Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
Welcome back to another watchTowr Labs blog post.This time, we're looking at Progress Kemp LoadMaster, a load balancer that sits at the edge of a lot of enterprise networks. Edge appliances have a habit of becoming the way in rather than the thing keeping people out, and
First reported Jun 29, 2026 19:24 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordSuddenly, you’re in a room. You look around - oh, you’re surrounded by other new starters at your new job. Yes, it’s Monday, and you’re being onboarded.You know the drill - it’s the typical enterprise “please don’t be
First reported Aug 14, 2026 07:08 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordIt is yet another day in this parallel universe of security, where the devices we bolt onto the edge of our networks to keep the bad people out are, with remarkable consistency, the exact thing that let the bad people in.While we’ve seemingly had a breather from
First reported Jun 12, 2026 05:17 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordToday, we woke up with a nagging feeling: what if Citrix had, in fact, patched multiple Memory Overread vulnerabilities as part of CVE-2026-3055? While we've been using our analysis from Part 1 (please read it first, as this post will be brief) to accurately identify exploitable
First reported Mar 29, 2026 20:07 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordPart 1 of this week's saga can be found here.This research is a glimpse into the capabilities that power our Preemptive Exposure Management solution, enabling organizations to rapidly react to emerging threats: the watchTowr Platform.What Is A Citrix NetScaler?NetScaler, from Citrix (now under Cloud
First reported Sep 29, 2026 13:55 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordThree posts? In three days? Are we insane?We're home alone, there's no one to stop us, and we're up past bedtime. So, we need to talk about Splunk. On June 10th, Splunk published this CVE-2026-20253 advisory:It has everything that we
First reported Jun 12, 2026 20:35 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordIf you squint and look at the CISA KEV list, you might think it's made up exclusively of vulnerabilities in file transfer solutions.While this would be wrong (and you shouldn’t squint, it’s bad for your eyes), file transfer solutions do play a decent
First reported Apr 02, 2026 10:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordGod damn it, we're back in the room again. Yes, that sound in your ears is screaming. The footgun has gone off again, shockingly, and we are yet again dealing with a situation where the entire world apparently knew about Citrix NetScaler CVEs before Citrix had woken up
First reported Sep 28, 2026 10:55 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordWelcome back to yet another episode of "security was taken seriously".Being who we are (and constantly being exposed to what we see…), we recognize we have been doomed to eternal damnation as we keep on watching security best practices crumble behind “secure by design”
First reported Oct 06, 2026 17:01 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordSequels? Pain? We're obviously talking about Citrix NetScalers, yet again.Welcome back to another watchTowr Labs blog post - pull up a chair, we always welcome new members to our group therapy sessions.If you asked a C programmer what they most dislike doing in life, their answer might
First reported Mar 28, 2026 20:39 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordWe’re back, melting - we’ve tried shouting, screaming, and throwing things at the Sun, and it is just not working.Before we begin our analysis, we want to be clear - given the number of vulnerabilities fixed (and some not mentioned..), we’ve struggled to have confidence
First reported Jul 02, 2026 16:38 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordHello! Yes, it's all a disaster again! Let's get this party started: No comments today, so imagine this:We wrote something that we find very funny,Nobody else gets it,But everyone humors us Just like a typical watchTowr Labs blog introduction.As with all watchTowr
First reported Apr 29, 2026 17:19 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordToday, Ivanti published an advisory.“No way?” we hear you say. "Yes way!"Today’s advisory outlines two vulnerabilities in Ivanti’s Sentry product, appealing directly to our inner desire for sophisticated server-side, pre-authenticated vulnerabilities.CVE-2026-10520An OS Command Injection
First reported Jun 10, 2026 00:52 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordWell, well, well - once again, the cat has dragged us in and spat us out.Today, we find ourselves questioning the reality we sit within. Must it be so predictable, and why us? “But watchTowr, what do you mean?”Well, if you’re here, you likely fit
First reported Jun 30, 2026 19:35 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordWell, well, well, well, well, well, well, well, well, well, well, well, well, well, well. We're back. Sorry.We've been watching the onslaught of vulnerabilities flood the internet. Every man, dog, and their grandmas (apparently?) are now using LLMs to find and reproduce vulnerabilities - it’
First reported Sep 23, 2026 23:19 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordA filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.