Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities by SecureAge

    CVE-2026-15506 (GCVE-0-2026-15506)

    Vulnerability from cvelistv5 – Published: 2026-07-12 21:30 – Updated: 2026-07-14 16:35
    VLAI
    Title
    SecureAge CatchPulse Driver saappctl.sys heap-based overflow
    Summary
    A security vulnerability has been detected in SecureAge CatchPulse up to 10.9.3. The affected element is an unknown function in the library saappctl.sys of the component Driver. Such manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. Upgrading to version 10.10.0 is sufficient to fix this issue. You should upgrade the affected component. The vendor was contacted early about this disclosure.
    Severity
    8.5 (High)
    CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
    7.8 (High)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
    7.8 (High)
    CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
    SSVC
    Exploitation: poc Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    SecureAge CatchPulse Affected: 10.9.0
    Affected: 10.9.1
    Affected: 10.9.2
    Affected: 10.9.3
    Unaffected: 10.10.0
        cpe:2.3:a:secureage:catchpulse:*:*:*:*:*:*:*:*
    		 Create a notification for this product.
    Credits
    Jordan Higgins Jordanhiggins (VulDB User) Jordanhiggins (VulDB User) VulDB CNA Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15506",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-13T18:06:21.412991Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-13T18:12:18.713Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:secureage:catchpulse:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Driver"
          ],
          "product": "CatchPulse",
          "vendor": "SecureAge",
          "versions": [
            {
              "status": "affected",
              "version": "10.9.0"
            },
            {
              "status": "affected",
              "version": "10.9.1"
            },
            {
              "status": "affected",
              "version": "10.9.2"
            },
            {
              "status": "affected",
              "version": "10.9.3"
            },
            {
              "status": "unaffected",
              "version": "10.10.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jordan Higgins"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jordanhiggins (VulDB User)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jordanhiggins (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security vulnerability has been detected in SecureAge CatchPulse up to 10.9.3. The affected element is an unknown function in the library saappctl.sys of the component Driver. Such manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. Upgrading to version 10.10.0 is sufficient to fix this issue. You should upgrade the affected component. The vendor was contacted early about this disclosure."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.8,
            "vectorString": "AV:L/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "Memory Corruption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T16:35:28.887Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-377835 | SecureAge CatchPulse Driver saappctl.sys heap-based overflow",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/377835"
        },
        {
          "name": "VDB-377835 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/377835/cti"
        },
        {
          "name": "CVE-2026-15506 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-15506"
        },
        {
          "name": "Submit #845584 | SecureAge Technology CatchPulse \u003c10.9.3 Heap-based Buffer Overflow",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/845584"
        },
        {
          "tags": [
            "broken-link",
            "exploit"
          ],
          "url": "https://jordanhiggins.blog/catchpulse-antivirus-exploits/"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/Kalagious/SecureAgeExploit"
        },
        {
          "tags": [
            "media-coverage"
          ],
          "url": "https://youtu.be/xZqRVWlrah8"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-29T00:00:00.000Z",
          "value": "Countermeasure disclosed"
        },
        {
          "lang": "en",
          "time": "2026-07-12T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-07-12T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-07-14T18:40:23.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "SecureAge CatchPulse Driver saappctl.sys heap-based overflow"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-15506",
    "datePublished": "2026-07-12T21:30:12.054Z",
    "dateReserved": "2026-07-12T05:44:41.811Z",
    "dateUpdated": "2026-07-14T16:35:28.887Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-11459 (GCVE-0-2026-11459)

    Vulnerability from cvelistv5 – Published: 2026-06-07 08:15 – Updated: 2026-06-12 17:19
    VLAI
    Title
    SecureAge CatchPulse IOCTL saappctl.sys information disclosure
    Summary
    A security vulnerability has been detected in SecureAge CatchPulse up to 10.9.3. Impacted is an unknown function in the library saappctl.sys of the component IOCTL Handler. The manipulation leads to information disclosure. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used.
    Severity
    4.8 (Medium)
    CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
    3.3 (Low)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
    3.3 (Low)
    CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    SecureAge CatchPulse Affected: 10.9.0
    Affected: 10.9.1
    Affected: 10.9.2
    Affected: 10.9.3
        cpe:2.3:a:secureage:catchpulse:*:*:*:*:*:*:*:*
    		 Create a notification for this product.
    Credits
    Jordan Higgins Nathan Sawyer Jordanhiggins (VulDB User) Jordanhiggins (VulDB User)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11459",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-08T13:05:20.334286Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-08T13:05:31.178Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:secureage:catchpulse:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "IOCTL Handler"
          ],
          "product": "CatchPulse",
          "vendor": "SecureAge",
          "versions": [
            {
              "status": "affected",
              "version": "10.9.0"
            },
            {
              "status": "affected",
              "version": "10.9.1"
            },
            {
              "status": "affected",
              "version": "10.9.2"
            },
            {
              "status": "affected",
              "version": "10.9.3"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jordan Higgins"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Nathan Sawyer"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jordanhiggins (VulDB User)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jordanhiggins (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security vulnerability has been detected in SecureAge CatchPulse up to 10.9.3. Impacted is an unknown function in the library saappctl.sys of the component IOCTL Handler. The manipulation leads to information disclosure. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 1.7,
            "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "Information Disclosure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "Improper Access Controls",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-12T17:19:09.964Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-369078 | SecureAge CatchPulse IOCTL saappctl.sys information disclosure",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/369078"
        },
        {
          "name": "VDB-369078 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/369078/cti"
        },
        {
          "name": "CVE-2026-11459 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-11459"
        },
        {
          "name": "Submit #829131 | SecureAge CatchPulse 10.9.1 Authentication Bypass by Spoofing",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/829131"
        },
        {
          "tags": [
            "broken-link",
            "exploit"
          ],
          "url": "https://jordanhiggins.blog/catchpulse-antivirus-exploits/"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/Kalagious/SecureAgeExploit"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-06T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-06-06T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-06-12T19:23:59.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "SecureAge CatchPulse IOCTL saappctl.sys information disclosure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-11459",
    "datePublished": "2026-06-07T08:15:17.193Z",
    "dateReserved": "2026-06-06T16:06:09.991Z",
    "dateUpdated": "2026-06-12T17:19:09.964Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}