New! PHP2Shell: Successful exploitation observed against a vulnerable GreyNoise sensor
Voluntary Product Accessibility Template (VPAT)
GreyNoise is committed to making its information and communication technologies accessible to individuals with disabilities, and evaluates its products against the Web Content Accessibility Guidelines (WCAG) 2.2 Levels A and AA.
Section 508 is a federal law that requires agencies to provide individuals with disabilities equal access to electronic information and data comparable to those who do not have disabilities. The Section 508 standards are the technical requirements and criteria that are used to measure conformance within this law. More information on Section 508 and the technical standards can be found at Section508.gov.
The WCAG guidelines are the technical requirements and criteria that are used to measure conformance as specified by the World Wide Web Consortium (W3C). The W3C is an international community that develops open standards to ensure the long-term growth of the Web. More information on WCAG and the technical standards can be found at W3C.
The purpose of the Voluntary Product Accessibility Template, or VPAT™, WCAG Version 2.2, is to assist Federal contracting officials and other buyers in making preliminary assessments regarding the availability of commercial “Electronic and Information Technology” products and services with features that support accessibility.
The first table of the Template provides a summary view of the Standards and Levels of Conformance. The subsequent tables provide more detailed views of each subsection.
Product Name: GreyNoise Visualizer (Classic and Modern)
Report Date: October 26, 2026 - Version 03
Applications: GreyNoise Visualizer is available in two interfaces, assessed separately. Classic Visualizer is the older interface and is being deprecated. Modern Visualizer is the new interface and the default for new users. Where ratings differ, the remarks note which interface each applies to.
Scope: The Classic and Modern Visualizer web applications, including navigation, account, help and contact support, IP analysis, CVEs, Sessions, tags, dashboards and management forms. Separately delivered applications, PDF documents and Level AAA criteria are not assessed.
Testing Tools and Methods used:
"If there is no content to which a success criterion applies, the success criterion is satisfied."
This VPAT shows such criterion as: “N/A”
https://www.w3.org/WAI/WCAG22/Understanding/conformance
“AT” stands for Assistive Technology such as screen readers, voice input, etc
This report covers the degree of conformance for the following accessibility standard/guidelines:
The terms used in the Conformance Level information are defined as follows:
Partially Supports
Most data views provide text or table equivalents, such as Trust List values.
Exceptions: hourly activity charts (Classic: NTP Protocol; Modern: Web Crawler) do not provide an equivalent text presentation of the hourly profile.
1.2.1: Audio-only or Video-only (Prerecorded)
(Level A)
Provide alternatives for pre-recorded audio-only or video- only content.
N/A
No prerecorded audio-only or video-only content in the assessed applications.
N/A
No prerecorded audio requiring captions in the assessed applications.
1.2.3: Audio Description or Media Alternative (Prerecorded)
(Level A)
Provide alternatives for pre-recorded synchronized audio/video.
N/A
No prerecorded synchronized media requiring an audio description or media alternative in the assessed applications.
1.3.1: Information and Relationships
(Level A)
Info, structure, and relationships can be pro-grammatically determined.
Supports
Form labels, table headers (including sort direction) and grouped controls expose their relationships programmatically.
(Level A)
The correct reading sequence can be pro-grammatically determined.
Supports
Content and controls follow a meaningful visual and reading order.
1.3.3: Sensory Characteristics
(Level A)
Do not rely on Sensory characteristics of components such as shape, size, visual Location, orientation, or sound.
Supports
Instructions identify actions and controls in words and do not rely solely on shape, location or sound.
Classic: Partially Supports
Modern: Supports
On the first page of paginated results, the current page and unavailable actions are indicated by color alone.
Charts and data selections convey meaning through text or shape as well as color.
N/A
No audio plays automatically.
(Level A)
All functionality is available from a keyboard, except for tasks such as drawing.
Partially Supports
Most navigation and controls are keyboard operable.
Exceptions: selecting an individual hour on activity charts (Classic: NTP Protocol; Modern: Web Crawler) requires a pointer, with no keyboard equivalent.
(Level A)
The user can use the keyboard to move through page elements and is not trapped on a particular element.
Supports
No keyboard traps were found. Search suggestions, dialogs and menus can be exited using the keyboard.
(Level A)
If a keyboard shortcut is implemented in content using only letter (including upper- and lower- case letters), punctuation, number, or symbol characters, then at least one of the following is true: Turn off, Remap, Active only on focus.
N/A
Does not contain character-only keyboard shortcuts; global commands use modifier keys.
(Level A)
Users are warned of time limits shorter than 20 hours and time limits can be turned off or extended.
Supports
Sign-in sessions renew silently in the background, and the only user-facing time limits are longer than 20 hours.
(Level A)
Users can stop, pause, or hide moving, blinking, scrolling, or auto- updating information.
Classic: Supports
Modern: Partially Supports
Displayed information does not update automatically; Sessions Live updates start only when the user turns them on.
Exceptions: on the Sensors page, displayed sensor cards are periodically replaced by a loading state and then restored, with no control to pause or stop these updates.
2.3.1 Three Flashes or Below Threshold
(Level A)
No more than three flashes in a 1- second period, or the flashes are below the defined thresholds.
Supports
No flashing content was identified.
Supports
Each page exposes a main landmark, allowing users of assistive technology to bypass the repeated navigation.
Classic: Partially Supports
Modern: Supports
Intelligence detail pages (such as IP, CVE and Tag) have descriptive titles.
Exceptions: the Account page and some management and publication catalog pages use a generic application title.
Pages have descriptive titles, including Account Settings, Threat Briefs and intelligence detail pages.
Partially Supports
Tab order is logical on most pages.
Classic – Saved dashboards: after opening Browse saved dashboards, focus moves through background content before reaching the drawer.
Modern – Narrow-screen navigation: with the navigation menu open, focus moves to Search behind the menu.
2.4.4: Link Purpose (In Context)
(Level A)
The purpose of each link can be determined from the link text or surrounding context.
Supports
Links identify their purpose through their text or surrounding context, including publication cards and the publication reader.
(Level A)
All functionality that uses multi-point or path-based gestures for operation can be operated with a single pointer without a path- based gesture, unless a multi-point or path-based gestures are essential.
Supports
All functionality works with single-pointer actions; no multi-point or path-based gestures are required.
(Level A)
For functionality that can be operated using a single pointer, at least one of the following is true:
Supports
Pointer actions complete on release and can be cancelled, including dashboard movement and chart range selection.
(Level A)
For user interface components with labels that include text or images of text, the name contains the text that is presented visually.
Supports
Visible labels are included in the accessible names of controls, including fields, buttons and selectors.
(Level A)
Functionality that can be operated by device motion or user motion can also be operated by user interface components and responding to the motion can be disabled to prevent accidental actuation, except when:
N/A
No functionality is operated by device or user motion.
Classic: Partially Supports
Modern: Supports
Application pages declare English as the page language.
Exceptions: the Available Upgrades error page does not declare a page language.
All pages, including error pages, declare English as the page language.
(Level A)
When a UI component receives focus, this does not trigger unexpected actions.
Supports
Receiving focus does not trigger navigation or submission; actions require explicit activation.
(Level A)
Changing the setting of a checkbox, radio button, or other UI component does not trigger unexpected changes in context.
Supports
Changing a setting does not cause an unexpected change of context; explicit commands are used to advance or submit.
(Level A)
Help mechanisms that repeat across pages appear in the same relative order.
Supports
Help is in a consistent location across pages (Classic: the account menu; Modern: the footer) and provides access to documentation and the contact form.
Supports
The Help and Contact support forms identify missing required fields with adjacent error text.
3.3.2: Labels and Instructions
(Level A)
Items requiring user input are clearly labeled or have clear instructions.
Supports
Account, Help, editor and Blocklist inputs have labels or instructions.
(Level A)
Information the user has already entered in the same process is filled in automatically or available to select, instead of being required again.
Supports
The signup and onboarding process does not ask users to re-enter information they have already provided.
(Level A)
For all UI components, the name, value, and role can be programmatically determined.
Partially Supports
Most controls expose an accessible name, role and state.
Classic – Sessions: the Query Help button has no accessible name.
Modern – some expand and collapse controls do not fully expose their state.
N/A
No live audio or video content.
1.2.5: Audio Description (Prerecorded)
(Level AA)
Provide audio description for prerecorded video content in synchronized media.
N/A
No prerecorded video content requiring audio description.
(Level AA)
Content does not restrict its view and operation to a single display orientation, such as portrait or landscape, unless a specific display orientation is essential.
Supports
Content does not restrict its view to a single orientation and works in both portrait and landscape layouts.
(Level AA)
The purpose of each input field collecting information about the user can be programmatically determined when: The input field serves a purpose identified in the Input Purposes for User Interface Components section; and the content is implemented using technologies with support for identifying the expected meaning for form input data.
Classic: Partially Supports
Modern: Supports
Exceptions: the Account First Name and Last Name fields do not identify their purpose programmatically (autocomplete is turned off).
The Account and profile First Name and Last Name fields identify their purpose programmatically.
1.4.3: Color Contrast (Minimum)
(Level AA)
Text has enough contrast with the background (4.5:1 for small text and 3:1 for large text)
Classic: Partially Supports
Modern: Supports
Most text meets minimum contrast.
Exceptions: on the Callback page, the "Filter by IP address" helper text is about 3.2:1.
Text meets minimum contrast, including form error labels.
Supports
Text can be resized to 200% browser zoom without loss of content or functionality.
(Level AA)
Text is used rather than images of text, except where the presentation of text is essential, such as logos.
Supports
Text is used rather than images of text, except for logos.
(Level AA)
Content can be presented without loss of information or functionality, and without requiring scrolling in two dimensions for: Vertical scrolling content at a width equivalent to 320 CSS pixels; Horizontal scrolling content at a height equivalent to 256 CSS pixels.
Partially Supports
Most content reflows at 320 CSS pixels wide.
Classic – Account preference helper text and some filter controls require horizontal scrolling or are clipped.
Modern – the Tags Anomalies tab label is clipped.
(Level AA)
User interface components and graphical objects have a contrast ratio of at least 3:1 against adjacent color(s).
Classic: Partially Supports
Modern: Supports
Most controls and graphics have at least 3:1 contrast.
Exceptions: the focus outline on the Account Save Preferences button is about 1.7:1.
Controls, graphics and focus outlines have at least 3:1 contrast.
(Level AA)
In content implemented using markup languages that support the following text style properties, no loss of content or functionality occurs by setting all the following and by changing no other style property:
Classic: Supports
Modern: Partially Supports
Content remains available when text spacing is increased.
Most content remains available when text spacing is increased.
Exceptions: at narrow widths, the expanded map header title is clipped.
1.4.13 Content on Hover or Focus
(Level AA)
Where receiving and then removing pointer hover or keyboard focus triggers additional content to become visible and then hidden, the following are true:
Partially Supports
Exceptions: activity chart tooltips (Classic: NTP Protocol; Modern: Web Crawler) can be hovered and close when the pointer moves away, but they can cover chart content and cannot be dismissed without moving the pointer or focus.
Partially Supports
Most pages can be reached through navigation, the footer and search.
Exceptions: Account Details (Classic) and Settings (Modern) are reachable only through the account menu.
Supports
Headings and labels describe their topic or purpose.
(Level AA)
The page element with the current keyboard focus has a visible focus indicator.
Partially Supports
Most controls have a visible focus indicator.
Classic – the footer Discord link has no visible focus indicator.
Modern – with the narrow-screen navigation menu open, the focused Search field is hidden behind the menu.
2.4.11 Focus Not Obscured (Minimum)
(Level AA)
When a component receives keyboard focus, it is not entirely hidden by author-created content.
Partially Supports
Focused controls remain visible on most pages.
Exceptions: on narrow screens with the navigation menu open, keyboard focus can move to controls entirely hidden behind the menu (Classic: background controls; Modern: the Search field).
(Level AA)
Functionality that uses dragging can be achieved with a single pointer without dragging, unless dragging is essential.
Supports
Dragging actions have single-pointer alternatives, including dashboard Move Left and Move Right controls and start and end controls for chart time ranges.
(Level AA)
Pointer targets are at least 24 by 24 CSS pixels, unless spacing, an equivalent control or another exception applies.
Supports
Pointer targets meet the minimum size or a permitted exception, such as sufficient spacing or an equivalent larger control.
(Level AA)
Specify the language of text passages that are in a different language than the default language of the page.
Supports
All content is in English; no passages in other languages require language markup.
(Level AA)
Navigation menus are in the same location and order on every web page.
Supports
Navigation menus appear in the same relative order across pages.
3.2.4: Consistent Identification
(Level AA)
UI components used across the web site are identified consistently on every page.
Supports
Navigation, Search and Help are identified consistently across pages.
(Level AA)
When the user makes an input error, give suggestions for valid input.
Supports
Error messages explain how to correct the input, such as "This field is required." and "Choose a topic."
3.3.4: Error Prevention (Legal, Financial, Data)
(Level AA)
For web pages with legal or financial commitments, input can be reviewed and corrected before final submission, and submissions can be reverted.
Supports
Account changes can be reviewed and corrected before saving, and account deletion requires confirmation.
3.3.8 Accessible Authentication (Minimum)
(Level AA)
Authentication does not require a cognitive function test, such as remembering a password, unless an alternative or assistance mechanism is available.
Supports
Sign-in supports pasting and password managers, so users do not need to recall or retype a password.
(Level AA)
In content implemented using markup languages, status messages can be programmatically determined through role or properties such that they can be presented to the user by assistive technologies without receiving focus.
Partially Supports
Exceptions: in testing with VoiceOver, some messages were not announced: the no-results message in Classic Fields search, and validation errors in the Modern Contact support form.
