Sentinel
Security reviews for open-source forensic tools.
Investigators rely on open-source tools to process sensitive evidence, and many of those tools have never had a security review. Sentinel is Mobasi's free review program. We find vulnerabilities, work with maintainers to fix them, and publish the findings through the CVE process.
- CVEs published
- 19
- CVEs published
- open-source tools
- 14
- open-source tools
- fixes released
- 17
- fixes released
How a review works.
Reviews are free for maintainers. Findings stay private until the maintainer has had time to fix them.
- 01ReviewWe review the code and its dependencies for security vulnerabilities and supply chain risk.
- 02DiscloseWe report each finding to the maintainers privately and give them time to fix it.
- 03Fix and publishWe send pull requests with fixes where we can, then publish the finding through the CVE process and credit the project.
Vulnerability index.
Every public finding from Sentinel reviews, newest first, with its CVE record. Some findings stay under embargo during disclosure; we add them here once they're public.
| CVE | Tool | Issue | Severity | Status | Date |
|---|---|---|---|---|---|
| CVE-2026-78412 | Velociraptor | Cross-Org Event Read via WatchEvent API | medium | Fixed | 2026-10-05 |
| CVE-2026-82525 | FTK Imager | XXE File Exfiltration via Report.xml XSLT | high | Fixed | 2026-09-03 |
| CVE-2026-18638 | Velociraptor | Server Crash via SetPassword API | medium | Fixed | 2026-08-11 |
| CVE-2026-42796 | Arelle | Unauthenticated RCE via /rest/configure | critical | Fixed | 2026-05-04 |
| CVE-2026-43616 | Detect-It-Easy | Path Traversal Arbitrary File Write | high | Fixed | 2026-05-04 |
| CVE-2026-40032 | UAC | Command Injection via Placeholder Substitution | high | Fixed | 2026-04-05 |
| CVE-2026-40027 | ALEAPP | NQ Vault Path Traversal / RCE | high | Fixed | 2026-03-05 |
| CVE-2026-40024 | Sleuth Kit | tsk_recover Path Traversal | high | Fixed | 2026-03-05 |
| CVE-2026-40025 | Sleuth Kit | APFS Keybag Parser OOB Read | medium | Fixed | 2026-03-05 |
| CVE-2026-40026 | Sleuth Kit | ISO9660 SUSP ER Length Trust OOB Read | medium | Fixed | 2026-03-05 |
| CVE-2026-40028 | Hayabusa | XSS from HTML Inputs | medium | Fixed | 2026-02-20 |
| CVE-2026-40031 | MemProcFS | DLL/Shared Library Hijacking | high | Fixed | 2026-02-20 |
| CVE-2026-4946 | NSA Ghidra | Arbitrary Code Execution via @execute Annotation | high | Fixed | 2026-02-20 |
| CVE-2026-40029 | parseusbs | Command Injection via LNK Filename | high | Fixed | 2026-02-20 |
| CVE-2026-40030 | parseusbs | Command Injection via -v Volume Argument | high | Fixed | 2026-02-20 |
| CVE-2026-25061 | tcpflow | Out of Bounds Write | medium | Fixed | 2026-02-20 |
| CVE-2026-24857 | bulk_extractor | Heap Overflow Attack | high | Disclosed | 2026-01-28 |
| CVE-2026-40035 | unfurl | Permanent Debug Mode | critical | Disclosed | 2026-01-28 |
| CVE-2026-40036 | unfurl | Decompression Bomb DoS | high | Fixed | 2026-01-28 |
Sentinel updates.
All research →Maintain an open‑source forensic tool?
We'd like to help make sure it's secure. Submit it for a free review.