Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in its send buffer instead of zeros, and the server stores ...
First reported Oct 07, 2026 23:03 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordVault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. When Vault uses Shamir seals and has an external...
First reported Oct 07, 2026 21:37 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordVault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of...
First reported Oct 07, 2026 21:48 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the enabled-by-default cookie store re...
First reported Oct 07, 2026 20:54 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordA heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGE...
First reported Oct 07, 2026 19:29 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordProtection Mechanism Failure. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by C...
First reported Oct 07, 2026 20:46 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, ANCHORARRAY recursively calls the exported CalcCellValue function, creating a fresh cal...
First reported Oct 07, 2026 17:51 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, WebSocketHandler.upgrade aborts a h...
First reported Oct 07, 2026 21:27 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxied ws request is carried thr...
First reported Oct 07, 2026 21:28 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordThe LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the process_step_cus...
First reported Oct 07, 2026 23:27 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordIn Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could cause Splunk Secure Gateway to sign attacker-controlled p...
First reported Oct 07, 2026 20:46 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordCVE-2026-97715 is a vulnerability in the client registration process of Secure Access servers prior to version 14.60. Authenticated attackers can pass malformed data to the server and cause a persi...
First reported Oct 07, 2026 19:30 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordIn Splunk Enterprise versions below 10.4.3, a user that holds a role with the list_spl2_modules capability could use SQL injection in SPL2 module filtering to access all relevant data available thr...
First reported Oct 07, 2026 20:46 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordThe Aurora Heatmap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.7.2 due to insufficient input sanitization and o...
First reported Oct 07, 2026 23:27 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordInsufficient API bounds checking in phalFelica in NXP NXPNfcRdLib RC663 through 07.14.00_Pub may allow an attacker with privileges or an untrusted third party to access unintended memory regions, p...
First reported Oct 08, 2026 02:04 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordVault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated user with delegated permissions to byp...
First reported Oct 07, 2026 22:01 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordIn OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with ...
First reported Oct 07, 2026 20:08 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordpgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first part of a value on a connection with GSS encryption (gssEn...
First reported Oct 07, 2026 18:19 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordUse of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable. This issue affects ADVMS: before 3.10.
First reported Oct 07, 2026 19:36 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordImproper Adherence to Coding Standards. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are gr...
First reported Oct 07, 2026 20:46 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordIn Progress® Telerik® Document Processing SpreadProcessing library, versions prior to 2026.3.1006, an infinite loop vulnerability exists when importing an XLS file with a specifically-targted corru...
First reported Oct 07, 2026 18:02 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0 in github.com/xuri/excelize/v2 and from 1.1.0 to 1.4.1 in github.com/xuri/excelize, Colu...
First reported Oct 07, 2026 18:26 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, flatCols expands file-loaded column ranges without validating Min and Max against the w...
First reported Oct 07, 2026 18:48 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.0 to 2.11.0, GetStyle's fill, border, and font extraction predicates check only upper bounds for att...
First reported Oct 07, 2026 18:55 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordA filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.