Check Point Software Technologies

https://support.checkpoint.com/results/sk/sk185222

Added 2026-08-05 as the ONE candidate source of this run. Check Point's own support/PSIRT advisory pages (sk articles), the vendor primary for the Security Management / SmartConsole management-plane CVE stream this pipeline has covered four times in three weeks (CVE-2026-16232, CVE-2026-62144/-62145, CVE-2026-18574). Until now every Check Point entry had to lean on CERT-FR/BSI restatements because the vendor page was unreadable. FETCH → https://support.checkpoint.com/results/sk/<skid> is a Next.js SPA returning only a <title> to a direct GET. The full advisory body (symptoms, affected versions, conditions, mitigation, solution, dateCreated/lastModified) is served as JSON at https://support.checkpoint.com/_next/data/<buildId>/results/sk/<skid>.json, read <buildId> from the /_next/static/<buildId>/_buildManifest.js reference in the shell HTML (2026-08-05: qfIT1FE0sMobyOnl2MXEb; it rotates on every site deploy, so re-read it, never hardcode it). CITE the human /results/sk/<skid> URL; read the body from the data route. Candidate; promote to active after 3 contributing runs. | 2026-09-11: promoted candidate -> active per state-digest sources.promotion_due (3 contributing runs, most recent 2026-09-10T0410Z-intel), per Phase 0 allocation rule 4. | 2026-10-02 (2026-10-02T0404Z-intel): the record URL is a single SK (sk185222, 2026-08-01), not a listing, so it cannot discover new advisories; `url https://support.checkpoint.com/results/sk/<id>` returns the Next.js page whose __NEXT_DATA__ JSON carries lastModified and the full text. New SK ids come from Check Point's blog or CERT relays. | 2026-10-07 (main agent): source_health flagged needs-content-fix because extract and the direct transport returned nothing; repeated direct GETs of the SK page returned 504 after 30 s (a CDN gateway timeout) although one earlier GET returned the Next.js shell, and the reader served the page, so the cause is an upstream outage on support.checkpoint.com, not a recipe defect. Recipe unchanged; a 5xx never demotes. Re-probe on the next run. | 2026-10-13 (S1): the advisory text sits in the page __NEXT_DATA__ JSON (props.pageProps.data: title, symptoms, solution, dateCreated, lastModified); the record URL is a fixed SK page, not a listing, so new Check Point SKs need their sk ids from CERT feeds.