AETERNAE AI RESEARCH LLC INDEPENDENT RESEARCH
ÆAETERNAERESEARCH
Sign inRequest access
Æ / PUBLIC MALWARE INTELLIGENCE

Follow the evidence.

Published file metadata, source observations, indicators, and research history in one bounded catalog.

27Reachable catalog records
1 / 2Current catalog page
24Maximum records per page
0Samples downloaded by this page
Clear filters
27 MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
REPORT1 SOURCE

Control iD iDSecure Multiple Denial of Service Vulnerabilities

Control iD iDSecure Multiple Denial of Service Vulnerabilities Control iD iDSecure is an on-premises access control and time attendance management application for Windows. Version 4.8.1.0 is affected by multiple vulnerabilities:CVE-2026-92625 :Unauthenticated Service Restart Denial of Service (High): The /api/license/restartService endpoint is reachable without authentication and invokes an intern

First reported Aug 12, 2026 19:50 UTCOpen evidence record
REPORT1 SOURCE

ScadaLTS Multiple Vulnerabilities

ScadaLTS Multiple Vulnerabilities ScadaLTS is an open-source, web-based SCADA/HMI application. Version 2.8.1-release-candidate build 0 is affected by multiple vulnerabilities:CVE-2026-84858: Authenticated Remote Code Execution via Scripting Sandbox Bypass (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)The DWR "DataSourceEditDwr" class exposes the "validateScript" method that compiles and executes attacker-s

First reported Sep 16, 2026 14:20 UTCOpen evidence record
REPORT1 SOURCE

Gogs - Authentication Bypass via Unvalidated Reverse Proxy Headers

Gogs - Authentication Bypass via Unvalidated Reverse Proxy Headers When 'ENABLE_REVERSE_PROXY_AUTHENTICATION' is enabled, Gogs accepts the configured authentication header (default: 'X-WEBAUTH-USER') directly from client requests without validating that the request originated from a trusted reverse proxy.Any remote attacker who can reach the Gogs service can forge this header to impersonate any us

First reported Jun 19, 2026 06:41 UTCOpen evidence record
REPORT1 SOURCE

Snipe-IT Checkout Request Cancellation IDOR

Snipe-IT Checkout Request Cancellation IDOR Snipe-IT is an open-source IT asset management application developed by Grokability, Inc. The endpoint that cancels asset checkout requests, POST /account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?}, trusts two user-controlled URL path parameters without performing a server-side authorization check. The cancel_by_admin segment is tre

First reported Aug 11, 2026 20:26 UTCOpen evidence record
REPORT1 SOURCE

WordPress Loops & Logic - Reflected XSS

WordPress Loops & Logic - Reflected XSS A Reflected Cross-Site Scripting vulnerability exists in the Wordpress plugin 'Loops & Logic' The ‘name’ parameter of the ‘tangible_fields_fetch’ and ‘tangible_fields_store’ actions is used in the response without any filtering, resulting in a reflected XSS vulnerability. curl http://WORDPRESS/wp-admin/admin-ajax.php?action=tangible_fields_fetch&name=%3cimg+

First reported Aug 28, 2026 06:39 UTCOpen evidence record
REPORT1 SOURCE

WordPress - Kubio AI Website Builder DoS

WordPress - Kubio AI Website Builder DoS The REST endpoint `GET /wp-json/kubio/v1/enable-theme` passes the client-supplied `name` parameter directly and without validation into WordPress core's `switch_theme()`:// lib/api/colibri.php function kubio_enable_theme( WP_REST_Request $data ) { switch_theme( $data['name'] ); // $data['name'] ) ); }Because `$data['name']` is not type-checked, an authorize

First reported Aug 31, 2026 15:42 UTCOpen evidence record
REPORT1 SOURCE

Google Cloud Platform (GCP) Apigee Cross-Tenant Data Exfiltration via Confused Deputy

Google Cloud Platform (GCP) Apigee Cross-Tenant Data Exfiltration via Confused Deputy Tenable Research has identified and responsibly disclosed a critical cross-tenant data exfiltration vulnerability in Google Cloud Apigee. This flaw allowed an attacker to abuse a "confused deputy" in Apigee's internal analytics infrastructure to read arbitrary Google Cloud Storage (GCS) objects across different t

First reported Aug 10, 2026 16:35 UTCOpen evidence record
REPORT1 SOURCE

Link Library - Reflected Cross-Site Scripting

Link Library - Reflected Cross-Site Scripting The WordPress Plugin Link Library version below 7.9.4 is affected by an unauthenticated Reflected XSS.The 'thumbs_rating_add_vote' AJAX handler reads the 'likelabel' parameter without any sanitization and echoes it back into an HTML response. Joshua Martinelle Wed, 07/29/2026 - 02:40

First reported Jul 29, 2026 06:40 UTCOpen evidence record
REPORT1 SOURCE

GCP Apigee PE to Service Agent with API Proxy

GCP Apigee PE to Service Agent with API Proxy Tenable Research has identified and responsibly disclosed a privilege escalation vulnerability in Google Cloud Apigee. This vulnerability allowed an attacker with restricted Apigee permissions to exfiltrate the OAuth access token of the privileged Apigee Core Service Agent.The vulnerability stems from Apigee API Proxies' ability to execute custom JavaS

First reported Aug 31, 2026 17:07 UTCOpen evidence record

A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.