// docs / changelog

變更紀錄

FixVibe 掃描引擎更新：新的覆蓋範圍、安全性改進和準確性改進。最新條目優先。

2026-08-04

新增MLflow 作業身份驗證-邊界檢查。 經過驗證的主動掃描現在可以使用有限的唯讀驗證證據來確認 MLflow 作業路由何時繞過設定的基本驗證。此檢查從不列出、讀取、提交、執行、搜尋或取消作業。
新增runc 容器突破配置檢查。 GitHub 儲存庫掃描現在可以標記與 CVE-2024-21626 關聯的容器工作目錄配置，同時區分來源證據和部署的執行時間可利用性。 FixVibe 從不執行映像或容器、存取主機檔案、覆寫二進位檔案或嘗試突破。

2026-08-03

新增PLY 解析器表 pickle 原始碼安全檢查。 GitHub 儲存庫掃描現在可以標記為有爭議的 CVE-2025-56005 明確設定 PLY yacc 建構器透過 pickle 載入解析器表的 Python 原始碼；檢查只會報告原始碼/設定證據，不會開啟 pickle 檔案、執行解析器、執行有效負載或聲稱已達成遠端程式碼執行。
新增新增: LobeHub /webapi/proxy. CVE-2026-54157 · SSRF · OOB.
新增新增: verot/class.upload.php CVE-2019-19576. Composer · Packagist · GHSA-r5gm-4p5w-pq2p.
新增新增: Microsoft Kiota CVE-2026-59865. .NET tool · NuGet · GHSA-hq9q-27g5-qwpj.
新增NocoBase CVE-2026-34156. @nocobase/plugin-workflow-javascript · npm · 2.0.28 · GHSA-px3p-vgh9-m57c.

2026年7月21日

新增Apache ActiveMQ Artemis core-client 依賴性諮詢檢查。 GitHub 儲存庫掃描現在可以在 Maven 和 Gradle 建置文件中標記受影響的 Apache ActiveMQ Artemis core-client 依賴證據。調查結果僅限於與 CVE-2022-23913 / GHSA-pr38-qpxm-g88x 相關的已發布 org.apache.activemq:artemis-core-client 版本，並且永遠不會連接到 Artemis、發送精心設計的協議數據、壓力記憶體、碰撞測試服務或要求即時拒絕服務確認。
新增Next.js WebSocket SSRF 依賴性諮詢檢查。 GitHub 儲存庫掃描現在可以標記與 CVE-2026-44578 / GHSA-c4j6-fc7j-m34r 相關的 Next.js 清單和鎖定檔案證據。調查結果仍然基於版本，聲明 Vercel 託管的部署不受影響，並且從不發送 WebSocket 升級、探測內部目標或要求即時 SSRF 確認。

2026年7月20日

新增Gitea Composer 來源連結權限安全公告檢查。 GitHub 儲存庫掃描現在可以標記受 CVE-2026-27771 / GHSA-8qw8-rq86-9pc2 影響且精確鎖定版本的 Gitea 伺服器映像，並回報以版本為依據的安全公告證據，而無需要求 Composer 中繼資料、檢查受限制的來源連結，也不會聲稱已在實際運作環境中確認權限繞過。
新增Apache Tomcat 叢集加密填充預言攻擊安全公告檢查。 GitHub 儲存庫掃描現在可將受影響的 Apache Tomcat 相依項目與叢集加密設定關聯，並回報 CVE-2026-29146 的版本與設定證據，無需與運作中的叢集互動，也不會宣稱即時環境中存在資料外洩。
新增NGINX HTTP/2 與 gRPC 代理安全公告檢查。 GitHub 儲存庫掃描現在可以辨識受影響的官方 NGINX 映像證據，並將其與 CVE-2026-42055 所涉及、較少見的非預設 upstream 設定加以關聯；無需執行 NGINX、傳送危險流量、對工作處理程序進行當機測試，也不會宣稱已確認漏洞利用。
新增vLLM 視訊處理依賴性諮詢檢查。 GitHub 回購掃描現在可以標記 Python 清單和鎖定文件，這些清單和鎖定文件固定或允許受 CVE-2026-22778 / GHSA-4r2x-xpjr-7cvv 影響的版本，報告基於版本的諮詢證據，而無需運行 vLLM、提交視頻輸入或聲明運行時利用。
新增ChromaDB Python 後端諮詢檢查。 經過驗證的主動掃描現在可以使用唯讀 API 元資料來識別與 CVE-2026-45829 相關的已發布 Python FastAPI 後端版本。此檢查區分不受影響的預設 Rust 前端，並且從不建立 ChromaDB 資源、請求遠端模型、測試授權繞過或執行程式碼。

14 July 2026

新增ADSelfService Plus CVE-2018-5353. FixVibe reports public product/build evidence below build 5517 without spoofing servers, testing RDP/NLA, inspecting GINA/CP clients, or claiming code execution.
新增jscover command-injection advisory. FixVibe repo scans flag npm manifest and lockfile evidence for CVE-2020-7623 / GHSA-c5hm-xc74-pqrg without running jscover or JSCover, sending injection strings, tracing request flow, or claiming compromise.
新增curlrequest dependency advisory. FixVibe repo scans flag npm manifests and lockfiles resolving curlrequest versions tied to CVE-2020-7646 / GHSA-m8xj-5v73-3hh8 with version-based advisory evidence only, without executing curlrequest, invoking curl, tracing request data flow, reading local files, running proof payloads, or claiming live command execution.
新增QCubed profile.php 物件注入相依性公告檢查。 GitHub 儲存庫掃描現在可以標記解析到受 CVE-2020-24914 / GHSA-7w3c-jgh7-cwjw 影響之 qcubed/qcubed 版本的 Composer manifest 與 lockfile，並回報版本式公告證據；不會送出序列化 PHP 物件、探測 profiler 端點、建立 gadget chain、執行 PHP 程式碼，或宣稱已確認即時利用。
新增ForkCMS backend Ajax object-injection advisory. Authorized GitHub repo scans can flag Composer evidence for forkcms/forkcms releases affected by CVE-2020-24036 and keep the result version-based, without logging into ForkCMS, sending serialized PHP objects, probing backend Ajax routes, building gadget chains, deleting files, executing PHP code, or claiming live exploit proof.
新增Handlebars AST code-injection dependency advisory check. GitHub repo scans now include npm manifest and lockfile coverage for handlebars versions affected by CVE-2026-33937 / GHSA-2w6w-674q-4c4q, with version-based advisory evidence only and no crafted AST requests, JavaScript execution, live route inspection, compile() input proof, or live RCE confirmation claim.
新增Rollup path-traversal advisory. FixVibe repo scans flag npm manifests and lockfiles resolving rollup versions tied to CVE-2026-27606 / GHSA-mw96-cpmx-2vgc with version-based advisory evidence only, without running path-traversal proof builds, writing outside the build directory, executing untrusted plugins, inspecting CI runner filesystems, or claiming live RCE confirmation.
新增Rancher command-injection advisory. FixVibe repo scans flag Go module and deployment manifest evidence resolving Rancher Manager versions tied to CVE-2026-44939 / GHSA-mhc6-2gfq-xx62 without fetching cluster import manifests, sending authImage parameters, applying YAML, deploying workloads, or claiming live command execution.
新增Apache Derby LDAP authenticator advisory. FixVibe repo scans flag Maven and Gradle evidence resolving org.apache.derby:derby versions tied to CVE-2022-46337 / GHSA-rcjc-c4pj-xxrp without running Derby, submitting LDAP usernames, bypassing authentication, creating databases, executing procedures, or claiming live RCE.
新增libssh SFTP handle advisory. FixVibe repo scans flag C/C++ dependency, source-header, build, and container metadata resolving libssh versions tied to CVE-2025-5318 / GHSA-98qw-prqm-9f4p without sending malformed SFTP handle traffic, reading process memory, crash-testing SFTP services, or claiming live exploit confirmation.
新增zlib inflateGetHeader advisory. FixVibe repo scans flag C/C++ zlib source, build, and dependency evidence tied to CVE-2022-37434 / GHSA-cfmr-vrgj-vqwv only when the repo also calls inflateGetHeader, reporting likely repo evidence without feeding malformed gzip headers, crash-testing services, or claiming live exploit confirmation.
新增Newtonsoft.Json denial-of-service advisory. FixVibe repo scans flag .NET NuGet project files, central package props files, packages.config files, and lockfiles tied to CVE-2024-21907 / GHSA-5crp-9r3c-p9vr without sending deeply nested JSON, crash-testing services, or claiming live denial-of-service confirmation.
新增gRPC-Go :path authorization advisory. FixVibe repo scans flag Go module evidence resolving google.golang.org/grpc versions tied to CVE-2026-33186 / GHSA-p77j-4mvh-x3m3 / GO-2026-4762 without sending malformed HTTP/2 :path frames, bypassing authorization, enumerating gRPC methods, or claiming live exploit confirmation.
新增Sourcecodester Daily Tracker repo source advisory. GitHub repository scans may now flag CVE-2020-24193-style Daily Tracker login source when authorized repo evidence is present; FixVibe reports file and line context without submitting login forms, sending SQLi payloads, bypassing authentication, following redirects, accessing post-login pages, or reading database data.
新增Acexy Wireless-N repeater credential exposure check. Verified active scans may now flag Acexy-style /password.html pages that render a non-empty administrator password value; FixVibe redacts the credential and does not attempt login or device-setting changes.

2026年7月13日

新增Apache ActiveMQ Artemis OpenWire dependency advisory check. Repo scans now flag Maven and Gradle build files resolving org.apache.activemq:artemis-openwire-protocol versions affected by CVE-2021-26118 / GHSA-q7fr-vqhq-v5xr. Findings stay version-based: FixVibe does not connect to brokers, create advisory messages, probe OpenWire sessions, bypass access policies, read messages, or claim live unauthorized access.
新增get-git-data command-injection advisory. FixVibe repo scans flag npm manifest and lockfile evidence for CVE-2020-7619 / GHSA-wj6h-7chw-x4h2 without running packages, executing Git, sending injection strings, tracing request flow, or claiming compromise.
新增Injective Labs npm wallet-key stealer advisory check. Repo scans now flag package manifests and lockfiles resolving @injectivelabs/sdk-ts 1.20.21 or related @injectivelabs 1.20.21 packages tied to the compromised SDK. Findings stay version-based: FixVibe does not install packages, execute dependency code, derive wallets, contact exfiltration infrastructure, or claim key theft.
新增Nginx-UI command-injection advisory. FixVibe repo scans flag Go module evidence resolving github.com/0xJacky/Nginx-UI versions tied to CVE-2024-22198 / GHSA-8r25-68wm-jw35 without logging in, changing settings, opening terminals, executing commands, or claiming live command execution.
新增op-browser command-injection dependency advisory. GitHub repo scans flag npm evidence for op-browser versions affected by CVE-2020-7625 / GHSA-3hq6-rmv7-39vh, reporting version-based advisory evidence without browser launches, command-injection traffic, request-flow tracing, or host-compromise claims.
新增QCubed profile.php SQL injection dependency advisory. GitHub repo scans flag Composer evidence for qcubed/qcubed versions affected by CVE-2020-24913 / GHSA-8fj6-pc5r-347q, reporting version-based advisory evidence without SQL injection traffic, profiler probing, database reads, or live exploit claims.
新增React Server Components CVE-2026-23864 advisory check. Repo scans now report npm manifest and lockfile evidence for react-server-dom-webpack, react-server-dom-parcel, or react-server-dom-turbopack versions affected by GHSA-83fc-fqcc-2hmg as version-based advisory context; they do not send crafted RSC requests, probe Server Function endpoints, crash-test services, or claim live denial-of-service confirmation.
新增Go net/url 查詢解析儲存庫 advisory 檢查。 GitHub 儲存庫掃描現在可以將受影響的 Go 工具鏈/build 證據與 CVE-2025-61726 的 Go 查詢/表單解析呼叫點關聯起來，回報工具鏈/source advisory 證據，而不會送出大型 query string 或表單本文、測量記憶體、對服務做 crash testing，或宣稱已即時確認阻斷服務。

2026-07-09

新增Dolibarr CVE-2018-25357. FixVibe reports version-based public page evidence safely, without installer access, setup submission, file writes, code execution, or live RCE claims.
新增Axios CVE-2026-25639 advisory check. Repo scans now report npm manifest and lockfile evidence for GHSA-43fc-jf86-j433 as version-based advisory context; they do not run Axios, pass crafted config objects, crash-test services, or claim runtime denial-of-service confirmation.
新增urllib3 CVE-2026-21441 advisory check. Repo scans now report Python dependency evidence for GHSA-38jv-5279-wg99 as version-based advisory context; they do not run Python, follow redirects, create compressed responses, generate decompression bombs, crash-test clients, or claim runtime denial-of-service confirmation.
新增NumPy insecure-load repo advisory. GitHub repository scans now flag affected NumPy dependency evidence when source code explicitly enables pickle loading with allow_pickle=True, and report dependency/source evidence without running Python, loading files, creating pickle payloads, or claiming runtime code execution.
新增karma-mojo CVE-2020-7626 advisory check. Repo scans now report npm manifest and lockfile evidence for GHSA-pf8j-vhg8-xmc3 as version-based advisory context; they do not run Karma, load karma-mojo, execute test suites, pass config arguments, send command-injection strings, or claim host compromise.
新增install-package CVE-2020-7629 advisory check. Repo scans now report npm manifest and lockfile evidence for GHSA-6m4r-m3gc-h4r5 as version-based advisory context; they do not run the package, install dependencies, pass command-injection strings, execute package-manager commands, or claim host compromise.
新增Milvus metrics-port REST API exposure check. Verified active scans can now flag Milvus management REST API exposure on port 9091 with bounded unauthenticated response-shape evidence. The scanner records response keys and counts only, avoids debug expression endpoints, does not create or modify Milvus resources, and does not store returned username values.
新增Emerson Dixell XWEB-500 fingerprint advisory check. Customer-authorized active scans can now flag public XWEB-500 management-surface evidence tied to CVE-2021-45420 with read-only HTTP fingerprinting. The scanner does not upload files, write markers, call file-write CGI actions, or claim remote-code-execution proof.
新增node-key-sender CVE-2020-7627 advisory check. Repo scans now report npm manifest and lockfile evidence for GHSA-4xrw-wvmq-8jmh as version-based advisory context; they do not run the package, simulate keyboard input, pass command-injection strings, execute desktop automation, or claim host compromise.
新增strong-nginx-controller CVE-2020-7621 advisory check. Repo scans now report npm manifest and lockfile evidence for GHSA-4v9w-pvwr-38h3 as version-based advisory context; they do not run the package, start or control NGINX, pass command-injection strings, inspect controller trust boundaries, or claim host compromise.
新增git-add-remote advisory check. GitHub 儲存庫掃描現在可以使用基於版本的證據來標記 CVE-2020-7630 / GHSA-h9v8-rm3m-5h5f 的 npm 清單和鎖定文件，而無需執行程式包或聲稱主機受到損害。

2026-07-04

新增OpenDaylight Karaf CVE-2015-1778 advisory check. Repo scans now report Maven and Gradle dependency evidence for GHSA-qm24-4869-99pj as version-based advisory context; they do not run OpenDaylight, submit arbitrary credentials, create sessions, follow authenticated redirects, or claim live controller access.
新增TYPO3 ceselector CVE-2026-46725 advisory check. Repo scans now report composer.json and composer.lock evidence for mmc/ceselector versions affected by GHSA-8x3j-439w-537c as version-based advisory context; they do not run TYPO3, inspect live plugin settings, send crafted cookies, trigger PHP deserialization, or claim remote-code-execution proof.
新增AngularJS CVE-2024-21490 advisory check. Repo scans now report npm, Bower, and Maven/WebJars evidence for GHSA-4w4v-5hc9-xrr2 as version-based advisory context; they do not run AngularJS, render templates, create crafted srcset inputs, freeze browsers, or claim denial-of-service proof.
新增Google.Protobuf CVE-2015-5237 advisory check. Repo scans now report NuGet project and lockfile evidence for GHSA-jwvw-v7c5-m82h as version-based advisory context; they do not run .NET apps, create oversized messages, crash-test services, or claim memory-corruption proof.
新增Netty CVE-2019-16869 advisory check. Repo scans now report Maven and Gradle dependency evidence for GHSA-p979-4mfw-53vg as version-based advisory context; they do not run Netty, send request-smuggling traffic, inspect proxy topology, or claim runtime exploit confirmation.

2026-07-02

修正Legal-link false positives reduced. Privacy and terms links that are visible after client-side rendering now count correctly, so SPA footers are not reported as missing when users can see those links.

2026年6月30日

新增Label Studio CVE-2025-47783 reflected XSS check. Verified active scans now flag Label Studio upload-example responses when target-specific label_config evidence shows raw HTML metacharacter reflection, without executing JavaScript, using victim sessions, reading tokens, or storing project data.
新增AVideo CVE-2023-25313 / GHSA-pgvh-p3g4-86jw advisory. Repo scans flag affected wwbn/avideo Composer manifests and lockfiles below 12.4 with version-based evidence only; no AVideo login, video-link submission, video creation, request-delay checks, command execution, or runtime exploit claim.
新增GL.iNet GL-MT3000 CVE-2026-11451 advisory. Verified active scans flag GL.iNet GL-MT3000 firmware 4.4.5 as version-based advisory evidence only; no router authentication, FTP-setting changes, file writes, command input, or command-execution claim.
改進Schneider Modicon M221 遠端重啟涵蓋。 既有的被動 Modicon M221 韌體檢查現在會將同一組強公共 HTTP 產品與韌體版本證據，與 CVE-2018-7789 以及 CVE-2018-7790 關聯，並以版本型通告脈絡回報；不會傳送重啟探測、查詢 Modbus、重放驗證、上傳 PLC 程式或宣稱已確認利用。
新增Mbed TLS CVE-2024-45159 repo advisory coverage. GitHub repo scans now flag source and build metadata for affected Mbed TLS 3.2.0 through 3.6.0 releases, reporting version-based advisory evidence without client-certificate probes, TLS handshake testing, or authentication-bypass confirmation.
新增Oracle Java SE/GraalVM CVE-2022-21340 repo advisory coverage. GitHub repo scans now flag explicit Oracle Java SE or Oracle GraalVM Enterprise runtime metadata, reporting version-based advisory evidence without running Java, sandbox-code proof, denial-of-service traffic, or runtime exploit confirmation.
新增OpenSSL CMS CVE-2025-15467 advisory. GitHub repo scans now flag affected OpenSSL CMS release-line evidence and report branch-aware source/config evidence without crash, denial-of-service, or code-execution reproduction.
新增codfish semantic-release GitHub Action compromise check. Repo scans can now flag workflow YAML references to codfish/semantic-release-action refs associated with the June 2026 compromise, reporting source/config evidence only. The check does not run GitHub Actions, read CI secrets, inspect runners, or claim credential theft.
新增Spring Data Commons property-path advisory coverage. GitHub repo scans now report Maven/Gradle dependency evidence for Spring Data Commons versions associated with CVE-2018-1274 / GHSA-5q8m-mqmx-pxp9. The finding stays version-based and does not run the app, probe Spring Data REST endpoints, send crafted property-path parameters, stress CPU or memory, or claim denial-of-service confirmation.
新增vm2 Promise species advisory coverage. GitHub repo scans now report npm manifest and lockfile evidence for vm2 versions associated with CVE-2026-47208 / GHSA-76w7-j9cq-rx2j. The finding stays version-based and does not run the app, execute sandbox-breakout proof-of-concept code, inspect live workers, or claim host command execution.
新增pyLoad /flashgot advisory coverage. GitHub repo scans now report Python manifest and lockfile evidence for pyload-ng versions associated with CVE-2024-47821 / GHSA-w7hq-f2pj-c53g. The finding stays version-based and does not run pyLoad, send /flashgot requests, change settings, download files, write script directories, or claim command execution.
新增SAP Cloud SDK for AI Python advisory check. GitHub repo scans now flag Python manifest and lockfile evidence for sap-ai-sdk-base versions affected by CVE-2023-25617 / GHSA-xxhh-59gh-6ffx as version-based advisory evidence, without running Python, connecting to SAP BusinessObjects, scheduling Program Objects, sending command-injection input, or claiming OS command execution.
新增Gradio Windows/Python path traversal advisory check. GitHub repo scans now flag Gradio dependency evidence for CVE-2026-28414 / GHSA-39mp-8hj3-5c49 and raise confidence when repository configuration also points to Windows with Python 3.13+, without requesting Gradio file endpoints, sending traversal input, reading files, or claiming live arbitrary file read.

29 Jun 2026

新增MISP STIX import source advisory coverage. GitHub repo scans now report source evidence for CVE-2018-19908 in app/Model/Event.php when original STIX filenames flow into shell command construction. The check uses repository source evidence and does not run MISP, import files, or claim runtime command execution.
新增MindsDB status version advisory coverage. Verified active scans now include MindsDB /api/status version evidence for CVE-2026-27483 when the public status endpoint reports a release before 25.9.1.1. This read-only check does not upload files, send traversal filenames, or claim remote-code execution.
新增NiceGUI upload filename source advisory check. GitHub repo scans now include CVE-2026-25732 coverage when affected NiceGUI dependency evidence appears with upload-handler source that saves paths built from client-supplied filenames. The check reports source/dependency evidence without uploading files, writing outside upload directories, or claiming code execution.

June 18, 2026

新增SillyTavern SearXNG SSRF active check. Verified active scans now report only direct evidence that a SillyTavern SearXNG search proxy fetched a FixVibe-controlled external callback URL. The probe avoids localhost, cloud metadata, private-network targets, and internal-service requests.
新增Glances REST API 未驗證暴露檢查。 經驗證的主動掃描現在可以確認被掃描的 origin 是否在未驗證情況下暴露 Glances REST API 身分資訊與指標形態回應。FixVibe 只記錄回應形態，並避免收集大範圍 API dump、程序清單、命令列、設定或 secret。
新增Spring Data Commons + XMLBeam advisory coverage. GitHub repo scans now report paired Maven/Gradle dependency evidence for Spring Data Commons and XMLBeam versions associated with CVE-2018-1259 / GHSA-m929-7fr6-cvjg. The finding stays version-based and does not run the app, send XML payloads, probe endpoints, read local files, or claim SSRF confirmation.
新增Moby AuthZ 相依性公告檢查。 GitHub 儲存庫掃描現在可以標記解析到受 CVE-2026-34040 / GHSA-x744-4wpc-v9h2 影響的 Moby 或 Docker Engine 版本的 Go 模組清單，並以版本型公告證據呈現，不連線 Docker APIs、不探測 AuthZ 外掛、不送出特製請求，也不聲稱已確認授權繞過。
新增NGINX rewrite-module config advisory check. GitHub repo scans can now correlate affected NGINX version evidence with rewrite-module configuration evidence for CVE-2026-42945, without running NGINX, sending traffic, or claiming memory-corruption proof.
新增SQLitePCLRaw NuGet advisory check. GitHub repo scans can now flag .NET project and NuGet lockfile evidence for affected SQLitePCLRaw native SQLite packages tied to CVE-2025-6965 / GHSA-2m69-gcr7-jv3q, without claiming memory-corruption proof.
新增gemini-mcp-tool CVE-2026-0755 advisory. Repo scans flag affected npm manifest and lockfile versions for GHSA-4h5r-5jm8-jxjm with repository version evidence only. The check does not run the MCP server, send command or @file probes, trigger callbacks, read local files, or assert runtime exploit confirmation.
新增Mastra easy-day-js advisory check. GitHub repo scans flag easy-day-js manifest and lockfile evidence tied to the June 2026 Mastra npm incident. The finding stays limited to repository dependency evidence and does not verify stale npm owners, run package scripts, inspect hosts, or assert credential theft.
新增Drupal Core CVE-2026-9082 advisory check. GitHub repo scans flag Composer manifest and lockfile versions for GHSA-ghwc-95x2-682j with repository version evidence only. The check does not run Drupal, verify PostgreSQL, send SQL payloads, extract data, or assert runtime exploit confirmation.
新增Paramiko SSH-server authentication advisory check. GitHub repo scans can now flag Python dependency files that resolve Paramiko releases affected by CVE-2018-7750 / GHSA-232r-66cg-79px, reporting version-based advisory evidence without starting an SSH server, sending bypass traffic, or claiming deployed server-mode exposure.
新增Apache Tomcat HTTP/2 resource-consumption dependency advisory check. GitHub repo scans can now flag Maven and Gradle build files that resolve Tomcat releases affected by CVE-2020-11996 / GHSA-53hp-jpwq-2jgq, reporting version-based advisory evidence without running Tomcat, sending HTTP/2 denial-of-service traffic, generating high-CPU proof traffic, or claiming runtime availability impact.
新增@andrei-tatar/nora-firebase-common prototype-pollution advisory check. GitHub repo scans can now flag npm manifests and lockfiles that resolve @andrei-tatar/nora-firebase-common versions affected by CVE-2024-30564 / GHSA-jjff-q3q4-5hh8, reporting version-based advisory evidence without running the package, mutating Object.prototype, sending proof payloads, or claiming runtime exploit confirmation.
新增cordova-plugin-inappbrowser Android 公告檢查。 GitHub repo 掃描現在可以標記 npm manifests、lockfiles 與 Cordova config.xml 中解析到受 CVE-2019-0219 / GHSA-c6pw-q7f2-97hv 影響的 cordova-plugin-inappbrowser 版本，並以版本型公告證據回報，而不建置行動二進位檔、不載入證明內容、不演練 plugin bridge 行為，也不聲稱已確認部署中的 Android 可被利用。
新增Nokogiri libxslt RubyGems advisory coverage. GitHub repo scans now report Gemfile, Gemfile.lock, and gemspec evidence for Nokogiri releases affected by CVE-2019-18197 / GHSA-242x-7cm6-4w8j. The check uses version-based RubyGems evidence and does not run Ruby, process XML or XSLT input, crash-test libxslt, or claim runtime exploit confirmation.
新增Perl GD CPAN advisory coverage. GitHub repo scans now report CPAN dependency evidence for Perl GD releases affected by CVE-2026-11526. The check uses version-based repository evidence and does not run Perl, process image files, pass crafted filenames to GD::Image constructors, or claim command-execution or file-overwrite confirmation.
新增kill-port-process CVE-2019-15609 advisory check. GitHub repo scans flag affected npm manifest and lockfile versions for GHSA-xp4x-j9vh-c3wf, reporting version evidence only. The check does not run the package, send command payloads, terminate processes, or assert runtime exploit confirmation.
新增proxy npm advisory coverage. GitHub repo scans can now report repository dependency evidence for proxy releases associated with CVE-2023-2968 / GHSA-mj6p-3pc9-wf5m. The finding stays version-based and does not run proxy, send crafted request traffic, crash-test services, or claim runtime denial-of-service confirmation.
新增Apache ActiveMQ Artemis Jolokia dependency advisory check. GitHub repo scans can now flag Maven and Gradle build files that resolve org.apache.activemq:artemis-cli versions affected by CVE-2023-50780 / GHSA-443j-grxv-2pgv, reporting version-based advisory evidence without authenticating to Jolokia, enumerating MBeans, changing Log4J2 configuration, writing files, restarting services, or claiming live RCE confirmation.
新增Apache ActiveMQ Artemis dependency advisory check. GitHub repo scans can now flag Maven and Gradle build files that pin or allow artemis-server versions affected by CVE-2026-27446 / GHSA-fw88-pf9m-p947, reporting version-based advisory evidence without connecting to brokers, triggering federation callbacks, or claiming message injection/exfiltration confirmation.
新增Apache Spark UI dependency advisory check. GitHub repo scans can now flag Maven, Gradle, and PySpark dependency files that pin or allow Apache Spark versions affected by CVE-2022-33891 / GHSA-4x9r-j582-cgr8, reporting version-based advisory evidence without visiting Spark UI, sending active exploit probes, or claiming command-execution confirmation.
新增vLLM pickle-deserialization dependency advisory check. GitHub repo scans can now flag Python dependency files that pin or allow vllm versions affected by CVE-2024-9053 / GHSA-cj47-qj6g-x7r4, reporting version-based advisory evidence without running vLLM, exposing AsyncEngineRPCServer, sending pickle payloads, or claiming runtime code-execution confirmation.
新增Apache Airflow example-DAG advisory coverage. GitHub repo scans can now report repository dependency evidence for Airflow releases associated with CVE-2024-45498 / GHSA-c392-whpc-vfpr. The finding stays version-based and does not probe Airflow UI, trigger DAGs, run command payloads, or claim runtime exploit confirmation.
新增ONNX download_model_with_test_data advisory coverage. GitHub repo scans now report Python dependency evidence for onnx releases affected by CVE-2024-5187 / GHSA-6rq9-53c3-f7vj and add source-call context when download_model_with_test_data appears. The check does not run Python, download or extract model archives, create malicious tar files, overwrite files, or claim runtime exploit confirmation.
新增YOURLS type-juggling dependency advisory check. GitHub repo scans can now flag Composer and YOURLS source-version evidence for yourls/yourls releases affected by CVE-2019-14537 / GHSA-vf23-f26f-mjj9, reporting version-based advisory evidence without calling the YOURLS API, sending authentication-bypass requests, probing admin pages, or claiming unauthorized access.
新增http4k-format-xml dependency advisory check. GitHub repo scans can now flag Maven and Gradle build files that resolve org.http4k:http4k-format-xml versions affected by CVE-2024-55875 / GHSA-7mj5-hjjj-8rgw, reporting version-based advisory evidence without sending XML payloads, SSRF callbacks, local-file reads, or denial-of-service traffic.

June 14, 2026

修正DOM XSS fragment probe stability fix. Verified active scans now skip the DOM fragment probe cleanly when browser automation is unavailable at startup, so reports no longer show internal browser-context errors for that check.
改進Expanded Red Hat npm worm coverage. GitHub repo scans now include additional Wiz-reported @redhat-cloud-services package versions for the Miasma campaign, while still reporting repository dependency evidence without installing packages, executing lifecycle scripts, or claiming credential theft.
新增Known npm typosquat package check. GitHub repo scans can now flag package manifests and lockfiles that resolve Microsoft-reported vpmdhaj npm typosquat package versions, reporting version-based advisory evidence without installing packages, executing lifecycle scripts, fetching tarballs, contacting attacker infrastructure, or claiming credential theft.
新增Codex Remote UI token-stealing npm package check. GitHub repo scans can now flag package manifests and lockfiles that resolve codexui-android 0.1.82 or newer, reporting version-based advisory evidence without installing the package, executing it, reading Codex auth files, contacting exfiltration infrastructure, or claiming token theft.
新增Claude Code GitHub Action workflow repo check. GitHub repo scans can now flag Claude Code Action workflows with mutable action refs, broad workflow token permissions, or risky access override inputs, reporting workflow YAML evidence without running Actions, executing Claude Code, reading CI secrets, or claiming prompt-injection exploitation.
新增onering Rust crate malware repo check. GitHub repo scans can now flag Cargo manifests or lockfiles that resolve onering 1.4.1 or the known compromised onering git commit, and can flag matching checked-in build.rs evidence, without running Cargo, executing build scripts, fetching crates, or claiming source exfiltration.
新增Node-gyp / Phantom Gyp npm worm repo check. GitHub repo scans can now flag package manifests or lockfiles that resolve known malicious npm package versions from the binding.gyp supply-chain campaign, or flag matching binding.gyp source evidence, without running npm install, executing node-gyp, downloading tarballs, or claiming credential theft.

June 11, 2026

改進Moxa NPort authentication advisory coverage. The existing verified-active Moxa NPort firmware check now correlates the same strong HTTP model and firmware evidence with CVE-2016-9361 as part of the MCSA-160401 advisory family, while still reporting a version-based advisory without attempting password retries, brute-force checks, firmware uploads, unauthenticated administrative actions, SNMP queries, serial-device protocol probes, crash tests, or exploit confirmation.
改進Moxa NPort unauthenticated firmware-update advisory coverage. The existing verified-active Moxa NPort firmware check now correlates the same strong HTTP model and firmware evidence with CVE-2016-9369 as part of the MCSA-160401 advisory family, while still reporting a version-based advisory without attempting firmware uploads, unauthenticated administrative actions, SNMP queries, serial-device protocol probes, crash tests, or exploit confirmation.
新增Schneider Modicon M221 firmware advisory check. Passive scans can now flag strong public HTTP product and firmware-version evidence for Modicon M221 controllers associated with CVE-2018-7790, reporting version-based advisory context without capturing credentials, replaying authentication, querying Modbus, uploading PLC programs, or claiming unauthorized-access confirmation.
新增Langflow CVE-2025-34291 CORS advisory check. Verified active scans can now flag affected Langflow instances when target-specific version evidence is paired with credentialed CORS origin reflection, without authenticating, reading tokens, triggering refresh flows, or claiming code-execution confirmation.
新增SiteOmat BOS version advisory check. Verified active scans can now flag public SiteOmat BOS version evidence associated with CVE-2017-14728 as a version-based advisory, without attempting default credentials, SSH login, broad port scans, state-changing management actions, or unauthorized access.
新增SiteOmat login SQL injection advisory check. Verified active scans can now flag public SiteOmat BOS version evidence associated with CVE-2017-14851 as a version-based advisory, without submitting login forms, sending SQL injection payloads, attempting authentication bypass, accessing post-login pages, or making state-changing management requests.
新增SiteOmat CGI buffer-overflow advisory check. Verified active scans can now flag public SiteOmat BOS version evidence associated with CVE-2017-14854 as a version-based advisory, without sending crafted CGI input, overflow payloads, crash tests, broad port scans, state-changing management actions, or exploit requests.
新增Kubernetes externalIPs manifest advisory check. GitHub repo scans can now flag Kubernetes Service manifests that declare non-empty spec.externalIPs as source/config hardening evidence for CVE-2020-8554, without inspecting live clusters, checking RBAC, sending traffic, or claiming traffic interception.
新增Apache Tomcat EncryptInterceptor dependency advisory check. GitHub repo scans can now flag Maven and Gradle files that resolve exact Tomcat releases associated with CVE-2026-34486 / GHSA-69r9-qgr7-g2wj, reporting version-based advisory evidence without running Tomcat, inspecting cluster traffic, sending crafted Tribes packets, or claiming plaintext-disclosure confirmation.
新增Apache Tomcat h2c request mix-up dependency advisory check. GitHub repo scans can now flag Maven and Gradle files that resolve Tomcat embedded-core or Coyote versions affected by CVE-2021-25122 / GHSA-j39c-c8hj-x4j3, reporting version-based advisory evidence without running Tomcat, sending h2c upgrade requests, capturing traffic, or claiming information-disclosure confirmation.
新增PickleScan ZIP CRC dependency advisory check. GitHub repo scans can now flag Python dependency files that pin or allow PickleScan versions affected by CVE-2025-10156 / GHSA-mjqp-26hc-grxg, reporting version-based advisory evidence without running PickleScan, creating corrupted archives, loading models, or claiming runtime code-execution confirmation.
新增NLTK Zip Slip dependency advisory check. GitHub repo scans can now flag Python dependency files that pin or allow NLTK versions affected by CVE-2025-14009 / GHSA-7p94-766c-hgjp, reporting version-based advisory evidence without running Python or NLTK, calling nltk.download(), extracting packages, creating malicious archives, or claiming runtime code-execution confirmation.
新增TanStack ArkType adapter malware dependency check. GitHub repo scans can now flag package manifests and lockfiles that resolve @tanstack/arktype-adapter to malicious versions 1.166.12 or 1.166.15 from CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx, reporting version-based advisory evidence without running npm install, executing lifecycle scripts, downloading tarballs, or claiming credential theft.
新增Mbed TLS CVE-2021-44732 repo advisory check. GitHub repo scans can now flag source and build metadata that identify Mbed TLS versions affected by CVE-2021-44732, reporting version-based advisory evidence without running Mbed TLS, forcing out-of-memory behavior, calling session-copy APIs, or claiming live double-free confirmation.
新增IIS TRACK method exposure check. Verified active scans can now flag legacy TRACK echo behavior associated with CVE-2003-1567 using non-sensitive request evidence, without sending cookies, credentials, browser exploit pages, user traffic, or state-changing requests.
新增Red Hat npm worm dependency advisory check. GitHub repo scans can now flag package manifests and lockfiles that resolve known compromised @redhat-cloud-services npm versions associated with the credential-stealing worm campaign, reporting dependency evidence without executing install scripts or claiming credential theft.
新增DICOM executable preamble check. GitHub repo scans can now flag committed DICOM files whose Part 10 preamble carries executable-file evidence, reporting static file evidence without executing the file or claiming production compromise.

June 10, 2026

新增Mbed TLS CVE-2023-45199 repo advisory check. GitHub repo scans can now flag source and build metadata that identify Mbed TLS 3.2.x through 3.4.x, reporting version-based advisory evidence without sending TLS handshake payloads or claiming live memory corruption.
新增Rockwell MicroLogix 1100 advisory fingerprint. Passive scans can now flag strong public HTTP evidence of a Rockwell Automation MicroLogix 1100 controller associated with CVE-2021-33012, reporting advisory context without sending industrial protocol commands or claiming denial-of-service behavior.
新增Moxa NPort firmware advisory check. Verified active scans can now flag public HTTP model and firmware-version evidence for Moxa NPort devices associated with CVE-2016-9363, reporting version-based advisory context without sending crafted packets, querying SNMP, testing serial-device services, or claiming exploit confirmation.
新增Rockwell MicroLogix 1100 authentication-attempt advisory check. Verified active scans can now flag public HTTP model and firmware evidence for MicroLogix 1100 controllers associated with CVE-2017-7898, reporting version-based advisory context without attempting logins, brute force, or industrial protocol probes.
新增Log4j 1.2 JDBCAppender advisory check. GitHub repo scans can now flag Log4j 1.2 dependency evidence paired with JDBCAppender SQL configuration for CVE-2022-23305 / GHSA-65fg-84f6-3jq3, reporting repository/config evidence without executing SQL, writing log events, or claiming runtime database compromise.
新增Log4j 1.2 JMSAppender advisory check. GitHub repo scans can now flag Log4j 1.2 dependency evidence paired with JMSAppender configuration for CVE-2021-4104 / GHSA-fp5r-v3w9-4333, reporting repository/config evidence without contacting JNDI or JMS services or claiming runtime exploit confirmation.
新增Microsoft ATL MS09-035 source advisory check. GitHub repo scans can now flag legacy Visual C++ ATL project metadata paired with ATL source usage associated with CVE-2009-0901/CVE-2009-2493/CVE-2009-2495, reporting source/build advisory evidence without inspecting build machines, sending malformed streams, probing information disclosure, or claiming live code-execution confirmation.
新增Langflow CVE-2026-33017 version advisory check. Verified active scans can now flag public Langflow version evidence for CVE-2026-33017 / GHSA-vwmf-pq79-vjvx as a version-based advisory, without submitting flow data, building flows, executing code, or claiming public-flow exploit confirmation.
新增Keras CVE-2025-1550 dependency advisory check. GitHub repo scans can now flag Python dependency files that pin or allow Keras versions affected by CVE-2025-1550 / GHSA-48g7-3x6r-xfhp, reporting version-based advisory evidence without loading model archives, generating payloads, or claiming runtime code-execution confirmation.
新增TLS RC4 negotiation advisory check. Verified active scans can now flag TLS endpoints that still select RC4 cipher suites associated with CVE-2015-2808, reporting confirmed RC4 support without capturing traffic or claiming plaintext recovery.
新增TLS Sweet32 DES/3DES advisory check. Verified active scans can now flag TLS endpoints that still select DES or 3DES 64-bit block cipher suites associated with CVE-2016-2183, reporting confirmed cipher negotiation without capturing traffic or claiming plaintext recovery.
新增Schneider PowerLogic EGX advisory check. Verified active scans can now flag public PowerLogic EGX100 firmware or EGX300 product evidence associated with CVE-2021-22765/CVE-2021-22767/CVE-2021-22768, reporting product/firmware advisory context without sending crafted HTTP packets, querying industrial protocols, crash-testing gateways, or claiming exploit confirmation.

May 27, 2026

新增Arcserve UDP CVE-2025-34523 version advisory check. Verified active scans can now flag public Arcserve UDP version evidence for CVE-2025-34523 as a version-based advisory, without sending crafted heap-overflow input, crash-testing the service, authenticating to the console, or claiming command execution.
新增Liferay Portal CVE-2010-5327 version advisory check. Verified active scans can now flag public Liferay Portal version evidence for CVE-2010-5327 as a version-based advisory, without authenticating, editing templates, sending template payloads, or claiming command execution.
新增ws excessive-header DoS dependency advisory check. GitHub repo scans can now flag npm manifests and lockfiles that resolve ws versions affected by CVE-2024-37890 / GHSA-3h5v-q93c-6h6q, reporting version-based advisory evidence without sending denial-of-service traffic or claiming runtime WebSocket exposure.

May 25, 2026

改進SPIP version advisory wording. Passive SPIP version findings now distinguish version-fingerprint advisory evidence for CVE-2016-7980 and CVE-2016-7998 from runtime exploit proof, without active CSRF, local-file validation, or template-execution reproduction.
修正Active scan reliability and SSTI accuracy fix. Active scans now safely store response-derived evidence that contains unsupported control characters, and SSTI reporting requires stronger target-specific template-evaluation evidence instead of common page or static-asset content.

May 24, 2026

新增WebdriverIO BrowserStack service dependency advisory check. GitHub repo scans can now flag npm manifests and lockfiles that resolve @wdio/browserstack-service versions affected by CVE-2026-25244 / GHSA-5c46-x3qw-q7j7, reporting version-based advisory evidence without running WebdriverIO, starting BrowserStack Local, or using command payloads.
新增WordPress REST API user-exposure check. Verified active scans can now report WordPress REST users endpoints that return public user slugs to unauthenticated clients, with medium-severity exposure wording that does not claim WordPress version proof or account compromise.
新增Django CSRF dependency advisory check. GitHub repo scans can now flag Python dependency files that pin or allow Django versions affected by CVE-2011-0696 / GHSA-5j2h-h5hg-3wf8, reporting version-based advisory evidence without running Django, probing state-changing routes, or claiming runtime CSRF exploitability.
新增TMT Lockcell SQL injection active check. Verified active scans can now report TMT Lockcell login surfaces whose responses change consistently with CVE-2023-3047, using a bounded login-response comparison that does not run timing delays, follow authenticated redirects, or extract database data.
新增OpenSSL PowerPC Poly1305 advisory check. GitHub repo scans can now correlate affected OpenSSL 3.x version evidence with PowerPC build/deployment evidence for CVE-2023-6129, reporting version-and-architecture advisory evidence without reproducing state corruption or denial-of-service behavior.

May 23, 2026

新增electerm 未驗證命令執行公告檢查。 GitHub 儲存庫掃描現在可以標記鎖定或允許受 CVE-2020-23256 / GHSA-x73w-g8hx-v7rp 影響的 electerm 版本的 npm 資訊清單和鎖定檔,以基於版本的公告形式回報結果,而不會探測或啟動 electerm 服務。
新增SaltStack Salt 相依性公告檢查。 GitHub 儲存庫掃描現在可以標記受 CVE-2017-12791 / GHSA-xxvj-8g5m-4qgw 影響的 Salt 版本的 Python 相依性證據,以基於版本的公告形式回報,而不會探測 Salt master 交握。
新增rclone RC fsinfo 暴露檢查。 經過驗證的主動掃描現在可以確認與 CVE-2026-41179 / GHSA-jfwf-28xr-xw6q 相關的 rclone Remote Control 未驗證 fsinfo 暴露,使用有界中繼資料證據,不執行任何命令。
新增Apache Tomcat 工作階段持續化公告檢查。 GitHub 儲存庫掃描現在可以標記解析為受 CVE-2020-9484 / GHSA-344f-f5vg-2jfj 影響的 Tomcat 版本的 Maven 和 Gradle 建置檔,並在儲存庫設定同時顯示基於 FileStore 的 PersistentManager 工作階段持續化時強化該發現。
新增Note Mark dependency advisory check. GitHub repo scans can now flag Go manifests that resolve Note Mark backend versions affected by CVE-2026-44522 / GHSA-g49p-4qxj-88v3, reporting the result as a version-based advisory without uploading files, triggering exports, or claiming live RCE confirmation.

2026 年 5 月 20 日

新增Gogs dependency advisory check. GitHub repo 掃描現在可以標記 Go 清單，以基於版本的諮詢證據而不是路徑遍歷確認來固定受影響的 Gogs 版本 CVE-2018-20303 / GHSA-9hxg-w7qf-hh93。
新增deephas prototype-pollution advisory check. GitHub repo 掃描現在可以標記 npm 清單和鎖定文件，以解析受 CVE-2020-28271 / GHSA-4fr2-j4g9-mppf 影響的 deephas 版本，並使用基於版本的諮詢證據而不是運行時原型污染確認。
新增OpenSSL TLSv1.3 session advisory check. GitHub 儲存庫掃描現在可以將受影響的 OpenSSL 版本證據與 CVE-2024-2511 的 TLSv1.3 會話配置證據關聯起來，報告中等可信度來源/config 證據，而不是即時拒絕服務確認。

2026 年 5 月 19 日

改進electerm Linux install-script coverage. electterm 依賴建議現在包括 CVE-2026-41501 / GHSA-8x35-hph8-37hq 以及現有的 macOS 安裝腳本建議，將發現範圍限制在 npm 清單和鎖定文件證據，而不是利用確認。
新增GeniXCMS author-route SQL injection check. 經過驗證的主動掃描現在可以使用特定於目標的證據來確認 GeniXCMS 作者路線上的 CVE-2017-5517- 式資料庫錯誤行為，而無需資料提取或破壞性的 SQL 探針。
新增當唯讀 DNS API 拒絕基線請求但透過舊版 DNS 授權路徑返回 DNS 記錄證據時，Netmaker DNS key authorization-bypass check. 已驗證的主動掃描現在可以確認 Netmaker 部署上的 CVE-2023-32077 暴露，而無需建立、修改或刪除記錄。
新增openDCIM source command-injection check. GitHub 儲存庫掃描現在可以使用來源比對證據、置信度和運行時可利用性限制來標記 report_network_map.php 中的 CVE-2026-28517 來源/config 模式，而不是主動命令執行。
新增SPIP valider_xml XSS check. 經過驗證的主動掃描現在可以使用特定於目標的 HTML- 上下文證據來確認 CVE-2016-7981- 風格的未轉義 URL 對 SPIP 部署的反射，而無需在瀏覽器中執行 JavaScript。
新增Apache Tomcat Coyote dependency advisory check. GitHub repo 掃描現在可以標記 Maven 和 Gradle 建置文件，這些文件可解析受 CVE-2025-48989 / GHSA-gqp3-2cvr-x8m3 影響的 Tomcat Coyote 或嵌入式核心版本，並使用基於版本的諮詢證據而不是運行時拒絕服務確認。
新增veraPDF XSLT dependency advisory check. GitHub repo 掃描現在可以標記 Maven 和 Gradle 建置文件，以解決受 CVE-2024-28109 / GHSA-qxqf-2mfx-x8jw 影響的 veraPDF 工件，並使用基於版本的諮詢證據而不是 XSLT 執行確認。

2026 年 5 月 18 日

新增electerm dependency advisory check. GitHub repo 掃描可以標記 npm 清單和鎖定文件，這些清單和鎖定文件固定或允許受 CVE-2026-41500 / GHSA-wxw2-rwmh-vr8f 和 CVE-2026-41501 / GHSA-8x35-hph8-37hq 影響的證據而不是基於驗證版本的諮詢。
新增OpenCms dependency advisory check. GitHub repo 掃描現在可以標記 Maven pom.xml 文件，這些文件固定或解析受 CVE-2023-42344 / GHSA-rcc6-6q2f-m2cw 影響的 org.opencms:opencms-core 版本，並使用基於版本的諮詢證據而不是 XXE 漏洞確認。
新增當未經身份驗證的/cors端點獲取FixVibe控制的外部回調時，MagicMirror /cors SSRF check.驗證的主動掃描現在可以確認MagicMirror實例上的CVE-2026-42281暴露，而無需探測內部服務。

2026 年 5 月 17 日

新增FUXA hardcoded JWT secret check. 經過驗證的主動掃描現在可以確認FUXA 實例上的CVE-2025-69971 暴露情況，這些實例仍然信任易受攻擊的後備JWT 簽名配置。
新增CKAN DataStore SQL exposure check. 經過驗證的主動掃描現在可以確認與CVE-2026-42031 關聯的未經身份驗證的CKAN DataStore SQL 訪問，並指導團隊修補CKAN 版本線或更安全的DataStore 配置。

16 May 2026

新增PDF.js dependency advisory check. GitHub repo 掃描現在可以標記 npm 清單和鎖定文件，這些清單和鎖定文件固定或允許受 CVE-2024-4367 / GHSA-wgrm-67xf-hhpq 影響的 pdfjs-dist 版本。
新增Active scans via REST API and MCP. 現在可以從REST 和MCP 針對已從儀表板明確授權的已驗證網域觸發主動掃描。授權可隨時撤銷。
新增Safer authorization levels for active scans. 網域授權現在可以區分更安全的自動主動檢查和更深入的主動測試，因此團隊可以為每個網域自動執行正確等級的驗證。
新增First-use webhook for API/MCP active scans. 首次針對新授權的網域執行 API/MCP-triggered 主動掃描時，Webhook 可以通知團隊。
改進Improved Referrer-Policy findings. Missing or weak Referrer-Policy results now separate URL-referrer leakage from broad information exposure, show document-response evidence, and include generic plus static-host remediation guidance.
改進Improved Permissions-Policy findings. Missing or weak Permissions-Policy results now show feature-level evidence, separate broad feature allowlists from missing hardening, and include generic plus static-host remediation guidance for common hosts, proxies, and app servers.
改進Improved clickjacking header prompts. Missing X-Frame-Options findings now point agents to CSP frame-ancestors as the modern protection, add Vercel/static SPA header guidance, and verify x-frame-options with CSP.
改進CSP header evidence and fix prompts improved. Missing-CSP 報告現在包括更清晰的託管和回應上下文以及更安全的框架感知修復指南。
修正Vercel path-probe false positives reduced. FixVibe 現在需要更強大的特定應用程式的證據，然後才能報告部署中重寫未知路由到應用程式 shell 的公開框架工件。
修正合規類發現不再帶有誤導性的 CWE 標籤。先前 legal-compliance 檢查會把「缺少隱私政策」與「缺少服務條款」標示為 CWE-359（PII 暴露），但這並不能描述實際的落差。這些發現現在不再附帶 CWE — 它們是合規事項，而非可分類的安全弱點。

2026 年 5 月 15 日

新增Additional research-informed checks. FixVibe 根據最近的漏洞研究提供了更多覆蓋範圍，並將重複主題映射到覆蓋範圍已存在的現有掃描器模組。
新增儲存庫密鑰外洩檢查。 GitHub 儲存庫掃描現在可以標示硬編碼的供應商密鑰以及提交到原始碼中的高熵疑似密鑰值，並遮蔽相關證據，附上標準的 FixVibe 輪替提示。
新增Vercel deployment protection check. 被動掃描現在可以標記公開 *.vercel.app 產生的部署 URL，這些 URL 無需 Vercel 部署 Pro 保護即可回應，而現有標頭檢查將繼續審核 CSP、HSTS 和瀏覽器強化。

2026 年 5 月 14 日

新增LiteLLM dependency advisory check. GitHub 儲存庫掃描現在可以標記那些固定或允許受 CVE-2026-42208 / GHSA-r75f-5x8p-qvmc 影響的 LiteLLM 版本的 Python 依賴檔案。
新增LibreNMS dependency advisory check. GitHub 儲存庫掃描現在可以標記固定或允許受 CVE-2024-51092 / GHSA-x645-6pf9-xwxw 影響的 LibreNMS 版本的 Composer 清單。
改進Firebase rules detection improved. BaaS 掃描現在可以檢測更多Firebase 應用程式形狀，並使用唯讀證據來識別有風險的公共資料暴露。

2026 年 5 月 13 日

新增Repo Supabase RLS migration check. GitHub 儲存庫掃描現在可以標記 Supabase SQL 遷移，這些遷移會建立公用表而沒有符合的 ALTER TABLE ... ENABLE ROW LEVEL SECURITY 語句。
新增Supabase Storage posture check. 被動掃描現在可以審查公共Supabase 儲存桶和匿名物件清單暴露以及現有的RLS 和金鑰檢查。
新增AI-generated code guardrail check. GitHub 儲存庫掃描現在可以標記圍繞程式碼掃描、秘密掃描、依賴項更新和 AI-agent 指令缺少的安全自動化。

2026 年 5 月 12 日

新增Repo web-app risk checklist. GitHub 回購掃描現在可以標記高可信度OWASP-風格的代碼風險，例如原始SQL插值、不安全HTML接收器、憑證通配符CORS、禁用TLS驗證和弱JWT秘密後備。
新增Next.js middleware-bypass check. 對已驗證網域的主動掃描現在可以在報告之前確認受中間件保護的路由上的 CVE-2025-29927 暴露情況，並且報告包括用於修復的標準 FixVibe AI 修復提示。

2026 年 5 月 9 日

安全Cross-origin scope hardening. 主動掃描和用戶端資產檢查現在保留在授權的目標範圍內，並避免跨跨來源重定向攜帶客戶提供的憑證。
修正Supabase RLS check is now strictly read-only. Supabase 姿勢檢查現在避免寫入嘗試並專注於安全暴露訊號。驗證域主動測試仍然是更深入確認的邊界。
改進Security-header findings 只套用於 root HTML responses。 204、JSON API、file download 或 404 上缺少 CSP、Permissions-Policy、X-Frame-Options 或 Referrer-Policy，不再產生 finding。HSTS 與 X-Content-Type-Options 仍會跨所有 responses 評分。
改進Auth-flow and rate-limit checks now require stronger evidence. FixVibe 現在僅當應用程式行為明確支持該發現時才報告這些問題，從而減少來自通用錯誤頁面和不受支援的方法的噪音。
改進File-upload findings tier by exploitability evidence. 文件上傳報告現在將低置信度接受訊號與有風險服務行為的更有力證據分開，從而減少對良性上傳處理程序的過度嚴重性。

2026 年 5 月 7 日

修正Threat-intel listing accuracy improved. FixVibe 現在可以區分真正的阻止清單證據和解析器診斷，因此威脅情報調查結果不會過度報告基礎設施端查找回應。
新增GitHub repo scans。 連接 repo 後，FixVibe 會檢查原始碼中是否有 leaked Supabase service keys、Firebase admin tokens、risky workflow files 與 outdated dependencies，而且完全不需要載入你部署的網站。請見掃描類型。
新增針對高風險 JavaScript 的 SAST checks。 Repo scans 現在會標記 new Function() 與 setTimeout("string")；在餵入不受信任輸入時，兩者都等同於 eval()。
修正Vercel / Cloudflare sites 上的 false「exposed file」findings。 裸 403 Forbidden responses 不再被報告為「file exists」；大多數 edge providers 對看起來可疑的 paths 都會回傳 403，不論檔案是否存在。現在必須有正向 HTTP signal 才會標記。
修正Repo-code false positives reduced. Repo 掃描現在可以避免在註釋、文件、測試幫助程序和明顯僅伺服器上下文中標記安全術語，以進行多個高信號代碼檢查。
修正localStorage 中的 Supabase anon key 不再被報告為 JWT-in-storage finding；anon key 是公開預期的 client token。瀏覽器 storage 中真正的 service-role tokens 現在會是 critical，且標題更清楚。
修正CSP weakness detection improved. Content-Security-Policy 檢查現在可以捕捉更寬鬆的來源策略，同時將證據和補救措施集中在有效的瀏覽器策略上。
修正Reflected-XSS check tightened. 主動掃描現在需要更強的反射證據才能報告可執行上下文風險，從而減少頁面上不相關標記的誤報。
修正Domain verification 會正確處理 apex ↔ www redirects，並更清楚說明 TXT-record Host 欄位應填入哪個值。

格式

每個項目都有標籤，方便你快速瀏覽：

新增新的 check、surface 或 feature。
改進既有行為變得更好：更準確、更快、更清楚。
修正我們已發布、後來修掉的 bug。
安全強化、漏洞修正或合規變更。

發現有東西壞了但這裡沒記錄？請 email support@fixvibe.app。