metadata updated Oct 13, 2026 20:48 UTCOpen evidence record
The public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.