Merge branch 'e-m-b-a:master' into v2.0.3

2026-10-12 02:13:21 +00:00 · 2026-07-20 16:04:50 +02:00
parent af8bfcbacd 25d022b096
commit 978dfeb7c8
27 changed files with 1463 additions and 9 deletions
@@ -0,0 +1,27 @@
+# This workflow tests the project for syntax issues
+
+name: Check the project for bash syntax errors
+
+on:
+  push:
+    branches:    
+      - '**'        # matches every branch
+  pull_request:
+    branches:
+      - '**'
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+  
+permissions:
+  contents: read
+
+jobs:
+  bash-n:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout Branch
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd   # v6.0.2 - https://github.com/actions/checkout/releases/tag/v6.0.2
+      - name: Run bash -n
+        run: |
+          bash ./helpers/bash_syntax_checker.sh
@@ -0,0 +1,30 @@
+name: EMBA Unit Tests (bats)
+
+on:
+  push:
+    branches:
+      - '**'
+  pull_request:
+    branches:
+      - '**'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  bats:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Setup bats
+        run: |
+          curl -sL https://github.com/bats-core/bats-core/archive/refs/tags/v1.11.0.tar.gz | tar xz
+          mv bats-core-1.11.0 tests/bats-core
+          echo "${PWD}/tests/bats-core/bin" >> "${GITHUB_PATH}"
+
+      - name: Run unit tests
+        run: |
+          bats tests/helpers/ tests/modules/
@@ -10,6 +10,7 @@ config/emba_updater
 config/emba_updater_data
 config/module_blacklist.txt
 config/jtr_wordlist.txt
-config/gpt_config.env
+config/ai_config.env
 config/dependencytrack.env
 *config/cve-database.db
+tests/bats-core/
@@ -0,0 +1,71 @@
+# EMBA - Agent Guide
+
+## Overview
+EMBA (Embedded Linux Analyzer) is a firmware security analysis and SBOM tool. It is written entirely in **Bash** and runs as `sudo ./emba`. All code must pass strict mode (`-S` flag) and ShellCheck.
+
+## Key Commands
+| Action | Command |
+|---|---|
+| Install deps | `sudo ./installer.sh -d` |
+| Default scan | `sudo ./emba -l ~/log -f ~/firmware -p ./scan-profiles/default-scan.emba` |
+| SBOM scan | `sudo ./emba -l ~/log -f ~/firmware -p ./scan-profiles/default-sbom.emba` |
+| Emulation scan | `sudo ./emba -l ~/log -f ~/firmware -p ./scan-profiles/default-scan-emulation.emba` |
+| All scan profiles | `./scan-profiles/*.emba` |
+| GUI launcher | `./launcher` (requires `zenity`) |
+
+## Verification (CI checks + unit tests)
+```bash
+# Unit tests (bats framework, ~140 tests across 11 suites)
+./tests/run.sh
+
+# ShellCheck + semgrep on all .sh files
+./check_project.sh           # with --fast for quicker runs
+./check_project.sh --fast
+
+# Format check (2-space indent, no tabs)
+shfmt -d -i 2 .
+
+# ShellCheck standalone
+shellcheck -x -o require-variable-braces ./emba ./modules/*.sh ./helpers/*.sh
+
+# Strict mode runtime test
+sudo ./emba -S -l ~/log -f ~/firmware -p ./scan-profiles/quick-scan.emba
+```
+
+## Architecture
+- `./emba` — main entrypoint (bash), sources helpers then loads modules
+- `./modules/` — scan modules, **ordered by prefix** (alphanumeric sorting via `sort -V`):
+  - `P*` — extraction (binwalk, UEFI, ubifs, etc.)
+  - `S*` — static analysis (binary checks, kernel, passwords, etc.)
+  - `L*` — live/emulation checks (nmap, SNMP, web, metasploit)
+  - `F*` — final aggregation (SBOM, aggregator, tag builder)
+  - `D*` — firmware diffing
+- `./helpers/` — imported helper libraries (`helpers_emba_*.sh`)
+- `./installer/` — per-component install scripts (`I*`, `IF*`, `IL*`, `IP*`)
+- `./config/` — configuration (profile triggers, CVEs, blacklists, version identifiers)
+- `./scan-profiles/` — `.emba` profile files that enable/disable modules
+- `./external/` — gitignored; prebuilt kernel images + tool binaries for emulation
+
+## Code Conventions
+- **Indent**: 2 spaces, no tabs. Enforced by `shfmt`.
+- **Functions**: `snake_case()`. One blank line between functions.
+- **Global vars**: `CAPITALIZED_WITH_UNDERSCORES`.
+- **Local vars**: `l`-prefixed `UPPER_SNAKE_CASE` (e.g., `lMODULE_FILE`).
+- **Strict mode**: All scripts must pass `wickStrictModeFail` (loaded via `installer/wickStrictModeFail.sh`).
+- **ShellCheck**: Do not disable checks; fix the issue instead.
+- **Copyright header**: GPLv3, Siemens Energy AG, on every new file.
+
+## Docker
+Primary deployment method. Build - uses Dockerfile (Kali base):
+```bash
+BUILDKIT_NO_CLIENT_TOKEN=1 DOCKER_BUILDKIT=1 sudo -E docker compose --progress=plain build --no-cache --pull
+```
+Run: EMBA is automatically starting up the required docker images.
+
+Mounts: `FIRMWARE`, `LOG`, `EMBA` env vars required. Container runs privileged.
+
+## Merging / PRs
+- Base on `master`. Use `git rebase -i` to structure logical commits.
+- After each commit, EMBA must work (no temporary breakage).
+- All CI must pass: ShellCheck, shfmt, semgrep, `check_project.sh`.
+- Target OS: Kali Linux rolling / Ubuntu 22.04 LTS.
@@ -40,9 +40,10 @@ Author(s): Michael Messner, Pascal Eckmann, Benedikt Kühne

 ## Latest news

+* [*Black Hat Arsenal - EMBArk demo - USA 2026*](https://github.com/e-m-b-a/emba/wiki#publications-talks-and-live-demos)
+* [*Black Hat Arsenal - EMBA lab - USA 2026*](https://github.com/e-m-b-a/emba/wiki#publications-talks-and-live-demos)
 * [*EMBA v2.0.2 - Party the big 2k*](https://github.com/e-m-b-a/emba/releases/tag/v2.0.2-big-2k)
 * [*EMBA v2.0.1 - The interactor*](https://github.com/e-m-b-a/emba/releases/tag/v2.0.1-interactor)
-* [*EMBA v2.0.0 - A brave new world of firmware analysis*](https://github.com/e-m-b-a/emba/releases/tag/v2.0.0-A-brave-new-world)
 * [*Recording of TROOPERS25 talk "SBOMs the right way" available*](https://github.com/e-m-b-a/emba/wiki#publications-talks-and-live-demos)
 * [*The EMBA book is available*](https://github.com/e-m-b-a/emba/wiki/The-EMBA-book-%E2%80%90-Overview)
 * [*The new EMBA merch store is online - check your merch now*](https://emba-firmware-analyzer.myspreadshop.de/)
@@ -51,7 +52,7 @@ Author(s): Michael Messner, Pascal Eckmann, Benedikt Kühne
 * [**FLOSS Weekly** Episode 802: EMBA – Layers Upon Layers Of Bash](https://hackaday.com/2024/09/25/floss-weekly-episode-802-emba-layers-upon-layers-of-bash/)
 * [*EMBA article on Medium available*](https://medium.com/@iugkhgf/leveraging-automated-firmware-analysis-with-the-open-source-firmware-analyzer-emba-46d30d587a87)
 * [*BsidesLV recording available*](https://youtu.be/8sXyRv21jPY?si=J9H3HK_5KX75Fk4C)
-* [*DEF CON 31 - ICS Village Talk announced*](https://icsvillage.com/)
+* [*DEF CON 31 - ICS Village Talk announced*](https://www.icsvillage.com/defconevents/def-con-31)
 * [*Recording of Black Hat EU 2022 Arsenal session available*](https://github.com/e-m-b-a/emba/wiki#publications-talks-and-live-demos)
 * [*EMBA is now part of the OWASP Firmware Security Testing Methodology*](https://github.com/scriptingxss/owasp-fstm#emba---embedded-analyzer)

@@ -99,13 +99,22 @@ CVE-2026-6501;SNYK-JAVA-ORGJOPENDOCUMENT-16874189;https://security.snyk.io/vuln/
 CVE-2026-6410;SNYK-JS-FASTIFYSTATIC-16098211;https://security.snyk.io/vuln/SNYK-JS-FASTIFYSTATIC-16098211;no;no;yes;no;
 CVE-2026-6321;SNYK-JS-FASTURI-16642399;https://security.snyk.io/vuln/SNYK-JS-FASTURI-16642399;no;no;yes;no;
 CVE-2026-6321;SNYK-JAVA-ORGWEBJARSNPM-16642400;https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-16642400;no;no;yes;no;
+CVE-2026-62843;SNYK-GOLANG-GITHUBCOMFILEBROWSERFILEBROWSERV2HTTP-17987662;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMFILEBROWSERFILEBROWSERV2HTTP-17987662;no;no;yes;no;
+CVE-2026-61505;SNYK-JS-HFS-17970353;https://security.snyk.io/vuln/SNYK-JS-HFS-17970353;no;no;yes;no;
+CVE-2026-61445;SNYK-PYTHON-PRAISONAI-17950924;https://security.snyk.io/vuln/SNYK-PYTHON-PRAISONAI-17950924;no;no;yes;no;
+CVE-2026-61432;SNYK-PYTHON-PRAISONAI-17950759;https://security.snyk.io/vuln/SNYK-PYTHON-PRAISONAI-17950759;no;no;yes;no;
+CVE-2026-61431;SNYK-PYTHON-PRAISONAI-17950758;https://security.snyk.io/vuln/SNYK-PYTHON-PRAISONAI-17950758;no;no;yes;no;
 CVE-2026-6011;SNYK-JS-OPENCLAW-15967228;https://security.snyk.io/vuln/SNYK-JS-OPENCLAW-15967228;yes;no;no;no;
+CVE-2026-60089;SNYK-PYTHON-PRAISONAIAGENTS-17950762;https://security.snyk.io/vuln/SNYK-PYTHON-PRAISONAIAGENTS-17950762;no;no;yes;no;
+CVE-2026-60089;SNYK-PYTHON-PRAISONAI-17950761;https://security.snyk.io/vuln/SNYK-PYTHON-PRAISONAI-17950761;no;no;yes;no;
+CVE-2026-60088;SNYK-PYTHON-PRAISONAI-17950755;https://security.snyk.io/vuln/SNYK-PYTHON-PRAISONAI-17950755;no;no;yes;no;
 CVE-2026-59948;SNYK-PHP-COMPOSERCOMPOSER-17906588;https://security.snyk.io/vuln/SNYK-PHP-COMPOSERCOMPOSER-17906588;no;no;yes;no;
 CVE-2026-59946;SNYK-PHP-COMPOSERCOMPOSER-17906509;https://security.snyk.io/vuln/SNYK-PHP-COMPOSERCOMPOSER-17906509;no;no;yes;no;
 CVE-2026-59924;SNYK-PYTHON-MISTUNE-17895065;https://security.snyk.io/vuln/SNYK-PYTHON-MISTUNE-17895065;no;no;yes;no;
 CVE-2026-59820;SNYK-PYTHON-LITELLM-17900529;https://security.snyk.io/vuln/SNYK-PYTHON-LITELLM-17900529;no;no;yes;no;
 CVE-2026-59195;SNYK-JS-PNPMINSTALLINGENVINSTALLER-17660536;https://security.snyk.io/vuln/SNYK-JS-PNPMINSTALLINGENVINSTALLER-17660536;no;no;yes;no;
 CVE-2026-59195;SNYK-JS-PNPM-17660535;https://security.snyk.io/vuln/SNYK-JS-PNPM-17660535;no;no;yes;no;
+CVE-2026-59149;SNYK-JS-MOCKOONCOMMONSSERVER-17954402;https://security.snyk.io/vuln/SNYK-JS-MOCKOONCOMMONSSERVER-17954402;no;no;yes;no;
 CVE-2026-58499;SNYK-PYTHON-EVEROS-17675224;https://security.snyk.io/vuln/SNYK-PYTHON-EVEROS-17675224;no;no;yes;no;
 CVE-2026-58467;SNYK-UNMANAGED-COCKPITPROJECTCOCKPIT-17807952;https://security.snyk.io/vuln/SNYK-UNMANAGED-COCKPITPROJECTCOCKPIT-17807952;no;no;yes;no;
 CVE-2026-58451;SNYK-PHP-HORDEIMP-17756836;https://security.snyk.io/vuln/SNYK-PHP-HORDEIMP-17756836;no;no;yes;no;
@@ -113,6 +122,8 @@ CVE-2026-58372;SNYK-GOLANG-GITHUBCOMSEAWEEDFSSEAWEEDFSWEEDSERVER-17811817;https:
 CVE-2026-58302;SNYK-UNMANAGED-LINUXCNCLINUXCNC-17705242;https://security.snyk.io/vuln/SNYK-UNMANAGED-LINUXCNCLINUXCNC-17705242;no;no;yes;no;
 CVE-2026-58266;SNYK-PYTHON-AQT-17675231;https://security.snyk.io/vuln/SNYK-PYTHON-AQT-17675231;no;no;yes;no;
 CVE-2026-58192;SNYK-JS-APPIUMSTORAGEPLUGIN-17900815;https://security.snyk.io/vuln/SNYK-JS-APPIUMSTORAGEPLUGIN-17900815;no;no;yes;no;
+CVE-2026-57961;SNYK-PHP-THORSTENPHPMYFAQ-17950427;https://security.snyk.io/vuln/SNYK-PHP-THORSTENPHPMYFAQ-17950427;no;no;yes;no;
+CVE-2026-57961;SNYK-PHP-PHPMYFAQPHPMYFAQ-17950426;https://security.snyk.io/vuln/SNYK-PHP-PHPMYFAQPHPMYFAQ-17950426;no;no;yes;no;
 CVE-2026-5735;SNYK-UNMANAGED-THUNDERBIRD-15929059;https://security.snyk.io/vuln/SNYK-UNMANAGED-THUNDERBIRD-15929059;yes;no;no;no;
 CVE-2026-5735;SNYK-UNMANAGED-FIREFOX-15929058;https://security.snyk.io/vuln/SNYK-UNMANAGED-FIREFOX-15929058;yes;no;no;no;
 CVE-2026-57303;SNYK-JAVA-ORGJENKINSCIPLUGINS-17755946;https://security.snyk.io/vuln/SNYK-JAVA-ORGJENKINSCIPLUGINS-17755946;no;no;no;yes;
@@ -157,6 +168,7 @@ CVE-2026-55878;SNYK-PHP-SYMFONYUXTOOLKIT-17660437;https://security.snyk.io/vuln/
 CVE-2026-55874;SNYK-GOLANG-GITHUBCOMSEAWEEDFSSEAWEEDFSWEEDS3API-17895085;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSEAWEEDFSSEAWEEDFSWEEDS3API-17895085;no;no;yes;no;
 CVE-2026-55846;SNYK-JAVA-IOQAMETAALLURE-17732805;https://security.snyk.io/vuln/SNYK-JAVA-IOQAMETAALLURE-17732805;no;no;yes;no;
 CVE-2026-55832;SNYK-RUST-TRACTONNX-17756837;https://security.snyk.io/vuln/SNYK-RUST-TRACTONNX-17756837;no;no;yes;no;
+CVE-2026-55825;SNYK-PHP-CONTAOCOREBUNDLE-17971336;https://security.snyk.io/vuln/SNYK-PHP-CONTAOCOREBUNDLE-17971336;no;no;yes;no;
 CVE-2026-55760;SNYK-JAVA-COMGITHUBJKNACK-17372911;https://security.snyk.io/vuln/SNYK-JAVA-COMGITHUBJKNACK-17372911;no;no;yes;no;
 CVE-2026-55677;SNYK-GOLANG-GITHUBCOMLABSTACKECHOV5MIDDLEWARE-17660783;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMLABSTACKECHOV5MIDDLEWARE-17660783;no;no;yes;no;
 CVE-2026-55677;SNYK-GOLANG-GITHUBCOMLABSTACKECHOV5INTERNALPATHUTIL-17660782;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMLABSTACKECHOV5INTERNALPATHUTIL-17660782;no;no;yes;no;
@@ -173,9 +185,11 @@ CVE-2026-55667;SNYK-GOLANG-GITHUBCOMFILEBROWSERFILEBROWSERFILES-17748401;https:/
 CVE-2026-55603;SNYK-JS-HTTPPROXYMIDDLEWARE-17375007;https://security.snyk.io/vuln/SNYK-JS-HTTPPROXYMIDDLEWARE-17375007;yes;no;no;no;
 CVE-2026-55488;SNYK-PYTHON-MOTIONEYE-17675190;https://security.snyk.io/vuln/SNYK-PYTHON-MOTIONEYE-17675190;no;no;yes;no;
 CVE-2026-55471;SNYK-JAVA-CAUHNHAPIFHIR-17372948;https://security.snyk.io/vuln/SNYK-JAVA-CAUHNHAPIFHIR-17372948;no;no;no;yes;
+CVE-2026-55469;SNYK-PHP-SNIPESNIPEIT-17950440;https://security.snyk.io/vuln/SNYK-PHP-SNIPESNIPEIT-17950440;no;no;yes;no;
 CVE-2026-55201;SNYK-RUBY-EVILWINRM-17661041;https://security.snyk.io/vuln/SNYK-RUBY-EVILWINRM-17661041;no;no;yes;no;
 CVE-2026-55200;SNYK-UNMANAGED-LIBSSH2-17660953;https://security.snyk.io/vuln/SNYK-UNMANAGED-LIBSSH2-17660953;yes;no;no;no;
 CVE-2026-55092;SNYK-GOLANG-GITHUBCOMAQUASECURITYTRIVYPKGOCI-17753474;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMAQUASECURITYTRIVYPKGOCI-17753474;no;no;yes;no;
+CVE-2026-54684;SNYK-JAVA-IOGITHUBSKYLOT-17980835;https://security.snyk.io/vuln/SNYK-JAVA-IOGITHUBSKYLOT-17980835;no;no;yes;no;
 CVE-2026-54640;SNYK-JAVA-IOOPENREMOTE-17875105;https://security.snyk.io/vuln/SNYK-JAVA-IOOPENREMOTE-17875105;no;no;no;yes;
 CVE-2026-54591;SNYK-PYTHON-ASYNCSSH-17901258;https://security.snyk.io/vuln/SNYK-PYTHON-ASYNCSSH-17901258;no;no;yes;no;
 CVE-2026-54590;SNYK-PYTHON-ASYNCSSH-17901417;https://security.snyk.io/vuln/SNYK-PYTHON-ASYNCSSH-17901417;no;no;yes;no;
@@ -188,6 +202,7 @@ CVE-2026-54093;SNYK-GOLANG-GITHUBCOMFILEBROWSERFILEBROWSERV2HTTP-17748375;https:
 CVE-2026-54093;SNYK-GOLANG-GITHUBCOMFILEBROWSERFILEBROWSERV2FILES-17748373;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMFILEBROWSERFILEBROWSERV2FILES-17748373;no;no;yes;no;
 CVE-2026-54093;SNYK-GOLANG-GITHUBCOMFILEBROWSERFILEBROWSERHTTP-17748374;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMFILEBROWSERFILEBROWSERHTTP-17748374;no;no;yes;no;
 CVE-2026-54093;SNYK-GOLANG-GITHUBCOMFILEBROWSERFILEBROWSERFILES-17748372;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMFILEBROWSERFILEBROWSERFILES-17748372;no;no;yes;no;
+CVE-2026-54065;SNYK-PHP-NUKEVIETNUKEVIET-17971316;https://security.snyk.io/vuln/SNYK-PHP-NUKEVIETNUKEVIET-17971316;no;no;yes;no;
 CVE-2026-54014;SNYK-PYTHON-OPENWEBUI-17400344;https://security.snyk.io/vuln/SNYK-PYTHON-OPENWEBUI-17400344;no;no;yes;no;
 CVE-2026-53951;SNYK-PYTHON-COPIER-17895074;https://security.snyk.io/vuln/SNYK-PYTHON-COPIER-17895074;no;no;yes;no;
 CVE-2026-53925;SNYK-PYTHON-GLANCES-17670542;https://security.snyk.io/vuln/SNYK-PYTHON-GLANCES-17670542;no;no;yes;no;
@@ -209,6 +224,7 @@ CVE-2026-53519;SNYK-GOLANG-GITHUBCOMNEZHAHQNEZHACMDDASHBOARDCONTROLLER-17673404;
 CVE-2026-53486;SNYK-JS-XHMIKOSRDECOMPRESS-17874438;https://security.snyk.io/vuln/SNYK-JS-XHMIKOSRDECOMPRESS-17874438;no;no;yes;no;
 CVE-2026-53486;SNYK-JS-DECOMPRESS-17874437;https://security.snyk.io/vuln/SNYK-JS-DECOMPRESS-17874437;no;no;yes;no;
 CVE-2026-53486;SNYK-JAVA-ORGWEBJARSNPM-17874439;https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-17874439;no;no;yes;no;
+CVE-2026-53449;SNYK-UNMANAGED-COTURNCOTURN-17950386;https://security.snyk.io/vuln/SNYK-UNMANAGED-COTURNCOTURN-17950386;no;no;yes;no;
 CVE-2026-5331;SNYK-PHP-OPENCARTOPENCART-15907866;https://security.snyk.io/vuln/SNYK-PHP-OPENCARTOPENCART-15907866;no;no;yes;no;
 CVE-2026-52902;SNYK-PYTHON-AWXKIT-17339772;https://security.snyk.io/vuln/SNYK-PYTHON-AWXKIT-17339772;no;no;yes;no;
 CVE-2026-52811;SNYK-GOLANG-GOGSIOGOGSINTERNALDATABASE-17756818;https://security.snyk.io/vuln/SNYK-GOLANG-GOGSIOGOGSINTERNALDATABASE-17756818;no;no;yes;no;
@@ -229,6 +245,7 @@ CVE-2026-49984;SNYK-JAVA-IOKESTRA-17817230;https://security.snyk.io/vuln/SNYK-JA
 CVE-2026-49982;SNYK-JS-TMP-17315641;https://security.snyk.io/vuln/SNYK-JS-TMP-17315641;no;no;yes;no;
 CVE-2026-49982;SNYK-JAVA-ORGWEBJARSNPM-17339132;https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-17339132;no;no;yes;no;
 CVE-2026-49975;SNYK-UNMANAGED-APACHEHTTPD-17309031;https://security.snyk.io/vuln/SNYK-UNMANAGED-APACHEHTTPD-17309031;yes;no;no;no;
+CVE-2026-49970;SNYK-PHP-PLANKLARAVELMEDIABLE-17966724;https://security.snyk.io/vuln/SNYK-PHP-PLANKLARAVELMEDIABLE-17966724;no;no;yes;no;
 CVE-2026-49875;SNYK-JAVA-ORGAPACHECXF-17339193;https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHECXF-17339193;no;no;no;yes;
 CVE-2026-49833;SNYK-JAVA-ORGDSPACE-17901239;https://security.snyk.io/vuln/SNYK-JAVA-ORGDSPACE-17901239;no;no;yes;no;
 CVE-2026-49831;SNYK-JAVA-ORGDSPACE-17901300;https://security.snyk.io/vuln/SNYK-JAVA-ORGDSPACE-17901300;no;no;yes;no;
@@ -364,6 +381,7 @@ CVE-2026-45731;SNYK-PHP-WWBNAVIDEO-16755463;https://security.snyk.io/vuln/SNYK-P
 CVE-2026-45727;SNYK-PYTHON-CLOAKBROWSER-17670571;https://security.snyk.io/vuln/SNYK-PYTHON-CLOAKBROWSER-17670571;no;no;yes;no;
 CVE-2026-45725;SNYK-PYTHON-COMPLIANCETRESTLE-17283184;https://security.snyk.io/vuln/SNYK-PYTHON-COMPLIANCETRESTLE-17283184;no;no;yes;no;
 CVE-2026-45711;SNYK-GOLANG-GITHUBCOMAXLLENTMAILPITINTERNALDUMP-17710347;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMAXLLENTMAILPITINTERNALDUMP-17710347;no;no;yes;no;
+CVE-2026-45693;SNYK-PHP-FACTURASCRIPTSFACTURASCRIPTS-17972371;https://security.snyk.io/vuln/SNYK-PHP-FACTURASCRIPTSFACTURASCRIPTS-17972371;no;no;yes;no;
 CVE-2026-45571;SNYK-GOLANG-GITHUBCOMGOGITGOGITV6STORAGEFILESYSTEMDOTGIT-16776807;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGOGITGOGITV6STORAGEFILESYSTEMDOTGIT-16776807;no;no;yes;no;
 CVE-2026-45571;SNYK-GOLANG-GITHUBCOMGOGITGOGITV5STORAGEFILESYSTEMDOTGIT-16776809;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGOGITGOGITV5STORAGEFILESYSTEMDOTGIT-16776809;no;no;yes;no;
 CVE-2026-45571;SNYK-GOLANG-GITHUBCOMGOGITGOGITSTORAGEFILESYSTEMDOTGIT-16776806;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGOGITGOGITSTORAGEFILESYSTEMDOTGIT-16776806;no;no;yes;no;
@@ -395,6 +413,7 @@ CVE-2026-44885;SNYK-GOLANG-GITHUBCOMPORTAINERPORTAINERAPIARCHIVE-16733879;https:
 CVE-2026-44837;SNYK-RUBY-VIEWCOMPONENT-16624538;https://security.snyk.io/vuln/SNYK-RUBY-VIEWCOMPONENT-16624538;no;no;yes;no;
 CVE-2026-44829;SNYK-GOLANG-GITHUBCOMGOTENBERGGOTENBERGV8PKGMODULESAPI-17661082;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGOTENBERGGOTENBERGV8PKGMODULESAPI-17661082;no;no;yes;no;
 CVE-2026-44829;SNYK-GOLANG-GITHUBCOMGOTENBERGGOTENBERGV7PKGMODULESAPI-17661083;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGOTENBERGGOTENBERGV7PKGMODULESAPI-17661083;no;no;yes;no;
+CVE-2026-44825;SNYK-JAVA-ORGAPACHESOLR-17139337;https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHESOLR-17139337;yes;no;no;no;
 CVE-2026-4480;SNYK-UNMANAGED-SAMBA-16964914;https://security.snyk.io/vuln/SNYK-UNMANAGED-SAMBA-16964914;yes;no;no;no;
 CVE-2026-4480;SNYK-UBUNTU2004-SAMBA-16877386;https://security.snyk.io/vuln/SNYK-UBUNTU2004-SAMBA-16877386;yes;no;no;no;
 CVE-2026-4480;SNYK-ORACLE8-SAMBAWINBINDKRB5LOCATOR-17161094;https://security.snyk.io/vuln/SNYK-ORACLE8-SAMBAWINBINDKRB5LOCATOR-17161094;yes;no;no;no;
@@ -402,6 +421,43 @@ CVE-2026-4480;SNYK-ORACLE8-SAMBATEST-17161131;https://security.snyk.io/vuln/SNYK
 CVE-2026-4480;SNYK-ORACLE8-SAMBADCLIBS-17161096;https://security.snyk.io/vuln/SNYK-ORACLE8-SAMBADCLIBS-17161096;yes;no;no;no;
 CVE-2026-4480;SNYK-ORACLE8-SAMBACOMMON-17161150;https://security.snyk.io/vuln/SNYK-ORACLE8-SAMBACOMMON-17161150;yes;no;no;no;
 CVE-2026-4480;SNYK-ORACLE8-LIBWBCLIENT-17161092;https://security.snyk.io/vuln/SNYK-ORACLE8-LIBWBCLIENT-17161092;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-SAMBAWINEXE-18007042;https://security.snyk.io/vuln/SNYK-ORACLE10-SAMBAWINEXE-18007042;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-SAMBAWINBINDMODULES-18007158;https://security.snyk.io/vuln/SNYK-ORACLE10-SAMBAWINBINDMODULES-18007158;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-SAMBAWINBINDKRB5LOCATOR-18007238;https://security.snyk.io/vuln/SNYK-ORACLE10-SAMBAWINBINDKRB5LOCATOR-18007238;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-SAMBAWINBINDCLIENTS-18007163;https://security.snyk.io/vuln/SNYK-ORACLE10-SAMBAWINBINDCLIENTS-18007163;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-SAMBAWINBIND-18007256;https://security.snyk.io/vuln/SNYK-ORACLE10-SAMBAWINBIND-18007256;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-SAMBAVFSIOURING-18007073;https://security.snyk.io/vuln/SNYK-ORACLE10-SAMBAVFSIOURING-18007073;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-SAMBAUSERSHARES-18007184;https://security.snyk.io/vuln/SNYK-ORACLE10-SAMBAUSERSHARES-18007184;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-SAMBATOOLS-18007139;https://security.snyk.io/vuln/SNYK-ORACLE10-SAMBATOOLS-18007139;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-SAMBATESTLIBS-18007046;https://security.snyk.io/vuln/SNYK-ORACLE10-SAMBATESTLIBS-18007046;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-SAMBATEST-18007100;https://security.snyk.io/vuln/SNYK-ORACLE10-SAMBATEST-18007100;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-SAMBAPIDL-18007108;https://security.snyk.io/vuln/SNYK-ORACLE10-SAMBAPIDL-18007108;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-SAMBALIBS-18007089;https://security.snyk.io/vuln/SNYK-ORACLE10-SAMBALIBS-18007089;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-SAMBALDBLDAPMODULES-18007023;https://security.snyk.io/vuln/SNYK-ORACLE10-SAMBALDBLDAPMODULES-18007023;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-SAMBAKRB5PRINTING-18007029;https://security.snyk.io/vuln/SNYK-ORACLE10-SAMBAKRB5PRINTING-18007029;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-SAMBAGPUPDATE-18006930;https://security.snyk.io/vuln/SNYK-ORACLE10-SAMBAGPUPDATE-18006930;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-SAMBADEVEL-18007179;https://security.snyk.io/vuln/SNYK-ORACLE10-SAMBADEVEL-18007179;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-SAMBADCLIBS-18007279;https://security.snyk.io/vuln/SNYK-ORACLE10-SAMBADCLIBS-18007279;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-SAMBADCERPC-18007222;https://security.snyk.io/vuln/SNYK-ORACLE10-SAMBADCERPC-18007222;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-SAMBACOMMONTOOLS-18006941;https://security.snyk.io/vuln/SNYK-ORACLE10-SAMBACOMMONTOOLS-18006941;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-SAMBACOMMONLIBS-18007213;https://security.snyk.io/vuln/SNYK-ORACLE10-SAMBACOMMONLIBS-18007213;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-SAMBACOMMON-18007008;https://security.snyk.io/vuln/SNYK-ORACLE10-SAMBACOMMON-18007008;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-SAMBACLIENTLIBS-18007198;https://security.snyk.io/vuln/SNYK-ORACLE10-SAMBACLIENTLIBS-18007198;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-SAMBACLIENT-18007295;https://security.snyk.io/vuln/SNYK-ORACLE10-SAMBACLIENT-18007295;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-SAMBA-18007156;https://security.snyk.io/vuln/SNYK-ORACLE10-SAMBA-18007156;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-PYTHON3SAMBATEST-18007064;https://security.snyk.io/vuln/SNYK-ORACLE10-PYTHON3SAMBATEST-18007064;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-PYTHON3SAMBADC-18007050;https://security.snyk.io/vuln/SNYK-ORACLE10-PYTHON3SAMBADC-18007050;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-PYTHON3SAMBA-18007304;https://security.snyk.io/vuln/SNYK-ORACLE10-PYTHON3SAMBA-18007304;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-PYTHON3LDB-18007185;https://security.snyk.io/vuln/SNYK-ORACLE10-PYTHON3LDB-18007185;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-LIBWBCLIENTDEVEL-18007172;https://security.snyk.io/vuln/SNYK-ORACLE10-LIBWBCLIENTDEVEL-18007172;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-LIBWBCLIENT-18007041;https://security.snyk.io/vuln/SNYK-ORACLE10-LIBWBCLIENT-18007041;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-LIBSMBCLIENTDEVEL-18007300;https://security.snyk.io/vuln/SNYK-ORACLE10-LIBSMBCLIENTDEVEL-18007300;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-LIBSMBCLIENT-18007127;https://security.snyk.io/vuln/SNYK-ORACLE10-LIBSMBCLIENT-18007127;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-LIBNETAPIDEVEL-18007103;https://security.snyk.io/vuln/SNYK-ORACLE10-LIBNETAPIDEVEL-18007103;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-LIBNETAPI-18007262;https://security.snyk.io/vuln/SNYK-ORACLE10-LIBNETAPI-18007262;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-LIBLDBDEVEL-18007016;https://security.snyk.io/vuln/SNYK-ORACLE10-LIBLDBDEVEL-18007016;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-LIBLDB-18007038;https://security.snyk.io/vuln/SNYK-ORACLE10-LIBLDB-18007038;yes;no;no;no;
+CVE-2026-4480;SNYK-ORACLE10-LDBTOOLS-18007249;https://security.snyk.io/vuln/SNYK-ORACLE10-LDBTOOLS-18007249;yes;no;no;no;
 CVE-2026-4480;SNYK-AMZN2023-SAMBAWINBINDMODULESDEBUGINFO-17418513;https://security.snyk.io/vuln/SNYK-AMZN2023-SAMBAWINBINDMODULESDEBUGINFO-17418513;yes;no;no;no;
 CVE-2026-4480;SNYK-AMZN2023-SAMBAWINBINDKRB5LOCATORDEBUGINFO-17418500;https://security.snyk.io/vuln/SNYK-AMZN2023-SAMBAWINBINDKRB5LOCATORDEBUGINFO-17418500;yes;no;no;no;
 CVE-2026-4480;SNYK-AMZN2023-SAMBAWINBINDKRB5LOCATOR-17418252;https://security.snyk.io/vuln/SNYK-AMZN2023-SAMBAWINBINDKRB5LOCATOR-17418252;yes;no;no;no;
@@ -556,6 +612,8 @@ CVE-2026-42605;SNYK-PHP-AZURACASTAZURACAST-16419413;https://security.snyk.io/vul
 CVE-2026-42600;SNYK-GOLANG-GITHUBCOMMINIOMINIOCMD-16424149;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMMINIOMINIOCMD-16424149;no;no;yes;no;
 CVE-2026-4258;SNYK-JS-SJCL-15369617;https://security.snyk.io/vuln/SNYK-JS-SJCL-15369617;yes;no;no;no;
 CVE-2026-4258;SNYK-JAVA-ORGWEBJARSNPM-15751243;https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-15751243;yes;no;no;no;
+CVE-2026-42588;SNYK-JAVA-ORGAPACHEACTIVEMQ-17151887;https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHEACTIVEMQ-17151887;yes;no;no;no;
+CVE-2026-42588;SNYK-JAVA-ORGAPACHEACTIVEMQ-17151864;https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHEACTIVEMQ-17151864;yes;no;no;no;
 CVE-2026-42586;SNYK-JAVA-IONETTY-16439010;https://security.snyk.io/vuln/SNYK-JAVA-IONETTY-16439010;yes;no;no;no;
 CVE-2026-42585;SNYK-JAVA-IONETTY-16438737;https://security.snyk.io/vuln/SNYK-JAVA-IONETTY-16438737;yes;no;no;no;
 CVE-2026-42584;SNYK-JAVA-IONETTY-16438923;https://security.snyk.io/vuln/SNYK-JAVA-IONETTY-16438923;yes;no;no;no;
@@ -1443,6 +1501,8 @@ CVE-2026-2033;SNYK-PYTHON-MLFLOW-15325640;https://security.snyk.io/vuln/SNYK-PYT
 CVE-2026-1839;SNYK-PYTHON-TRANSFORMERS-15166618;https://security.snyk.io/vuln/SNYK-PYTHON-TRANSFORMERS-15166618;yes;no;no;no;
 CVE-2026-1776;SNYK-RUBY-CAMALEONCMS-15469324;https://security.snyk.io/vuln/SNYK-RUBY-CAMALEONCMS-15469324;no;no;yes;no;
 CVE-2026-1703;SNYK-PYTHON-PIP-15182639;https://security.snyk.io/vuln/SNYK-PYTHON-PIP-15182639;no;no;yes;no;
+CVE-2026-15626;SNYK-GOLANG-GITHUBCOMNEXTLEVELBUILDERGOCLAWINTERNALPROVIDERSACP-17971503;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMNEXTLEVELBUILDERGOCLAWINTERNALPROVIDERSACP-17971503;no;no;yes;no;
+CVE-2026-15626;SNYK-GOLANG-GITHUBCOMNEXTLEVELBUILDERGOCLAWINTERNALPROVIDERS-17971502;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMNEXTLEVELBUILDERGOCLAWINTERNALPROVIDERS-17971502;no;no;yes;no;
 CVE-2026-15138;SNYK-PYTHON-MCPTEXTEDITOR-17911734;https://security.snyk.io/vuln/SNYK-PYTHON-MCPTEXTEDITOR-17911734;no;no;yes;no;
 CVE-2026-14967;SNYK-PYTHON-BBOT-17895061;https://security.snyk.io/vuln/SNYK-PYTHON-BBOT-17895061;no;no;yes;no;
 CVE-2026-1470;SNYK-JS-N8NWORKFLOW-15118125;https://security.snyk.io/vuln/SNYK-JS-N8NWORKFLOW-15118125;yes;no;no;no;
@@ -1453,6 +1513,7 @@ CVE-2026-12866;SNYK-JS-EXPREVAL-15054690;https://security.snyk.io/vuln/SNYK-JS-E
 CVE-2026-12866;SNYK-JAVA-ORGWEBJARSNPM-17662018;https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-17662018;yes;no;no;no;
 CVE-2026-12644;SNYK-JS-TSDEEPMERGE-17339141;https://security.snyk.io/vuln/SNYK-JS-TSDEEPMERGE-17339141;yes;no;no;no;
 CVE-2026-12644;SNYK-JAVA-ORGWEBJARSNPM-17393714;https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-17393714;yes;no;no;no;
+CVE-2026-12482;SNYK-PYTHON-KERAS-17971535;https://security.snyk.io/vuln/SNYK-PYTHON-KERAS-17971535;no;no;yes;no;
 CVE-2026-12479;SNYK-PYTHON-KERAS-17825944;https://security.snyk.io/vuln/SNYK-PYTHON-KERAS-17825944;no;no;yes;no;
 CVE-2026-12243;SNYK-PYTHON-NLTK-17817780;https://security.snyk.io/vuln/SNYK-PYTHON-NLTK-17817780;no;no;yes;no;
 CVE-2026-12208;SNYK-JS-JSONATA-17339139;https://security.snyk.io/vuln/SNYK-JS-JSONATA-17339139;yes;no;no;no;
@@ -1531,6 +1592,7 @@ CVE-2025-7425;SNYK-UNMANAGED-GNOMELIBXSLT-10674343;https://security.snyk.io/vuln
 CVE-2025-7425;SNYK-CONAN-LIBXSLT-10674344;https://security.snyk.io/vuln/SNYK-CONAN-LIBXSLT-10674344;yes;no;no;no;
 CVE-2025-7424;SNYK-UNMANAGED-GNOMELIBXSLT-10674341;https://security.snyk.io/vuln/SNYK-UNMANAGED-GNOMELIBXSLT-10674341;yes;no;no;no;
 CVE-2025-7424;SNYK-CONAN-LIBXSLT-10674342;https://security.snyk.io/vuln/SNYK-CONAN-LIBXSLT-10674342;yes;no;no;no;
+CVE-2025-71394;SNYK-RUST-SURREALDBCORE-10079848;https://security.snyk.io/vuln/SNYK-RUST-SURREALDBCORE-10079848;no;no;yes;no;
 CVE-2025-71085;SNYK-SLES157-KERNELLIVEPATCH64015070078RT-15766647;https://security.snyk.io/vuln/SNYK-SLES157-KERNELLIVEPATCH64015070078RT-15766647;yes;no;no;no;
 CVE-2025-71085;SNYK-SLES157-KERNELLIVEPATCH64015070073RT-15766650;https://security.snyk.io/vuln/SNYK-SLES157-KERNELLIVEPATCH64015070073RT-15766650;yes;no;no;no;
 CVE-2025-71085;SNYK-SLES157-KERNELLIVEPATCH640150700728RT-15766670;https://security.snyk.io/vuln/SNYK-SLES157-KERNELLIVEPATCH640150700728RT-15766670;yes;no;no;no;
@@ -2496,7 +2558,6 @@ CVE-2025-24019;SNYK-PHP-YESWIKIYESWIKI-8651733;https://security.snyk.io/vuln/SNY
 CVE-2025-24011;SNYK-DOTNET-UMBRACOCMSCORE-8656574;https://security.snyk.io/vuln/SNYK-DOTNET-UMBRACOCMSCORE-8656574;yes;no;no;no;
 CVE-2025-24011;SNYK-DOTNET-UMBRACOCMSAPIMANAGEMENT-8656575;https://security.snyk.io/vuln/SNYK-DOTNET-UMBRACOCMSAPIMANAGEMENT-8656575;yes;no;no;no;
 CVE-2025-24010;SNYK-JS-VITE-8648411;https://security.snyk.io/vuln/SNYK-JS-VITE-8648411;yes;no;no;no;
-CVE-2025-2336;SNYK-JS-ANGULARSANITIZE-10337224;https://security.snyk.io/vuln/SNYK-JS-ANGULARSANITIZE-10337224;yes;no;no;no;
 CVE-2025-2336;SNYK-JAVA-ORGWEBJARSNPM-10337225;https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-10337225;yes;no;no;no;
 CVE-2025-2336;SNYK-JAVA-ORGWEBJARSBOWER-10337226;https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-10337226;yes;no;no;no;
 CVE-2025-2336;SNYK-JAVA-ORGWEBJARS-10337227;https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-10337227;yes;no;no;no;
@@ -5074,6 +5135,7 @@ CVE-2023-26118;SNYK-JAVA-ORGWEBJARSNPM-5406327;https://security.snyk.io/vuln/SNY
 CVE-2023-26118;SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-5406328;https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-5406328;yes;no;no;no;
 CVE-2023-26118;SNYK-JAVA-ORGWEBJARSBOWER-5406326;https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-5406326;yes;no;no;no;
 CVE-2023-26118;SNYK-DOTNET-ANGULARJS-10771615;https://security.snyk.io/vuln/SNYK-DOTNET-ANGULARJS-10771615;yes;no;no;no;
+CVE-2023-26117;SNYK-JS-ANGULARRESOURCE-17988734;https://security.snyk.io/vuln/SNYK-JS-ANGULARRESOURCE-17988734;yes;no;no;no;
 CVE-2023-26117;SNYK-JS-ANGULAR-3373045;https://security.snyk.io/vuln/SNYK-JS-ANGULAR-3373045;yes;no;no;no;
 CVE-2023-26117;SNYK-JAVA-ORGWEBJARSNPM-5406324;https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-5406324;yes;no;no;no;
 CVE-2023-26117;SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-5406325;https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-5406325;yes;no;no;no;
@@ -7175,6 +7237,7 @@ CVE-2012-3521;SNYK-PHP-GESHIGESHI-9789611;https://security.snyk.io/vuln/SNYK-PHP
 CVE-2012-1089;SNYK-JAVA-ORGAPACHEWICKET-31012;https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHEWICKET-31012;no;no;yes;no;
 CVE-2011-4457;SNYK-JAVA-COMGOOGLECODEOWASPJAVAHTMLSANITIZER-6182919;https://security.snyk.io/vuln/SNYK-JAVA-COMGOOGLECODEOWASPJAVAHTMLSANITIZER-6182919;yes;no;no;no;
 CVE-2011-4367;SNYK-JAVA-ORGAPACHEMYFACESCORE-30023;https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHEMYFACESCORE-30023;no;no;yes;no;
+CVE-2011-3389;SNYK-DEBIAN14-ASTERISK-17957421;https://security.snyk.io/vuln/SNYK-DEBIAN14-ASTERISK-17957421;yes;no;no;no;
 CVE-2011-0698;SNYK-PYTHON-DJANGO-40060;https://security.snyk.io/vuln/SNYK-PYTHON-DJANGO-40060;no;no;yes;no;
 CVE-2010-3863;SNYK-JAVA-ORGAPACHESHIRO-30725;https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHESHIRO-30725;no;no;yes;no;
 CVE-2010-3863;SNYK-JAVA-ORGAPACHESHIRO-30722;https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHESHIRO-30722;no;no;yes;no;
@@ -5652,6 +5652,7 @@ linux-6.12.92;01-Jun-2026
 linux-6.12.93;09-Jun-2026
 linux-6.12.94;19-Jun-2026
 linux-6.12.95;04-Jul-2026
+linux-6.12.96;18-Jul-2026
 linux-6.12;18-Nov-2024
 linux-6.13.1;01-Feb-2025
 linux-6.13.10;07-Apr-2025
@@ -5749,6 +5750,7 @@ linux-6.18.35;09-Jun-2026
 linux-6.18.36;19-Jun-2026
 linux-6.18.37;27-Jun-2026
 linux-6.18.38;04-Jul-2026
+linux-6.18.39;18-Jul-2026
 linux-6.18.4;08-Jan-2026
 linux-6.18.5;11-Jan-2026
 linux-6.18.6;17-Jan-2026
@@ -6035,4 +6037,5 @@ linux-7.0;13-Apr-2026
 linux-7.1.1;19-Jun-2026
 linux-7.1.2;27-Jun-2026
 linux-7.1.3;04-Jul-2026
+linux-7.1.4;18-Jul-2026
 linux-7.1;14-Jun-2026
@@ -1,4 +1,14 @@
 cveID,vendorProject,product,vulnerabilityName,dateAdded,shortDescription,requiredAction,dueDate,knownRansomwareCampaignUse,notes,cwes
+CVE-2026-58644,Microsoft,SharePoint,"Microsoft SharePoint Deserialization of Untrusted Data Vulnerability",2026-07-16,"Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.","Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",2026-07-19,Unknown,"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-58644",CWE-502
+CVE-2026-25089,Fortinet,FortiSandbox,"Fortinet FortiSandbox OS Command Injection Vulnerability",2026-07-16,"Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.","Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",2026-07-19,Unknown,"https://fortiguard.fortinet.com/psirt/FG-IR-26-141 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-25089",CWE-78
+CVE-2026-39808,Fortinet,FortiSandbox,"Fortinet FortiSandbox OS Command Injection Vulnerability",2026-07-16,"Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.","Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",2026-07-19,Unknown,"https://fortiguard.fortinet.com/psirt/FG-IR-26-100 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-39808",CWE-78
+CVE-2026-46817,Oracle,"E-Business Suite","Oracle E-Business Suite Improper Privilege Management Vulnerability",2026-07-15,"Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.","Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",2026-07-18,Unknown,"https://www.oracle.com/security-alerts/cspumay2026.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-46817","CWE-269, CWE-287, CWE-306"
+CVE-2023-4346,"KNX Association","KNX Protocol Connection Authorization Option 1","KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability",2026-07-15,"KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device. ","Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",2026-07-29,Unknown,"https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2023-4346",CWE-645
+CVE-2026-56155,Microsoft,"Active Directory Federation Services","Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability ",2026-07-14,"Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.","Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",2026-07-28,Unknown,"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56155 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-56155; https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/decommission/adfs-decommission-guide",CWE-1220
+CVE-2026-56164,Microsoft,"SharePoint Server","Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability",2026-07-14,"Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network.","Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",2026-07-17,Unknown,"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56164 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-56164",CWE-306
+CVE-2026-15409,SonicWall,"SMA1000 Appliances","SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability",2026-07-14,"SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.","Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",2026-07-17,Unknown,"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-15409",CWE-918
+CVE-2026-15410,SonicWall,"SMA1000 Appliances","SonicWall SMA1000 Appliances Code Injection Vulnerability",2026-07-14,"SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.","Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",2026-07-17,Unknown,"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-15410",CWE-94
+CVE-2008-4128,Cisco,IOS,"Cisco IOS Cross-Site Request Forgery Vulnerability",2026-07-13,"Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain ""show privilege"" command to the /level/15/exec/- URI, and (2) a certain ""alias exec"" command to the /level/15/exec/-/configure/http URI.","Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",2026-07-16,Unknown,"https://www.cisco.com/c/en/us/obsolete/ios-nx-os-software/cisco-ios-software-releases-12-4-mainline.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2008-4128",CWE-352
 CVE-2026-56291,Balbooa,Forms,"Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability",2026-07-10,"Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability that allows an unauthenticated arbitrary file upload which could allow uploading of executable files leading to full RCE.","Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",2026-07-13,Unknown,"https://www.balbooa.com/joomla-forms ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-56291",CWE-434
 CVE-2026-48939,iCagenda,iCagenda,"iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability",2026-07-10,"iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.","Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",2026-07-13,Unknown,"https://www.icagenda.com/#download ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48939",CWE-434
 CVE-2026-48908,JoomShaper,"SP Page Builder","JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability",2026-07-07,"JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.","Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",2026-07-10,Unknown,"https://extensions.joomla.org/extension/sp-page-builder/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48908",CWE-434
@@ -0,0 +1,65 @@
+#!/bin/bash -p
+
+# EMBA - EMBEDDED LINUX ANALYZER
+#
+# Copyright 2026-2026 Siemens Energy AG
+#
+# EMBA comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
+# welcome to redistribute it under the terms of the GNU General Public License.
+# See LICENSE file for usage of this software.
+#
+# EMBA is licensed under GPLv3
+# SPDX-License-Identifier: GPL-3.0-only
+#
+# Author(s): Michael Messner
+
+# Description: Checks all EMBA source files with bash -n for syntax errors
+#
+
+GREEN='\033[0;32m'
+ORANGE='\033[0;33m'
+RED='\033[0;31m'
+BOLD='\033[1m'
+NC='\033[0m' # no color
+
+EMBA_SOURCES_ARR=()
+EMBA_SOURCE_FILE=""
+MODULES_TO_CHECK_ARR=()
+
+import_emba_scripts() {
+  local lFILES_ARR=()
+  local lEMBA_FILE=""
+
+  mapfile -t lFILES_ARR < <(find ./ \( -name .git -o -name external \) -prune -o -type f -print 2>/dev/null)
+  for lEMBA_FILE in "${lFILES_ARR[@]}"; do
+    if file "${lEMBA_FILE}" | grep -q "shell script"; then
+      echo "${lEMBA_FILE}"
+      EMBA_SOURCES_ARR+=("${lEMBA_FILE}")
+    fi
+  done
+}
+
+echo -e "\\n${ORANGE}${BOLD}Embedded Linux Analyzer Bash syntax checker${NC}"
+echo -e "${BOLD}=================================================================${NC}"
+
+echo -e "\\n${GREEN}Load all sources to check:${NC}\\n"
+import_emba_scripts
+
+echo -e "\\n${GREEN}Check all source files for correct bash syntax:${NC}\\n"
+for EMBA_SOURCE_FILE in "${EMBA_SOURCES_ARR[@]}"; do
+  [[ ! -f "${EMBA_SOURCE_FILE}" ]] && continue
+  echo -e "\\n${GREEN}Run ${ORANGE}bash -n${GREEN} on ${ORANGE}${EMBA_SOURCE_FILE}${NC}\\n"
+  if bash -n "${EMBA_SOURCE_FILE}" 2>/dev/null; then
+    echo -e "${GREEN}${BOLD}==> SUCCESS${NC}\\n"
+  else
+    echo -e "\\n${ORANGE}${BOLD}==> FIX ERRORS${NC}\\n"
+    bash -n "${EMBA_SOURCE_FILE}"
+    MODULES_TO_CHECK_ARR+=("${EMBA_SOURCE_FILE}")
+  fi
+done
+
+if [[ "${#MODULES_TO_CHECK_ARR[@]}" -gt 0 ]]; then
+  echo -e "${RED}[-] WARNING: Syntax errors detected -> Fix before pushing to EMBA repo${NC}"
+  exit 1
+fi
+exit 0
@@ -167,12 +167,10 @@ output_details() {
  fi
  lENTROPY_PIC_PATH=$(find "${LOG_DIR}" -xdev -maxdepth 1 -type f -iname "*_entropy.png" 2>/dev/null)
  if [[ -n "${ENTROPY}" ]]; then
-    print_output "[+] Entropy analysis of binary firmware is: ${ORANGE}${ENTROPY}"
+    print_output "[+] Entropy analysis of binary firmware is: ${ORANGE}${ENTROPY}${NC}"
    write_link "p02"
-    if [[ -n "${lENTROPY_PIC_PATH}" ]]; then
-      if [[ ! -s "${lENTROPY_PIC_PATH}" ]]; then
-        write_link "${lENTROPY_PIC_PATH}"
-      fi
+    if [[ -f "${lENTROPY_PIC_PATH}" ]]; then
+      write_link "${lENTROPY_PIC_PATH}"
    fi
    write_csv_log "entropy_value" "${ENTROPY}" "NA" "NA" "NA" "NA" "NA" "NA" "NA"
    lDATA_GENERATED=1
@@ -151,6 +151,8 @@ generate_entropy_graph() {
    print_output "$("${BINWALK_BIN[@]}" --entropy --png "${lENTROPY_PIC_PATH}" "${lFIRMWARE_PATH_BIN}")"
    if [[ -s "${lENTROPY_PIC_PATH}" ]]; then
      write_link "${lENTROPY_PIC_PATH}"
+    else
+      rm -f "${lENTROPY_PIC_PATH}" || print_error "[-] P02 - entropy pic removal error"
    fi
  fi
 }
@@ -45,6 +45,7 @@ export VEX_METRICS=1

 # the following modules are long running modules which are disabled in the default profile
 export MODULE_BLACKLIST+=( "S10_binaries_basic_check" "S15_radare_decompile_checks" "S99_grepit" "S110_yara_check" "F20_vul_aggregator" )
+export MODULE_BLACKLIST+=( "F10_license_summary" )

 # enable silent mode and status bar
 export DISABLE_STATUS_BAR=0
@@ -0,0 +1,4 @@
+/etc/passwd
+/etc/shadow
+/var/run/sshd.pid
+/root/.bash_history
@@ -0,0 +1,101 @@
+# EMBA - EMBEDDED LINUX ANALYZER
+#
+# Copyright 2026-2026 Siemens Energy AG
+#
+# EMBA comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
+# welcome to redistribute it under the terms of the GNU General Public License.
+# See LICENSE file for usage of this software.
+#
+# EMBA is licensed under GPLv3
+# SPDX-License-Identifier: GPL-3.0-only
+#
+
+# shellcheck disable=SC1091,SC2034
+
+load ../setup.bash
+
+setup() {
+  setup_emba_test_env
+  # shellcheck disable=SC1091
+  source "${HELP_DIR}/helpers_emba_defaults.sh"
+}
+
+teardown() {
+  teardown_emba_test_env
+}
+
+@test "set_defaults sets EMBA_VERSION" {
+  set_defaults
+  [[ -n "${EMBA_VERSION}" ]]
+  [[ "${EMBA_VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
+}
+
+@test "set_defaults sets RELEASE flag" {
+  set_defaults
+  [ "${RELEASE}" -eq 1 ]
+}
+
+@test "set_defaults sets default log directory" {
+  set_defaults
+  [[ "${LOG_DIR}" == *"/logs" ]]
+}
+
+@test "set_defaults sets THREADED default" {
+  set_defaults
+  [ "${THREADED}" -eq 1 ]
+}
+
+@test "set_defaults sets SHORT_PATH default" {
+  set_defaults
+  [ "${SHORT_PATH}" -eq 0 ]
+}
+
+@test "set_defaults sets RTOS default" {
+  set_defaults
+  [ "${RTOS}" -eq 1 ]
+}
+
+@test "set_defaults sets ARCH_CHECK default" {
+  set_defaults
+  [ "${ARCH_CHECK}" -eq 1 ]
+}
+
+@test "set_defaults sets MAX_EXT_CHECK_BINS" {
+  set_defaults
+  [ "${MAX_EXT_CHECK_BINS}" -eq 20 ]
+}
+
+@test "set_defaults sets DEEP_EXT_DEPTH" {
+  set_defaults
+  [ "${DEEP_EXT_DEPTH}" -eq 4 ]
+}
+
+@test "set_defaults sets SHELLCHECK default" {
+  set_defaults
+  [ "${SHELLCHECK}" -eq 1 ]
+}
+
+@test "set_defaults sets SBOM_MAX_FILE_LOG" {
+  set_defaults
+  [ "${SBOM_MAX_FILE_LOG}" -eq 200 ]
+}
+
+@test "set_defaults sets CPE_VERSION" {
+  set_defaults
+  [ "${CPE_VERSION}" = "2.3" ]
+}
+
+@test "set_defaults sets SBOM_LIFECYCLE_PHASE" {
+  set_defaults
+  [ "${SBOM_LIFECYCLE_PHASE}" = "operations" ]
+}
+
+@test "set_log_paths sets SBOM_LOG_PATH" {
+  set_log_paths
+  [[ "${SBOM_LOG_PATH}" == *"/SBOM" ]]
+}
+
+@test "set_log_paths sets S02_LOG path" {
+  set_log_paths
+  [[ "${S02_LOG}" == *"s02_uefi_fwhunt.txt" ]]
+}
@@ -0,0 +1,90 @@
+# EMBA - EMBEDDED LINUX ANALYZER
+#
+# Copyright 2026-2026 Siemens Energy AG
+#
+# EMBA comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
+# welcome to redistribute it under the terms of the GNU General Public License.
+# See LICENSE file for usage of this software.
+#
+# EMBA is licensed under GPLv3
+# SPDX-License-Identifier: GPL-3.0-only
+#
+
+# shellcheck disable=SC1091
+
+load ../setup.bash
+
+setup() {
+  setup_emba_test_env
+  # shellcheck disable=SC1091
+  source "${HELP_DIR}/helpers_emba_dependency_check.sh"
+}
+
+teardown() {
+  teardown_emba_test_env
+}
+
+@test "version formats single component" {
+  result="$(version "1")"
+  [ "${result}" = "1000000000" ]
+}
+
+@test "version formats two components" {
+  result="$(version "1.2")"
+  [ "${result}" = "1002000000" ]
+}
+
+@test "version formats three components" {
+  result="$(version "1.2.3")"
+  [ "${result}" = "1002003000" ]
+}
+
+@test "version formats four components" {
+  result="$(version "1.2.3.4")"
+  [ "${result}" = "1002003004" ]
+}
+
+@test "version handles leading zeros" {
+  result="$(version "0.1.0")"
+  [ "${result}" = "0001000000" ]
+}
+
+@test "version handles double digits" {
+  result="$(version "10.20.30")"
+  [ "${result}" = "10020030000" ]
+}
+
+@test "version sorts correctly (lower < higher)" {
+  local v1 v2
+  v1="$(version "2.1.0")"
+  v2="$(version "10.0.0")"
+  [ "${v1}" -lt "${v2}" ]
+}
+
+@test "version sorts correctly (equal)" {
+  local v1 v2
+  v1="$(version "2.1.0")"
+  v2="$(version "2.1.0")"
+  [ "${v1}" -eq "${v2}" ]
+}
+
+@test "check_emba_version detects current version" {
+  # shellcheck disable=SC2030,SC2031
+  export EMBA_VERSION="2.0.2"
+  run check_emba_version "2.0.2"
+  [ "${status}" -eq 0 ]
+  [[ "${output}" == *"ok"* ]]
+}
+
+@test "check_emba_version detects available update" {
+  # shellcheck disable=SC2030,SC2031
+  export EMBA_VERSION="2.0.2"
+  run check_emba_version "9.9.9"
+  [ "${status}" -eq 0 ]
+  [[ "${output}" == *"Updates available"* ]]
+}
+
+@test "check_emba_version handles empty input" {
+  run check_emba_version ""
+  [ "${status}" -eq 0 ]
+}
@@ -0,0 +1,71 @@
+# EMBA - EMBEDDED LINUX ANALYZER
+#
+# Copyright 2026-2026 Siemens Energy AG
+#
+# EMBA comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
+# welcome to redistribute it under the terms of the GNU General Public License.
+# See LICENSE file for usage of this software.
+#
+# EMBA is licensed under GPLv3
+# SPDX-License-Identifier: GPL-3.0-only
+#
+
+# shellcheck disable=SC1091
+
+load ../setup.bash
+
+setup() {
+  setup_emba_test_env
+  # shellcheck disable=SC1091
+  source "${HELP_DIR}/helpers_emba_print.sh"
+  # shellcheck disable=SC1091
+  source "${HELP_DIR}/helpers_emba_helpers.sh"
+}
+
+teardown() {
+  teardown_emba_test_env
+}
+
+@test "function_exists returns 0 for defined function" {
+  run function_exists "function_exists"
+  [ "${status}" -eq 0 ]
+}
+
+@test "function_exists returns non-zero for undefined function" {
+  run function_exists "nonexistent_func"
+  [ "${status}" -ne 0 ]
+}
+
+@test "backup_var appends to backup file" {
+  backup_var "TEST_VAR" "test_value"
+  grep -q 'export TEST_VAR="test_value"' "${LOG_DIR}/backup_vars.log"
+}
+
+@test "store_kill_pids creates pid file" {
+  store_kill_pids "12345"
+  [ -f "${TMP_DIR}/EXIT_KILL_PIDS.log" ]
+  grep -q "12345" "${TMP_DIR}/EXIT_KILL_PIDS.log"
+}
+
+@test "safe_logging writes to file via pipe" {
+  local lTEST_LOG="${LOG_DIR}/test_safe.log"
+  printf "%b" 'test message\n' | safe_logging "${lTEST_LOG}" 0
+  grep -q "test message" "${lTEST_LOG}"
+}
+
+@test "wait_for_pid handles empty array" {
+  run wait_for_pid
+  [ "${status}" -eq 0 ]
+}
+
+@test "cleaner handles 0 exit code" {
+  run cleaner 0
+  [ "${status}" -eq 0 ]
+}
+
+@test "max_pids_protection handles small pid count" {
+  # shellcheck disable=SC2034
+  declare -a lTEST_ARR=()
+  run max_pids_protection 5 lTEST_ARR
+  [ "${status}" -eq 0 ]
+}
@@ -0,0 +1,55 @@
+# EMBA - EMBEDDED LINUX ANALYZER
+#
+# Copyright 2026-2026 Siemens Energy AG
+#
+# EMBA comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
+# welcome to redistribute it under the terms of the GNU General Public License.
+# See LICENSE file for usage of this software.
+#
+# EMBA is licensed under GPLv3
+# SPDX-License-Identifier: GPL-3.0-only
+#
+
+# shellcheck disable=SC1091
+
+load ../setup.bash
+
+setup() {
+  setup_emba_test_env
+  # shellcheck disable=SC1091
+  source "${HELP_DIR}/helpers_emba_html_generator.sh"
+}
+
+teardown() {
+  teardown_emba_test_env
+}
+
+@test "strip_color_tags removes ANSI color codes" {
+  result="$(strip_color_tags $'\033[0;32mhello\033[0m')"
+  [ "${result}" = "hello" ]
+}
+
+@test "strip_color_tags handles plain text" {
+  result="$(strip_color_tags "plain text")"
+  [ "${result}" = "plain text" ]
+}
+
+@test "strip_color_tags removes multiple color codes" {
+  result="$(strip_color_tags $'\033[0;31mERROR\033[0m: \033[0;32mOK\033[0m')"
+  [ "${result}" = "ERROR: OK" ]
+}
+
+@test "strip_color_tags removes control characters" {
+  result="$(strip_color_tags $'line1\007line2')"
+  [ "${result}" = "line1line2" ]
+}
+
+@test "strip_color_tags handles empty input" {
+  result="$(strip_color_tags "")"
+  [ -z "${result}" ]
+}
+
+@test "strip_color_tags handles bold ANSI codes" {
+  result="$(strip_color_tags $'\033[1mBOLD\033[0m')"
+  [ "${result}" = "BOLD" ]
+}
@@ -0,0 +1,118 @@
+# EMBA - EMBEDDED LINUX ANALYZER
+#
+# Copyright 2026-2026 Siemens Energy AG
+#
+# EMBA comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
+# welcome to redistribute it under the terms of the GNU General Public License.
+# See LICENSE file for usage of this software.
+#
+# EMBA is licensed under GPLv3
+# SPDX-License-Identifier: GPL-3.0-only
+#
+
+# shellcheck disable=SC1091,SC2034
+
+load ../setup.bash
+
+setup() {
+  setup_emba_test_env
+  # shellcheck disable=SC1091
+  source "${HELP_DIR}/helpers_emba_path.sh"
+}
+
+teardown() {
+  teardown_emba_test_env
+}
+
+@test "abs_path returns realpath for existing file" {
+  local lTMP_FILE="${LOG_DIR}/test_file"
+  touch "${lTMP_FILE}"
+  result="$(abs_path "${lTMP_FILE}")"
+  [[ "${result}" == "/tmp/emba_test_"*"/test_file" ]]
+}
+
+@test "abs_path returns input for non-existing path" {
+  result="$(abs_path "/nonexistent/path")"
+  [ "${result}" = "/nonexistent/path" ]
+}
+
+@test "abs_path handles empty input" {
+  result="$(abs_path "")"
+  [ "${result}" = "" ]
+}
+
+@test "config_list reads config file" {
+  local lTEST_CFG="${LOG_DIR}/test_config.cfg"
+  printf '%s\n' "item1" "item2" "item3" >"${lTEST_CFG}"
+  run config_list "${lTEST_CFG}"
+  [ "${status}" -eq 0 ]
+  [[ "${output}" == *"item1"* ]]
+  [[ "${output}" == *"item2"* ]]
+  [[ "${output}" == *"item3"* ]]
+}
+
+@test "config_list returns C_N_F for missing file" {
+  result="$(config_list "/nonexistent/file.cfg")"
+  [ "${result}" = "C_N_F" ]
+}
+
+@test "config_list handles empty config file" {
+  local lEMPTY_CFG="${LOG_DIR}/empty.cfg"
+  touch "${lEMPTY_CFG}"
+  result="$(config_list "${lEMPTY_CFG}")"
+  [ -z "${result}" ]
+}
+
+@test "config_find returns C_N_F for missing config" {
+  result="$(config_find "/nonexistent/file.cfg")"
+  [ "${result}" = "C_N_F" ]
+}
+
+@test "config_grep returns C_N_F for missing config" {
+  result="$(config_grep "/nonexistent/file.cfg" "/tmp")"
+  [ "${result}" = "C_N_F" ]
+}
+
+@test "config_grep_string returns C_N_F for missing config" {
+  result="$(config_grep_string "/nonexistent/file.cfg" "test")"
+  [ "${result}" = "C_N_F" ]
+}
+
+@test "cut_path returns absolute path for SHORT_PATH=0" {
+  SHORT_PATH=0
+  result="$(cut_path "/some/long/path/file.txt")"
+  [ "${result}" = "/some/long/path/file.txt" ]
+}
+
+@test "print_path returns path with attributes" {
+  local lTMP_FILE="${LOG_DIR}/test_print"
+  touch "${lTMP_FILE}"
+  result="$(print_path "${lTMP_FILE}")"
+  [ -n "${result}" ]
+}
+
+@test "permission_clean returns permissions string" {
+  local lTMP_FILE="${LOG_DIR}/test_perm"
+  touch "${lTMP_FILE}"
+  result="$(permission_clean "${lTMP_FILE}")"
+  [[ "${result}" =~ ^[drwx-]{10} ]]
+}
+
+@test "owner_clean returns owner string" {
+  local lTMP_FILE="${LOG_DIR}/test_owner"
+  touch "${lTMP_FILE}"
+  result="$(owner_clean "${lTMP_FILE}")"
+  [ -n "${result}" ]
+}
+
+@test "group_clean returns group string" {
+  local lTMP_FILE="${LOG_DIR}/test_group"
+  touch "${lTMP_FILE}"
+  result="$(group_clean "${lTMP_FILE}")"
+  [ -n "${result}" ]
+}
+
+@test "check_path_valid does not fail for empty input" {
+  run check_path_valid ""
+  [ "${status}" -eq 0 ]
+}
@@ -0,0 +1,65 @@
+# EMBA - EMBEDDED LINUX ANALYZER
+#
+# Copyright 2026-2026 Siemens Energy AG
+#
+# EMBA comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
+# welcome to redistribute it under the terms of the GNU General Public License.
+# See LICENSE file for usage of this software.
+#
+# EMBA is licensed under GPLv3
+# SPDX-License-Identifier: GPL-3.0-only
+#
+
+# shellcheck disable=SC1091
+
+load ../setup.bash
+
+setup() {
+  setup_emba_test_env
+  # shellcheck disable=SC1091
+  source "${HELP_DIR}/helpers_emba_prepare.sh"
+}
+
+teardown() {
+  teardown_emba_test_env
+}
+
+@test "convert_timeformat converts days to seconds" {
+  result="$(convert_timeformat "2d")"
+  [ "${result}" = "$((2 * 24 * 3600))" ]
+}
+
+@test "convert_timeformat converts hours to seconds" {
+  result="$(convert_timeformat "5h")"
+  [ "${result}" = "$((5 * 3600))" ]
+}
+
+@test "convert_timeformat converts minutes to seconds" {
+  result="$(convert_timeformat "30m")"
+  [ "${result}" = "$((30 * 60))" ]
+}
+
+@test "convert_timeformat returns seconds unchanged" {
+  result="$(convert_timeformat "45s")"
+  [ "${result}" = "45" ]
+}
+
+@test "convert_timeformat handles combined format (days)" {
+  result="$(convert_timeformat "1d")"
+  [ "${result}" = "86400" ]
+}
+
+@test "convert_timeformat handles empty input" {
+  result="$(convert_timeformat "")"
+  [ -z "${result}" ]
+}
+
+@test "convert_timeformat handles plain number as seconds" {
+  result="$(convert_timeformat "60")"
+  [ "${result}" = "60" ]
+}
+
+@test "convert_timeformat handles zero" {
+  result="$(convert_timeformat "0s")"
+  [ "${result}" = "0" ]
+}
@@ -0,0 +1,185 @@
+# EMBA - EMBEDDED LINUX ANALYZER
+#
+# Copyright 2026-2026 Siemens Energy AG
+#
+# EMBA comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
+# welcome to redistribute it under the terms of the GNU General Public License.
+# See LICENSE file for usage of this software.
+#
+# EMBA is licensed under GPLv3
+# SPDX-License-Identifier: GPL-3.0-only
+#
+
+# shellcheck disable=SC1091,SC2034
+
+load ../setup.bash
+
+setup() {
+  setup_emba_test_env
+  # shellcheck disable=SC1091
+  source "${HELP_DIR}/helpers_emba_print.sh"
+}
+
+teardown() {
+  teardown_emba_test_env
+}
+
+@test "strip_color_codes removes ANSI escape sequences" {
+  result="$(strip_color_codes $'\033[0;32mhello\033[0m')"
+  [ "${result}" = "hello" ]
+}
+
+@test "strip_color_codes handles multiple color codes" {
+  result="$(strip_color_codes $'\033[0;31mERROR\033[0m: \033[0;32mOK\033[0m')"
+  [ "${result}" = "ERROR: OK" ]
+}
+
+@test "strip_color_codes handles plain text unchanged" {
+  result="$(strip_color_codes 'plain text')"
+  [ "${result}" = "plain text" ]
+}
+
+@test "strip_color_codes handles empty input" {
+  result="$(strip_color_codes '')"
+  [ "${result}" = "" ]
+}
+
+@test "escape_echo escapes special characters" {
+  result="$(escape_echo 'hello; rm -rf /')"
+  [[ "${result}" == *'hello'* ]]
+  [[ "${result}" == *'rm'* ]]
+}
+
+@test "escape_echo handles simple strings" {
+  result="$(escape_echo 'abc123')"
+  [[ "${result}" == *'abc123'* ]]
+}
+
+@test "check_int accepts valid integers" {
+  run check_int "42"
+  [ "${status}" -eq 0 ]
+}
+
+@test "check_int rejects non-integers" {
+  run check_int "abc"
+  [ "${status}" -eq 1 ]
+}
+
+@test "check_int accepts empty input" {
+  run check_int ""
+  [ "${status}" -eq 0 ]
+}
+
+@test "check_alnum accepts alphanumeric" {
+  run check_alnum "abc123"
+  [ "${status}" -eq 0 ]
+}
+
+@test "check_alnum rejects special chars" {
+  run check_alnum "abc-123"
+  [ "${status}" -eq 1 ]
+}
+
+@test "check_vendor accepts valid vendor names" {
+  run check_vendor "MyVendor_123"
+  [ "${status}" -eq 0 ]
+}
+
+@test "check_vendor rejects invalid vendor names" {
+  run check_vendor "vendor space"
+  [ "${status}" -eq 1 ]
+}
+
+@test "safe_echo outputs string" {
+  result="$(safe_echo "test")"
+  [ -n "${result}" ]
+}
+
+@test "format_log strips ANSI codes when FORMAT_LOG=0" {
+  FORMAT_LOG=0
+  result="$(format_log $'\\033[0;32mtest\\033[0m')"
+  [[ "${result}" != *'033'* ]]
+}
+
+@test "format_log preserves ANSI codes when FORMAT_LOG=1" {
+  FORMAT_LOG=1
+  result="$(format_log $'\\033[0;32mtest\\033[0m')"
+  [ -n "${result}" ]
+}
+
+@test "print_ln outputs newline" {
+  run print_ln "no_log"
+  [ "${status}" -eq 0 ]
+}
+
+@test "print_date returns a date string" {
+  result="$(print_date)"
+  [ -n "${result}" ]
+}
+
+@test "show_runtime returns duration" {
+  SECONDS=3661
+  result="$(show_runtime 1)"
+  [ -n "${result}" ]
+}
+
+@test "indent prepends spaces" {
+  result="$(indent "hello")"
+  [[ "${result}" == *"hello"* ]]
+}
+
+@test "white wraps text in NC tags" {
+  result="$(white "test")"
+  [[ "${result}" == *"test"* ]]
+}
+
+@test "red wraps text in RED tags" {
+  result="$(red "error")"
+  [[ "${result}" == *"error"* ]]
+}
+
+@test "green wraps text in GREEN tags" {
+  result="$(green "ok")"
+  [[ "${result}" == *"ok"* ]]
+}
+
+@test "check_path_input accepts valid paths" {
+  run check_path_input "/home/user/test"
+  [ "${status}" -eq 0 ]
+}
+
+@test "check_path_input rejects invalid chars" {
+  run check_path_input "/home/user/test|bad"
+  [ "${status}" -eq 1 ]
+}
+
+@test "color_output formats [-] as red" {
+  result="$(color_output "[-] error msg")"
+  [[ "${result}" == *"error msg"* ]]
+}
+
+@test "color_output formats [+] as green" {
+  result="$(color_output "[+] success msg")"
+  [[ "${result}" == *"success msg"* ]]
+}
+
+@test "color_output formats [*] as orange" {
+  result="$(color_output "[*] info msg")"
+  [[ "${result}" == *"info msg"* ]]
+}
+
+@test "format_grep_log strips ANSI codes" {
+  result="$(format_grep_log "test")"
+  [ -n "${result}" ]
+}
+
+@test "reset_module_count resets counter" {
+  SUB_MODULE_COUNT=5
+  reset_module_count
+  [ "${SUB_MODULE_COUNT}" -eq 0 ]
+}
+
+@test "secure_sleep handles zero time" {
+  run secure_sleep 0
+  [ "${status}" -eq 0 ]
+}
@@ -0,0 +1,148 @@
+# EMBA - EMBEDDED LINUX ANALYZER
+#
+# Copyright 2026-2026 Siemens Energy AG
+#
+# EMBA comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
+# welcome to redistribute it under the terms of the GNU General Public License.
+# See LICENSE file for usage of this software.
+#
+# EMBA is licensed under GPLv3
+# SPDX-License-Identifier: GPL-3.0-only
+#
+
+# shellcheck disable=SC1091
+
+load ../setup.bash
+
+setup() {
+  setup_emba_test_env
+  # shellcheck disable=SC1091
+  source "${HELP_DIR}/helpers_emba_print.sh"
+  # shellcheck disable=SC1091
+  source "${HELP_DIR}/helpers_emba_sbom_helpers.sh"
+}
+
+teardown() {
+  teardown_emba_test_env
+}
+
+@test "build_purl_identifier builds basic purl" {
+  result="$(build_purl_identifier "NA" "deb" "curl" "7.68.0" "")"
+  [ "${result}" = "pkg:deb/generic/[email protected]" ]
+}
+
+@test "build_purl_identifier includes arch" {
+  result="$(build_purl_identifier "NA" "deb" "curl" "7.68.0" "amd64")"
+  [[ "${result}" == *"?arch=amd64"* ]]
+}
+
+@test "build_purl_identifier handles no version" {
+  result="$(build_purl_identifier "NA" "deb" "curl" "" "")"
+  [ "${result}" = "pkg:deb/generic/curl" ]
+}
+
+@test "build_purl_identifier replaces spaces in arch" {
+  result="$(build_purl_identifier "NA" "deb" "curl" "1.0" "mips 32")"
+  [[ "${result}" == *"?arch=mips-32"* ]]
+}
+
+@test "build_purl_identifier includes distro for non-generic" {
+  result="$(build_purl_identifier "ubuntu" "deb" "curl" "7.68.0" "")"
+  [[ "${result}" == *"distro=ubuntu"* ]]
+}
+
+@test "build_purl_identifier handles -based distro" {
+  result="$(build_purl_identifier "debian-based" "deb" "curl" "7.0" "")"
+  [[ "${result}" != *"distro"* ]]
+}
+
+@test "build_purl_identifier purl has correct prefix" {
+  result="$(build_purl_identifier "ubuntu" "deb" "bash" "5.0" "amd64")"
+  [[ "${result}" == "pkg:deb/ubuntu/[email protected]?arch=amd64&distro=ubuntu" ]]
+}
+
+@test "get_confidence_string maps 1 to very-low" {
+  result="$(get_confidence_string 1)"
+  [ "${result}" = "very-low" ]
+}
+
+@test "get_confidence_string maps 2 to low" {
+  result="$(get_confidence_string 2)"
+  [ "${result}" = "low" ]
+}
+
+@test "get_confidence_string maps 3 to medium" {
+  result="$(get_confidence_string 3)"
+  [ "${result}" = "medium" ]
+}
+
+@test "get_confidence_string maps 4 to high" {
+  result="$(get_confidence_string 4)"
+  [ "${result}" = "high" ]
+}
+
+@test "get_confidence_string returns NA for unknown" {
+  result="$(get_confidence_string 99)"
+  [ "${result}" = "NA" ]
+}
+
+@test "get_confidence_string defaults to medium for empty input" {
+  result="$(get_confidence_string "")"
+  [ "${result}" = "medium" ]
+}
+
+@test "get_confidence_value maps very-low to 1" {
+  result="$(get_confidence_value "very-low")"
+  [ "${result}" = "1" ]
+}
+
+@test "get_confidence_value maps low to 2" {
+  result="$(get_confidence_value "low")"
+  [ "${result}" = "2" ]
+}
+
+@test "get_confidence_value maps medium to 3" {
+  result="$(get_confidence_value "medium")"
+  [ "${result}" = "3" ]
+}
+
+@test "get_confidence_value maps high to 4" {
+  result="$(get_confidence_value "high")"
+  [ "${result}" = "4" ]
+}
+
+@test "get_confidence_value returns 99 for unknown" {
+  result="$(get_confidence_value "critical")"
+  [ "${result}" = "99" ]
+}
+
+@test "get_confidence_value returns 99 for empty input" {
+  result="$(get_confidence_value "")"
+  [ "${result}" = "99" ]
+}
+
+@test "validate_xml rejects DOCTYPE" {
+  local lXML="${LOG_DIR}/test.xml"
+  echo '<!DOCTYPE foo>' >"${lXML}"
+  run validate_xml "${lXML}"
+  [ "${status}" -eq 1 ]
+}
+
+@test "validate_xml rejects ENTITY" {
+  local lXML="${LOG_DIR}/test.xml"
+  echo '<!ENTITY foo>' >"${lXML}"
+  run validate_xml "${lXML}"
+  [ "${status}" -eq 1 ]
+}
+
+@test "validate_xml accepts clean xml" {
+  local lXML="${LOG_DIR}/test.xml"
+  echo '<root><item/></root>' >"${lXML}"
+  run validate_xml "${lXML}"
+  [ "${status}" -eq 0 ]
+}
+
+@test "validate_xml handles missing file" {
+  run validate_xml "${LOG_DIR}/nonexistent.xml"
+  [ "${status}" -eq 0 ]
+}
@@ -0,0 +1,50 @@
+# EMBA - EMBEDDED LINUX ANALYZER
+#
+# Copyright 2026-2026 Siemens Energy AG
+#
+# EMBA comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
+# welcome to redistribute it under the terms of the GNU General Public License.
+# See LICENSE file for usage of this software.
+#
+# EMBA is licensed under GPLv3
+# SPDX-License-Identifier: GPL-3.0-only
+#
+
+# shellcheck disable=SC1091
+
+load ../setup.bash
+
+setup() {
+  setup_emba_test_env
+  # shellcheck disable=SC1091
+  source "${HELP_DIR}/helpers_emba_status_bar.sh"
+}
+
+teardown() {
+  teardown_emba_test_env
+}
+
+@test "repeat_char repeats single char" {
+  result="$(repeat_char "-" 5)"
+  [ "${result}" = "-----" ]
+}
+
+@test "repeat_char repeats multiple chars" {
+  result="$(repeat_char "=>" 3)"
+  [ "${result}" = "=>=>=>" ]
+}
+
+@test "repeat_char handles zero count" {
+  result="$(repeat_char "-" 0)"
+  [ -z "${result}" ]
+}
+
+@test "repeat_char handles empty char" {
+  result="$(repeat_char "" 5)"
+  [ -z "${result}" ]
+}
+
+@test "repeat_char handles large count" {
+  result="$(repeat_char "x" 100)"
+  [ "${#result}" -eq 100 ]
+}
@@ -0,0 +1,48 @@
+# EMBA - EMBEDDED LINUX ANALYZER
+#
+# Copyright 2026-2026 Siemens Energy AG
+#
+# EMBA comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
+# welcome to redistribute it under the terms of the GNU General Public License.
+# See LICENSE file for usage of this software.
+#
+# EMBA is licensed under GPLv3
+# SPDX-License-Identifier: GPL-3.0-only
+#
+
+# shellcheck disable=SC1091
+
+load ../setup.bash
+
+setup() {
+  setup_emba_test_env
+  export DEBUG_SCRIPT=0
+  # shellcheck disable=SC1091
+  source "${HELP_DIR}/helpers_emba_load_strict_settings.sh"
+}
+
+teardown() {
+  teardown_emba_test_env
+}
+
+@test "load_strict_mode_settings enables shell strict mode" {
+  run load_strict_mode_settings
+  [ "${status}" -eq 0 ]
+}
+
+@test "enable_strict_mode does nothing when STRICT_MODE=0" {
+  run enable_strict_mode 0 0
+  [ "${status}" -eq 0 ]
+  [[ "${output}" == "" ]]
+}
+
+@test "disable_strict_mode does nothing when STRICT_MODE=0" {
+  run disable_strict_mode 0 0
+  [ "${status}" -eq 0 ]
+  [[ "${output}" == "" ]]
+}
+
+@test "disable_strict_mode with lPRINTER=0 suppresses output" {
+  run disable_strict_mode 1 0
+  [ "${status}" -eq 0 ]
+}
@@ -0,0 +1,29 @@
+#!/bin/bash -p
+
+# EMBA - EMBEDDED LINUX ANALYZER
+#
+# Copyright 2026-2026 Siemens Energy AG
+#
+# EMBA comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
+# welcome to redistribute it under the terms of the GNU General Public License.
+# See LICENSE file for usage of this software.
+#
+# EMBA is licensed under GPLv3
+# SPDX-License-Identifier: GPL-3.0-only
+#
+
+create_mock_firmware() {
+  local lFW_DIR="${1:-/tmp/test_fw}"
+  if [[ -z "${lFW_DIR}" || "${lFW_DIR}" == "/" || "${lFW_DIR}" == "/tmp" || "${lFW_DIR}" != /tmp/* ]]; then
+    echo "Refusing to create mock firmware in unsafe directory: ${lFW_DIR}" >&2
+    return 1
+  fi
+  rm -rf "${lFW_DIR}"
+  mkdir -p "${lFW_DIR}/bin" "${lFW_DIR}/etc" "${lFW_DIR}/lib" "${lFW_DIR}/usr/bin"
+  echo "#!/bin/sh" >"${lFW_DIR}/bin/busybox"
+  echo "root:x:0:0:root:/root:/bin/sh" >"${lFW_DIR}/etc/passwd"
+  echo "#!/bin/sh" >"${lFW_DIR}/usr/bin/test_script.sh"
+  chmod +x "${lFW_DIR}/bin/busybox" "${lFW_DIR}/usr/bin/test_script.sh"
+  echo "mock libc" >"${lFW_DIR}/lib/libc.so.6"
+  echo "${lFW_DIR}"
+}
@@ -0,0 +1,106 @@
+# EMBA - EMBEDDED LINUX ANALYZER
+#
+# Copyright 2026-2026 Siemens Energy AG
+#
+# EMBA comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
+# welcome to redistribute it under the terms of the GNU General Public License.
+# See LICENSE file for usage of this software.
+#
+# EMBA is licensed under GPLv3
+# SPDX-License-Identifier: GPL-3.0-only
+#
+
+# shellcheck disable=SC1091
+
+load ../setup.bash
+
+setup() {
+  setup_emba_test_env
+  # shellcheck disable=SC1091
+  source "${HELP_DIR}/helpers_emba_print.sh"
+  # shellcheck disable=SC1091
+  source "${HELP_DIR}/helpers_emba_path.sh"
+}
+
+teardown() {
+  teardown_emba_test_env
+}
+
+@test "module_log_init creates LOG_FILE from function name" {
+  module_log_init "S01_test_module"
+  [[ "${LOG_FILE}" == *"s01_test_module.txt" ]]
+}
+
+@test "module_log_init sets LOG_FILE variable" {
+  module_log_init "S01_test_module"
+  [ -n "${LOG_FILE}" ]
+  [[ "${LOG_FILE}" == *"s01_test_module.txt" ]]
+}
+
+@test "module_log_init handles uppercase function name" {
+  module_log_init "F50_BASE_AGGREGATOR"
+  [[ "${LOG_FILE_NAME}" == "f50_base_aggregator.txt" ]]
+}
+
+@test "module_title writes formatted title" {
+  module_log_init "S01_test"
+  run module_title "Test Module"
+  [ "${status}" -eq 0 ]
+}
+
+@test "sub_module_title writes formatted sub-title" {
+  module_log_init "S01_test"
+  run sub_module_title "Sub Test"
+  [ "${status}" -eq 0 ]
+}
+
+@test "module_end_log reports nothing for state 0" {
+  module_log_init "S01_test"
+  run module_end_log "S01_test" 0
+  [ "${status}" -eq 0 ]
+}
+
+@test "module_end_log reports finish for state 1" {
+  module_log_init "S01_test"
+  run module_end_log "S01_test" 1
+  [ "${status}" -eq 0 ]
+}
+
+@test "pre_module_reporter runs without error" {
+  run pre_module_reporter "S01_test"
+  [ "${status}" -eq 0 ]
+}
+
+@test "module_start_log runs without error" {
+  run module_start_log "S01_test"
+  [ "${status}" -eq 0 ]
+}
+
+@test "write_log writes to specified file" {
+  local lTEST_LOG="${LOG_DIR}/write_test.log"
+  write_log "test entry" "${lTEST_LOG}"
+  grep -q "test entry" "${lTEST_LOG}"
+}
+
+@test "write_csv_log writes CSV line" {
+  module_log_init "S01_test"
+  local lCSV_FILE="${CSV_DIR}/s01_test.csv"
+  write_csv_log "col1" "col2" "col3"
+  [ -f "${lCSV_FILE}" ]
+  grep -q "col1;col2;col3" "${lCSV_FILE}"
+}
+
+@test "multiple module_log_init creates backup of old log" {
+  module_log_init "S01_test"
+  local lFIRST_LOG="${LOG_FILE}"
+  echo "old content" >"${lFIRST_LOG}"
+  module_log_init "S01_test"
+  local lFOUND_BACKUPS
+  lFOUND_BACKUPS=$(find "${LOG_DIR}" -name "s01_test.txt.bak.*" 2>/dev/null | wc -l)
+  [ "${lFOUND_BACKUPS}" -ge 1 ]
+}
+
+@test "write_notification runs without error" {
+  run write_notification "test notification"
+  [ "${status}" -eq 0 ]
+}
@@ -0,0 +1,51 @@
+#!/bin/bash -p
+
+# EMBA - EMBEDDED LINUX ANALYZER
+#
+# Copyright 2026-2026 Siemens Energy AG
+#
+# EMBA comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
+# welcome to redistribute it under the terms of the GNU General Public License.
+# See LICENSE file for usage of this software.
+#
+# EMBA is licensed under GPLv3
+# SPDX-License-Identifier: GPL-3.0-only
+#
+
+set -e
+
+INVOCATION_PATH="$(cd "$(dirname "${0}")" && pwd)"
+BATS_BIN="${INVOCATION_PATH}/bats-core/bin/bats"
+
+if ! [[ -x "${BATS_BIN}" ]]; then
+  echo "[-] bats not found at ${BATS_BIN}"
+  echo "[*] Install it via: cd tests && curl -sL https://github.com/bats-core/bats-core/archive/refs/tags/v1.11.0.tar.gz | tar xz && mv bats-core-1.11.0 bats-core"
+  echo "[*]   or: sudo apt-get install bats"
+  exit 1
+fi
+
+echo "==================================="
+echo " EMBA Unit Tests (bats)"
+echo "==================================="
+echo ""
+
+TOTAL=0
+PASSED=0
+FAILED=0
+
+while IFS= read -r -d '' TEST_FILE; do
+  echo "--- Running: $(basename "${TEST_FILE}") ---"
+  if "${BATS_BIN}" "${TEST_FILE}"; then
+    PASSED=$((PASSED + 1))
+  else
+    FAILED=$((FAILED + 1))
+  fi
+  TOTAL=$((TOTAL + 1))
+  echo ""
+done < <(find "${INVOCATION_PATH}" -name 'bats-core' -prune -o -name '*.bats' -print0)
+
+echo "==================================="
+echo " Results: ${PASSED}/${TOTAL} passed, ${FAILED} failed"
+echo "==================================="
+
+exit ${FAILED}
@@ -0,0 +1,61 @@
+#!/bin/bash -p
+
+# EMBA - EMBEDDED LINUX ANALYZER
+#
+# Copyright 2026-2026 Siemens Energy AG
+#
+# EMBA comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
+# welcome to redistribute it under the terms of the GNU General Public License.
+# See LICENSE file for usage of this software.
+#
+# EMBA is licensed under GPLv3
+# SPDX-License-Identifier: GPL-3.0-only
+#
+
+setup_emba_test_env() {
+  # BATS_TEST_FILENAME is tests/helpers/foo.bats or tests/modules/foo.bats
+  # Go up 2 levels to reach repo root
+  local lTEST_DIR
+  lTEST_DIR="$(cd "$(dirname "${BATS_TEST_FILENAME}")/../.." && pwd)"
+  export INVOCATION_PATH="${lTEST_DIR}"
+  export HELP_DIR="${INVOCATION_PATH}/helpers"
+  export CONFIG_DIR="${INVOCATION_PATH}/config"
+  export MOD_DIR="${INVOCATION_PATH}/modules"
+  export EXT_DIR="${INVOCATION_PATH}/external"
+
+  local lTMP_LOG_DIR
+  lTMP_LOG_DIR="$(mktemp -d /tmp/emba_test_XXXXXX)"
+  export LOG_DIR="${lTMP_LOG_DIR}"
+  export TMP_DIR="${LOG_DIR}/tmp"
+  export CSV_DIR="${LOG_DIR}/csv_logs"
+  export BASIC_DATA_LOG_DIR="${LOG_DIR}/basic_data"
+  export MAIN_LOG_FILE="emba.log"
+  export MAIN_LOG="${LOG_DIR}/${MAIN_LOG_FILE}"
+  mkdir -p "${TMP_DIR}" "${CSV_DIR}" "${BASIC_DATA_LOG_DIR}"
+
+  export FIRMWARE_PATH="/tmp/test_fw"
+  export RTOS=1
+  export ARCH=""
+  export THREADED=0
+  export HTML=0
+  export SHORT_PATH=0
+  export FORMAT_LOG=0
+  export DISABLE_NOTIFICATIONS=1
+  export DEBUG=0
+  export LOG_FILE="${LOG_DIR}/test_module.txt"
+
+  export GREEN='\033[0;32m'
+  export RED='\033[0;31m'
+  export ORANGE='\033[0;33m'
+  export BLUE='\033[0;34m'
+  export BOLD='\033[1m'
+  export NC='\033[0m'
+  export CYAN='\033[0;36m'
+  export MAGENTA='\033[0;35m'
+}
+
+teardown_emba_test_env() {
+  if [[ -n "${LOG_DIR-}" && "${LOG_DIR}" == /tmp/emba_test_* ]]; then
+    rm -rf "${LOG_DIR}" 2>/dev/null || true
+  fi
+}