diff --git a/CHANGELOG.md b/CHANGELOG.md
index b010bc8..640ec77 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,10 +1,26 @@
 # VINCE Changelog
 
 
+## Version 2.0.5  2023-01-04
+
+* Update to CVE2.1 Services Publish using CVE5 JSON
+* More Async functions for vendor status views
+* Added more common libraries to lib/vince/utils
+* Added a mute_lib.py to support mute a Case for a user in automated way
+* Fixed a number of small bugs in max length in FORM submissions and S3 sensitive filenames
+
+## Version 2.0.4: 2022-12-20
+
+* Added Filter to CaseView in VinceComm
+* Addition of more Async functions for non-interactive queries
+* Fixing of slow performance on allvendors view to use Django Aggregate and Filter/Q functions
+* Friendly errors and fixes for logging to add IP address of remote client
+
+
 ## Version 2.0.3: 2022-12-14
 
 * Major upgrade to Django 3.2 LTS target end byt 2024. Fixes related to Django upgrade in all libraries.
-* Aded new QuerySet Paging library for performance extend chain with chainqs for QuerySet 
+* Aded new QuerySet Paging library for performance extend chain with chainqs for QuerySet
 * Asynchronous calls for most vinny/views via JSON through asyncLoad class
 * Provide API Views 404 with JSON generic error
 * Allow Session or API Token authentication to support API access from browser
diff --git a/bigvince/settings_.py b/bigvince/settings_.py
index 845db1a..acb61f6 100644
--- a/bigvince/settings_.py
+++ b/bigvince/settings_.py
@@ -56,7 +56,7 @@
 ROOT_DIR = environ.Path(__file__) - 3
 
 # any change that requires database migrations is a minor release
-VERSION = "2.0.3"
+VERSION = "2.0.5"
 
 # Quick-start development settings - unsuitable for production
 # See https://docs.djangoproject.com/en/2.1/howto/deployment/checklist/
diff --git a/lib/vince/mutelib.py b/lib/vince/mutelib.py
new file mode 100644
index 0000000..9c11f2d
--- /dev/null
+++ b/lib/vince/mutelib.py
@@ -0,0 +1,39 @@
+from django.contrib.auth.models import User
+from vinny.views import VinceProfile as vp
+
+
+
+def mute_user(useremail,case_id,interactive=False):
+    """ Mute case for a user with `useremail` identified for a `case_id`
+    on success it return 0 (no need to update) or 1. If the user is not
+    found or user has nor profile, it returns -ve number repsectively.
+    You should use this with try/except block for web/API usage
+    """
+    q = User.objects.filter(username=useremail).using('vincecomm').first()
+    l = vp.objects.filter(user=q).first()
+    if not q:
+        if interactive:
+            print(f"User {useremail} not found")
+        return -1
+    if not l:
+        if interactive:
+            print(f"User {useremail} Profile not found")
+        return -2 
+    d = q.vinceprofile.settings.copy()
+    if 'muted_cases' in d:
+        if case_id in d['muted_cases']:
+            if interactive:
+                print(f"Case id {case_id} already muted for {useremail}")
+                print(d)
+            return 0
+        else:
+            d['muted_cases'] += [case_id]
+    else:
+        d['muted_cases'] = [case_id]
+    l._set_settings(d)
+    l.save()
+    if interactive:
+        print("Updated profile settings are ")
+        print(l._get_settings())
+    return 1
+
diff --git a/lib/vince/utils.py b/lib/vince/utils.py
new file mode 100644
index 0000000..8076f0b
--- /dev/null
+++ b/lib/vince/utils.py
@@ -0,0 +1,60 @@
+import inspect
+import pathlib
+import mimetypes
+import uuid
+import re
+#Utilities for VINCE to use that are generic
+
+def get_ip(request):
+    """ GET IP address of a request object and find it using simple
+    method of the first X-Forwarded-For header IP from proxy/web server
+    or the REMOTE_ADDR environment setup by the appserver. Returns a
+    string not an IP validated item/object.
+    """
+    try:
+        if request.META.get('HTTP_X_FORWARDED_FOR'):
+            return request.META.get('HTTP_X_FORWARDED_FOR').split(',')[0]
+        elif request.META.get('REMOTE_ADDR'):
+            return request.META.get('REMOTE_ADDR')
+        else:
+            return "Unknown"
+    except Exception as e:
+        return f"IP lookup Exception {e}"
+    return "Unknown"
+
+
+def deepGet(obj,idir):
+    """ Given an object of any kind find if it is a dictionary
+    or a list or an abstract object or instance of a class
+    that has a burried element.
+    """
+    x = obj
+    for s in idir.split("."):
+        if not x:
+            return None
+        if isinstance(x,dict) and s in x:
+            x = x[s]
+        elif isinstance(x,list) and s.isdigit() and int(s) < len(x):
+            x = x[int(s)]
+        elif hasattr(x,s):
+            x = getattr(x,s)
+            if callable(x) and not inspect.isclass(x):
+                x = x()
+        else:
+            return None
+    return x
+
+def safe_filename(filename,file_uuid=str(uuid.uuid4()),mime_type="application/octet-stream"):
+    filename = filename.replace("\r"," ").replace("\n"," ").strip()
+    if re.search(r'[^\x00-\x7F]+',filename):
+        #non-ascii filenames use uuid and extension
+        if file_uuid == None:
+            file_uuid = uuid.uuid4()
+        file_extension = "".join(pathlib.Path(filename).suffixes)
+        if file_extension:
+            filename = file_uuid + file_extension
+        elif mimetypes.guess_extension(mime_type):
+            filename = file_uuid + mimetypes.guess_extension(mime_type)
+        else:
+            filename = file_uuid
+    return filename
diff --git a/vince/forms.py b/vince/forms.py
index cd5481e..234c1c0 100644
--- a/vince/forms.py
+++ b/vince/forms.py
@@ -2344,7 +2344,7 @@ class CVEAffectedProductForm(forms.ModelForm):
         widget = forms.Select(attrs={'class': 'form-control'}),
         label=_('Version Affected'),
         required=False,
-        choices=([('None', None), ('<', '< (affects X versions prior to n)'), ('<=', '<= (affects X versions up to n)'), ('=', '= (affects n)'), ('>', '> (affects X versions above n)'), ('>=', '>= (affects X versions n and above)')])
+        choices=([('None', None), ('lessThan', '< (affects X versions prior to n)'), ('lessThanOrEqual', '<= (affects X versions up to n)')])
         )
     
     class Meta:
@@ -2358,13 +2358,13 @@ class CVEReferencesForm(forms.Form):
 	widget = forms.Select(attrs={'class': 'form-control'}),
         label=_('Reference Source'),
 	required=True,
-        choices=([('URL', 'URL'),('CERT-VN', 'CERT-VN'), ('MISC', 'MISC'), ('CONFIRM', 'CONFIRM')])
+        choices=([('URL', 'URL')])
      )
     
     reference = forms.URLField(
 	label=_('Reference'),
         widget = forms.TextInput(attrs={'placeholder': 'e.g., https://dhs.gov.'}),
-        help_text = 'Please provide reference URL.',
+        help_text = 'Please provide reference URL.  Do not add kb.cert.org reference. It will be automatically generated by the VU#',
         max_length=500
     )
 
diff --git a/vince/models.py b/vince/models.py
index 08e5d05..475eeef 100644
--- a/vince/models.py
+++ b/vince/models.py
@@ -48,6 +48,7 @@
 #Django 3 and up
 from django.db.models import JSONField
 import io
+from lib.vince import utils as vinceutils
 
 logger = logging.getLogger(__name__)
 
@@ -1268,7 +1269,8 @@ def __str__(self):
         return '%s' % self.filename
 
     def _get_access_url(self):
-        url = self.file.storage.url(self.file.name, parameters={'ResponseContentDisposition': f'attachment; filename="{self.filename}"'})
+        filename = vinceutils.safe_filename(self.filename,str(self.uuid),self.mime_type)
+        url = self.file.storage.url(self.file.name, parameters={'ResponseContentDisposition': f'attachment; filename="{filename}"'})
         return url
 
     access_url = property(_get_access_url)
@@ -1680,8 +1682,6 @@ class VulNoteRevision(BaseRevisionMixin,  models.Model):
     search_vector = SearchVectorField(null=True)
     
     def __str__(self):
-        logger.debug("in revision")
-        logger.debug(self.content)
         if self.revision_number:
             return "%s (%d)" % (self.title, self.revision_number)
         else:
@@ -3821,7 +3821,6 @@ def complete(self):
         else:
             return False
         if self.cve_name and self.date_public and len(refs) and len(cwes):
-            logger.debug(len(self.references))
             return True
         else:
             return False
@@ -3836,19 +3835,19 @@ class CVEAffectedProduct(models.Model):
         max_length=200)
 
     version_name = models.CharField(
-        _('Affected Version'),
+        _('Version Range End'),
         blank=True,
         null=True,
         max_length=100)
 
     version_affected = models.CharField(
-        _('Version Affected'),
+        _('Version Range Type'),
         blank=True,
         null=True,
         max_length=10)
     
     version_value = models.CharField(
-        _('Affected Version Value'),
+        _('Affected Version or Start'),
         max_length=100)
 
     organization = models.CharField(
diff --git a/vince/static/vince/css/overrides.css b/vince/static/vince/css/overrides.css
index 7001e1c..c8ac0c8 100644
--- a/vince/static/vince/css/overrides.css
+++ b/vince/static/vince/css/overrides.css
@@ -24,11 +24,11 @@
 	height: auto !important;
     }
     #offCanvas ul.vertical.menu > li.menu-close {
-	  position: fixed;
-	  right: 15%;
-	  top: 0px;
-	  border: none;
-	  padding-top: 0px;
+	position: fixed;
+	right: 15%;
+	top: 0px;
+	border: none;
+	padding-top: 0px;
     }
     #header {
 	height: auto !important;
@@ -48,3 +48,74 @@
 	top: 0%;
     }
 }
+nav.cdown {
+    display:inline-block;
+}
+
+nav.cdown ul {
+    background: #ff8c00;
+    list-style: none;
+    margin: 0;
+    padding-left: 0;
+}
+
+nav.cdown li {
+    color: #fff;
+    background: #ff8c00;
+    display: block;
+    float: left;
+    font-size: 0.8rem;
+    padding: 0.3rem 0.4rem 0.1rem 0.4rem;
+    position: relative;
+    text-decoration: none;
+    transition-duration: 0.5s;
+}
+
+nav.cdown li a {
+    color: #fff;
+}
+
+nav.cdown li:hover {
+    background: #dc3545;
+    cursor: pointer;
+}
+
+nav.cdown ul li ul {
+    background: #ffa500;
+    visibility: hidden;
+    opacity: 0;
+    min-width: 9rem;
+    position: absolute;
+    transition: all 0.5s ease;
+    margin-top: 1rem;
+    right: 0;
+    display: none;
+    top: 0.55rem;
+}
+
+nav.cdown ul li:hover > ul,
+nav.cdown ul li:focus-within > ul, 
+nav.cdown ul li ul:hover {
+    visibility: visible;
+    opacity: 1;
+    display: block;
+}
+
+nav.cdown ul li ul li {
+    clear: both;
+    width: 100%;
+}
+nav.cdown .fa-check {
+    font-size: 0.7rem;
+    opacity: 0;
+}
+nav.cdown .all .fa-check {
+    opacity: 1;
+}
+nav.cdown li.affected {
+    background-color: #990033;
+}
+nav.cdown li.not_affected {
+    background-color: #3adb76;
+}  
+
diff --git a/vince/static/vince/js/addvuls.js b/vince/static/vince/js/addvuls.js
index 51e77d3..98ce5ef 100644
--- a/vince/static/vince/js/addvuls.js
+++ b/vince/static/vince/js/addvuls.js
@@ -129,6 +129,11 @@ function del_tag(taggle, tag, modal){
 
 $(document).ready(function() {
 
+    if($('#largemodal').length < 1) {
+	$('body').prepend('<div class="reveal large" id="largemodal" ' +
+			  'data-reveal data-close-on-click="false"></div>');
+    }
+    let _ = new Foundation.Reveal($('#largemodal'));
     var modal = $("#largemodal");
     
     var vul_tags = [];
diff --git a/vince/static/vince/js/case.js b/vince/static/vince/js/case.js
index ef49993..cd60b48 100644
--- a/vince/static/vince/js/case.js
+++ b/vince/static/vince/js/case.js
@@ -1,38 +1,43 @@
 /*#########################################################################
-# VINCE
-#
-# Copyright 2022 Carnegie Mellon University.
-#
-# NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING
-# INSTITUTE MATERIAL IS FURNISHED ON AN "AS-IS" BASIS. CARNEGIE MELLON
-# UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED,
-# AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR
-# PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE
-# MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND
-# WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT.
-#
-# Released under a MIT (SEI)-style license, please see license.txt or contact
-# permission@sei.cmu.edu for full terms.
-#
-# [DISTRIBUTION STATEMENT A] This material has been approved for public
-# release and unlimited distribution.  Please see Copyright notice for non-US
-# Government use and distribution.
-#
-# Carnegie Mellon®, CERT® and CERT Coordination Center® are registered in the
-# U.S. Patent and Trademark Office by Carnegie Mellon University.
-#
-# This Software includes and/or makes use of Third-Party Software each subject
-# to its own license.
-#
-# DM21-1126
-########################################################################
+  # VINCE
+  #
+  # Copyright 2022 Carnegie Mellon University.
+  #
+  # NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING
+  # INSTITUTE MATERIAL IS FURNISHED ON AN "AS-IS" BASIS. CARNEGIE MELLON
+  # UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED,
+  # AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR
+  # PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE
+  # MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND
+  # WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT.
+  #
+  # Released under a MIT (SEI)-style license, please see license.txt or contact
+  # permission@sei.cmu.edu for full terms.
+  #
+  # [DISTRIBUTION STATEMENT A] This material has been approved for public
+  # release and unlimited distribution.  Please see Copyright notice for non-US
+  # Government use and distribution.
+  #
+  # Carnegie Mellon®, CERT® and CERT Coordination Center® are registered in the
+  # U.S. Patent and Trademark Office by Carnegie Mellon University.
+  #
+  # This Software includes and/or makes use of Third-Party Software each subject
+  # to its own license.
+  #
+  # DM21-1126
+  ########################################################################
 */
 
+function alertmodal(modal,msg) {
+    modal.html("<div class\"fullmodal\"><div class=\"modal-body\"><p> " +
+	       msg + "</p> <div class=\"modal-footer text-right\">" +
+	       "<a href=\"#\" class=\"hollow button cancel_confirm\" " +
+	       "data-close type=\"cancel\">Ok</a></div></div></div>")
+	.foundation('open');
+}
 
 function permissionDenied(modal) {
-
-    modal.html("<div class\"fullmodal\"><div class=\"modal-body\"><p>Error: You are not permitted to perform this action</p> <div class=\"modal-footer text-right\"><a href=\"#\" class=\"hollow button cancel_confirm\" data-close type=\"cancel\">Ok</a></div></div></div>").foundation('open');
-
+    alertmodal(modal,"Error: You are not permitted to perform this action");
 }
 
 function init_modal_markdown() {
@@ -85,10 +90,10 @@ function reloadVendorStats(case_id) {
 function reloadVendors(case_id, tablet) {
     tablet.replaceData();
     /*$.ajax({
-	url: "/vince/ajax_calls/case/vendors/"+case_id+"/",
-	success: function(data) {
+      url: "/vince/ajax_calls/case/vendors/"+case_id+"/",
+      success: function(data) {
 
-	}});*/
+      }});*/
 
     reloadVendorStats(case_id);
 }
@@ -161,7 +166,7 @@ function searchComms(e) {
 	error: function() {
             lockunlock(false,'div.mainbody,div.vtmainbody','#timeline');
             console.log(arguments);
-           alert("Search failed or canceled! See console log for details.");
+            alert("Search failed or canceled! See console log for details.");
         },
         complete: function() {
             /* Just safety net */
@@ -200,7 +205,7 @@ function searchTasks(e, tablet) {
         error: function() {
             console.log(arguments);
 	    lockunlock(false,'div.mainbody,div.vtmainbody','#case_tasks');
-           alert("Search failed or canceled! See console log for details.");
+            alert("Search failed or canceled! See console log for details.");
         },
         complete: function() {
             /* Just safety net */
@@ -247,12 +252,12 @@ function auto(data, taggle, tag_url, modal) {
 }
 
 $(document).ready(function() {
-     $('a').each(function () {
+    $('a').each(function () {
         $(this).qtip({
             content: $(this).attr("title"),
 	    style: {classes: 'qtip-youtube'}
 	})
-     });
+    });
     
     var input = document.getElementById("id_keyword");
     if (input) {
@@ -458,6 +463,7 @@ $(document).ready(function() {
     var largemodal = $("#largemodal");
     
     $(document).on("submit", '#addvendorform', function(event) {
+	/* the jquery autocomplete should use UUID or PKIDs*/
 	event.preventDefault();
 	var reload = $(this).attr("reload");
 	var vendors = [];
@@ -494,7 +500,7 @@ $(document).ready(function() {
 	    })
             .done(function() {
 		addmodal.foundation('close');
-        });
+            });
     });
 
 
@@ -645,20 +651,141 @@ $(document).ready(function() {
             }
 	});
     });
+    async function notify_all() {
+	let i = 1;
+	let hm = get_modal();
+	hm.append("<h2>Start all-vendor Notifications</h2>")
+	hm.append("<h4>Do not hit Escape or click outside this window!</h4>");
+	hm.append("<p> See Javascript console log for any failures</p>");
+	let caseid = $('.addvulmodal').attr('caseid');
+	if(!caseid) {
+	    hm.append("<strong style='color:red'>Error no CaseID found");
+	    return false;
+	}
+	
+	window.allvendors = [];
+	var max = 2;
+	hm.append("<h5> Fetching vendors list by Page " +
+		  "[<span class='cpage'>0</span>] of " +
+		  "<span class='tpage'>2</span> </h5>");
+	while (i <= max) {
+	    url = 'https://vince.cert.org/vince/ajax_calls/case/vendors/'+
+		caseid+'/?page='+String(i);
+	    hm.find('.cpage').html(String(i));
+            await $.get(url,function(d) {
+		if(d.last_page)
+		    max = parseInt(d.last_page);
+		hm.find('.tpage').html(max);
+		if(d.data)
+		    window.allvendors = window.allvendors.concat(d.data);
+            });
+	    i++;
+	}
+	hm.append("<h4> Initiating contact for vendor # " +
+		  "[<span class='mdcounter'>0</span>]  of " +
+		  window.allvendors.length + " Vendors in " +
+		  "this Case, please wait </h4>");
+	hm.append("<div><ul><li><h5>Starting Contact</h5></li>");
+	for( let i = 0; i < window.allvendors.length; i++) {
+	    hm.find("li:last-child").fadeOut('10000');
+	    let si = String(i+1);
+	    hm.find('.mdcounter').html(si);
+	    let v = window.allvendors[i];
+	    let csrf = getCookie('csrftoken');
+	    let vuid = "VU#Private";
+	    if($('#vuid').val())
+		vuid = $('#vuid').val();
+	    let fsubmit = { subject : vuid+": New Vulnerability Report",
+			    email_template: "",
+			    email_body: "We have new information about a " +
+			    "vulnerability that may affect your products. " +
+			    "Please login to the CERT/CC VINCE portal for " +
+			    "more information about this vulnerability." }
+	    fsubmit['csrfmiddlewaretoken'] = csrf;
+	    if(v.contact_date) {
+		console.log("Already Contacted vendor : " + v.vendor);
+		hm.append("<li> " + si + " Already Contacted vendor : " +
+			  v.vendor + " on " + v.contact_date + "</li>");
+		continue;
+	    } else {
+		console.log("Contacting vendor :  " + v.vendor);
+		hm.append("<li> " + si + " Attempting to contact : " + v.vendor +
+			  " result is <span class='vendor'" + si +
+			  "'></span></li>");  
+		var url = 'https://vince.cert.org/vince/editcasevendors/' +
+		    caseid+'/';
+		fsubmit['vendors'] = v.contact_id;
+		await $.post(url,fsubmit).done(function(r) {
+		    console.log("Contact result is ");
+		    console.log(r);
+		    console.log(si);
+		    hm.find(".vendor " + si).html(JSON.stringify(r));
+		    //hm.append(JSON.stringify(r));
+		});
+	    }
+	}
+	hm.append("</ul></div>");
+	finish_modal(hm);
+    }
 
-    $(document).on("click", '#approveall', function(event) {
-        event.preventDefault();
-        $.ajax({
-            url: $(this).attr("href"),
-            type: "GET",
-            success: function(data) {
-		addmodal.html(data).foundation('open');
-            },
-	    error: function(xhr, status) {
-                permissionDenied(addmodal);
-            }
-        });
-    });
+
+    async function approve_all_vendors() {
+	let hm = get_modal();
+	hm.append("<h2>Start all-vendor Approval</h2>");
+	hm.append("<h4> Do not close this window </h4>");
+	hm.append("<p> See Javascript console log for any failures</p>");
+	let caseid = $('.addvulmodal').attr('caseid');
+	if(!caseid) {
+            hm.append("<strong style='color:red'>Error no CaseID found");
+	    finish_modal(hm);
+            return false;
+	}
+	window.allvendors = [];
+	var max = 2;
+	let url = "https://vince.cert.org/vince/ajax_calls/case/vendors/"+
+	    caseid + "/?page=1&filters%5B0%5D%5Bfield%5D=reqapproval" +
+	    "&filters%5B0%5D%5Btype%5D=%3D&filters%5B0%5D%5Bvalue%5D=true";
+	hm.append("<div><ul><li><h5>Starting Contact</h5></li>");
+	await $.getJSON(url,async function(d) {
+	    if(d.data) {
+		hm.append("<h4> Initiating contact for vendor # " +
+			  "[<span class='mdcounter'>0</span>]  of " +
+			  d.data.length + " Vendors in " +
+			  "this Case, please wait </h4>");
+		hm.append("<div><ul><li><h5>Starting Contact</h5></li>");
+		for(let i=0; i<d.data.length; i++) {
+		    
+		    let si = String(i+1);
+		    hm.find("li:last-child").fadeOut('10000');
+		    hm.find('.mdcounter').html(si);
+		    let v = d.data[i];
+		    if(v.approved) {
+			hm.append("<li> " + si + " Already Approved vendor : " +
+				  v.vendor +"</li>");
+			continue;
+		    }
+		    let vurl =  'https://vince.cert.org/vince/vendor/approve/'+
+			v.id + '/';
+		    hm.append("<li> " + si + " Attempting to contact : " +
+			      v.vendor + " result is <span class='vendor" +
+			      si + "'></span></li>");
+		    await $.post(vurl,
+				 { csrfmiddlewaretoken: getCookie('csrftoken'),
+				   vendor: v.id
+				 },
+				 function(y) {
+				     
+				     hm.find(".vendor" + si).html(JSON.stringify(y));
+				 });
+		}
+	    }
+	    
+	});
+	finish_modal(hm);
+    }
+    
+    $(document).on("click", '#approveall', approve_all_vendors);
+    $(document).on("click", '#notifyall', notify_all);
 
     //Don't submit the form twice
     $(document).on('submit', '#editvulform', function (e) {
@@ -728,7 +855,7 @@ $(document).ready(function() {
 	var vulid = $(this).attr('vulid');
 	window.location = "/vince/cve/"+vulid+"/download/";
     });
-	      
+    
     
     $.widget("custom.tablecomplete", $.ui.autocomplete, {
 	_create: function() {
@@ -798,17 +925,17 @@ $(document).ready(function() {
     }
 
     function vend_auto(data) {
-    var autocomplete = $("#vendor").tablecomplete({
-	minLength: 1,
-	source: data,
-	focus: _doFocusStuff,
-	select: _doSelectStuff
+	var autocomplete = $("#vendor").tablecomplete({
+	    minLength: 1,
+	    source: data,
+	    focus: _doFocusStuff,
+	    select: _doSelectStuff
+	    
+	});
+	// create the autocomplete
 	
-    });
-    // create the autocomplete
-    
-    // get a handle on it's UI view
-    var autocomplete_handle = autocomplete.data("ui-autocomplete");
+	// get a handle on it's UI view
+	var autocomplete_handle = autocomplete.data("ui-autocomplete");
     }
 
 
@@ -870,12 +997,12 @@ $(document).ready(function() {
     }
 
     /*
-    $(window).keydown(function(event){
-	if(event.keyCode == 13) {
-	    event.preventDefault();
-	    return false;
-	}
-    });
+      $(window).keydown(function(event){
+      if(event.keyCode == 13) {
+      event.preventDefault();
+      return false;
+      }
+      });
     */
     var vendorinput = document.getElementById("vendor");
     if (vendorinput) {
@@ -903,12 +1030,12 @@ $(document).ready(function() {
     }
     
     /*$.getJSON("/vince/api/vendors/", function(data) {
-        vend_auto(data);
-	});*/
+      vend_auto(data);
+      });*/
     
-     $.getJSON("/vince/api/users/", function(data) {
+    $.getJSON("/vince/api/users/", function(data) {
 	user_auto(data);
-     });
+    });
 
     $.getJSON("/vince/api/contacts/", function(data) {
 	contact_auto(data);
@@ -1094,39 +1221,39 @@ $(document).ready(function() {
 
     });
     /*
-     //in vulmodal.js
+    //in vulmodal.js
     var cwe_formset = $('.cwe_formset').length;
     if (cwe_formset) {
-	$('.cwe_formset').formset({
-	    prefix: 'cwe',
-	    deleteText: '',
-	    addText: '<i class=\'fas fa-plus\'></i> add cwe',
-	    addCssClass: 'button tiny primary',
-	    deleteCssClass: 'remove-formset right'
-	});
+    $('.cwe_formset').formset({
+    prefix: 'cwe',
+    deleteText: '',
+    addText: '<i class=\'fas fa-plus\'></i> add cwe',
+    addCssClass: 'button tiny primary',
+    deleteCssClass: 'remove-formset right'
+    });
     }
 
 
     var ref_formset = $('.ref_formset').length;
     if (ref_formset) {
-        $('.ref_formset').formset({
-            prefix: 'ref',
-            deleteText: '',
-            addText: '<i class=\'fas fa-plus\'></i> add reference',
-            addCssClass: 'button tiny primary',
-            deleteCssClass: 'remove-formset right'
-        });
+    $('.ref_formset').formset({
+    prefix: 'ref',
+    deleteText: '',
+    addText: '<i class=\'fas fa-plus\'></i> add reference',
+    addCssClass: 'button tiny primary',
+    deleteCssClass: 'remove-formset right'
+    });
     }
     
     var exploit_formset = $('.exploit_formset').length;
     if (exploit_formset) {
-	$('.exploit_formset').formset({
-            prefix: 'exploit',
-            deleteText: '',
-            addText: '<i class=\'fas fa-plus\'></i> add exploit',
-            addCssClass: 'button tiny primary',
-          deleteCssClass: 'remove-formset right'
-        });
+    $('.exploit_formset').formset({
+    prefix: 'exploit',
+    deleteText: '',
+    addText: '<i class=\'fas fa-plus\'></i> add exploit',
+    addCssClass: 'button tiny primary',
+    deleteCssClass: 'remove-formset right'
+    });
     }*/
 
     $('#moreVendor').click(function(e) {
@@ -1136,7 +1263,7 @@ $(document).ready(function() {
         e.preventDefault();
     });
 
-     $('#lessVendor').click(function(e) {
+    $('#lessVendor').click(function(e) {
         $("#hidevendors").toggle();
         $("#moreVendors").toggle();
         $("#lessVendors").toggle();
@@ -1145,10 +1272,10 @@ $(document).ready(function() {
     });
     
 
-     if (document.getElementById('vuls_data')) {
-         var data = JSON.parse(document.getElementById('vuls_data').textContent);
-	 console.log(data);
-     }
+    if (document.getElementById('vuls_data')) {
+        var data = JSON.parse(document.getElementById('vuls_data').textContent);
+	console.log(data);
+    }
 
 
     var cellClickFunction = function(e, cell) {
@@ -1163,10 +1290,10 @@ $(document).ready(function() {
     var buttonFormatter = function(cell,  formatterParams, onRendered) {
         var rv = "<a vulid="+cell.getValue()+" href=\"#\" title=\"edit this vulnerability\" class=\"openeditmodal btn-link\"><i class=\"fas fa-pencil-alt\"></i></a><button title=\"clone this vulnerability\" class=\"clonevul btn-link\" obj="+cell.getValue()+"><i class=\"far fa-clone\"></i></button><button title=\"delete this vulnerability\" class=\"deletevul btn-link\" href=\""+cell.getRow().getData().remove_link+"\"><i class=\"fas fa-trash-alt\"></i></button>";
 	/*if (cell.getRow().getData().ask_vendor_status) {
-	    rv = rv + "<a vulid="+cell.getValue()+" href=\"#\" title=\"do not ask for status\" class=\"nosharevul btn-link\"><i class=\"fas fa-unlink\"></i></button>";
-	} else {
-	    rv = rv + "<a vulid="+cell.getValue()+" href=\"#\" title=\"ask for status\" class=\"sharevul btn-link\"><i class=\"fas fa-link\"></i></button>";
-	}*/
+	  rv = rv + "<a vulid="+cell.getValue()+" href=\"#\" title=\"do not ask for status\" class=\"nosharevul btn-link\"><i class=\"fas fa-unlink\"></i></button>";
+	  } else {
+	  rv = rv + "<a vulid="+cell.getValue()+" href=\"#\" title=\"ask for status\" class=\"sharevul btn-link\"><i class=\"fas fa-link\"></i></button>";
+	  }*/
 	return rv
     }
 
@@ -1286,7 +1413,7 @@ $(document).ready(function() {
 	if (cell.getRow().getData().alert_tags.length) {
 	    val = "<i class=\"fas fa-bell warning\"></i>  " + val
 	}
-	    
+	
         var url_mask = cell.getRow().getData().contact_link;
 	return "<a href=\""+url_mask+"\">"+ val + "</a>";
     }
@@ -1544,26 +1671,52 @@ $(document).ready(function() {
 	    }
 	}
     });
-
-
+    function alertmodal(modal,msg) {
+    modal.html("<div class\"fullmodal\"><div class=\"modal-body\"><p> " +
+               msg + "</p> <div class=\"modal-footer text-right\">" +
+               "<a href=\"#\" class=\"hollow button cancel_confirm\" " +
+	       "data-close type=\"cancel\">Ok</a></div></div></div>")
+        .foundation('open');
+    }
+    vendors_table = Tabulator.prototype.findTable("#vendors-table")[0]
+    approvemodal = $("#approvenote");
+    $(document).off("click", '#notifyvendors')
     $(document).on("click", '#notifyvendors', function(event) {
 	event.preventDefault();
 	var vendors = [];
         var selectedRows = vendors_table.getSelectedRows();
 	var url = $("#vendor_notify").attr("action");
 	var csrftoken = getCookie('csrftoken');
-		
+	var exceptions = "";
 	if (selectedRows.length > 0) {
 	    for (i=0; i < selectedRows.length; i++) {
-		vendors.push(selectedRows[i].getData().id)
+		var v = selectedRows[i].getData();
+		if(v.contact_date) {
+		    exceptions += "<h5>Skipping Vendor <u>"+ v.vendor +
+			"</u> Already notified on <i>"+ v.contact_date +
+			"</i></h5>";
+		    continue;
+		}
+		vendors.push(v.id)
 	    }
 
-	} 
+	}
+	if (vendors.length < 1) {
+	    alertmodal(approvemodal, "<h4><strong>No valid vendors to " +
+		       "notify!</strong></h4><h5>All vendors have been " +
+		       "notified or none were selected that can be "+
+		       "notified.</h5>");
+	    return;
+	}
+	if(exceptions != "") {
+	    exceptions = '<div style="background: rgb(244, 68, 68); ' +
+		'color: white;">' + exceptions + '</div>';
+	}
 	var formdata = {'vendors': vendors, 'csrfmiddlewaretoken': csrftoken};
 
 	$.post(url, formdata,
                function(data) {
-		   approvemodal.html(data).foundation('open');
+		   approvemodal.html(data+exceptions).foundation('open');
                })
 	    .fail(function(d) {
                 permissionDenied(addmodal);
@@ -1609,7 +1762,7 @@ $(document).ready(function() {
             });
 	approvemodal.foundation('close');
     });
-	       
+    
     
     $(document).on("submit", "#changedateform", function(event) {
 	event.preventDefault();
@@ -1633,8 +1786,8 @@ $(document).ready(function() {
 	$.post($(this).attr("action"), $(this).serializeArray(),
 	       function(data) {})
 	    .done(function() {
-		   reloadVendors($(".addvulmodal").attr('caseid'), vendors_table);
-	       })
+		reloadVendors($(".addvulmodal").attr('caseid'), vendors_table);
+	    })
 	    .fail(function(d) {
                 permissionDenied(addmodal);
             });
@@ -1687,7 +1840,7 @@ $(document).ready(function() {
 	    tooltipsHeader:true,
             selectable:true,
 	    dataEdited:function(data) {
-				    
+		
 		var csrftoken=getCookie('csrftoken');
 		for (i=0; i < data.length; i++) {
 		    var url = data[i].changetype;
@@ -1847,8 +2000,8 @@ $(document).ready(function() {
         var href = $(this).parent().parent().attr("href");
         var csrftoken = getCookie('csrftoken');
         $.post(href,
-            {'csrfmiddlewaretoken': csrftoken, 'new_status':$(this).attr("val")},
-            function(data) {})
+               {'csrfmiddlewaretoken': csrftoken, 'new_status':$(this).attr("val")},
+               function(data) {})
             .done(function(data, textStatus, jqXHR) {
                 console.log("post succeeded (textStatus: " + textStatus + ")");
                 window.location.reload(true);
@@ -1906,14 +2059,14 @@ $(document).ready(function() {
         });
     });
 
-     $(document).on("submit", "#publishsubmit", function(event) {
-	 $("#publishbtn").prop("disabled", true);
-	 return true;
-     });
+    $(document).on("submit", "#publishsubmit", function(event) {
+	$("#publishbtn").prop("disabled", true);
+	return true;
+    });
 
 
     $(document).on("click", "#askapproval", function(event) {
-    var csrftoken = getCookie('csrftoken');
+	var csrftoken = getCookie('csrftoken');
 	$.post($(this).attr("href"), {
             "csrfmiddlewaretoken": csrftoken,
 	},
@@ -1960,5 +2113,5 @@ $(document).ready(function() {
         // Keep chainability
 	return this;
     });
-        
+    
 });
diff --git a/vince/static/vince/js/search.js b/vince/static/vince/js/search.js
index 2a5ace8..2816d8a 100644
--- a/vince/static/vince/js/search.js
+++ b/vince/static/vince/js/search.js
@@ -57,44 +57,94 @@ function nextTickets(page) {
 }
 function searchTickets(e) {
     if (e) {
-        e.preventDefault();
+	e.preventDefault();
     }
     $("#id_page").val("1");
     var url = "/vince/ticket/results/";
     lockunlock(true,'div.mainbody,div.vtmainbody','#searchresults');
     window.txhr = $.ajax({
-        url: url,
-        type: "POST",
-        data: $('#searchform').serialize(),
-        success: function(data) {
-            lockunlock(false,'div.mainbody,div.vtmainbody','#searchresults');
-            $("#searchresults").html(data);
-        },
-        error: function() {
-            lockunlock(false,'div.mainbody,div.vtmainbody','#searchresults');
-            console.log(arguments);
-            alert("Search failed or canceled! See console log for details.");
-        },
-        complete: function() {
-            /* Just safety net */
-            lockunlock(false,'div.mainbody,div.vtmainbody','#searchresults');
-            window.txhr = null;
-        }
+	url: url,
+	type: "POST",
+	data: $('#searchform').serialize(),
+	success: function(data) {
+	    lockunlock(false,'div.mainbody,div.vtmainbody','#searchresults');
+	    $("#searchresults").html(data);
+	},
+	error: function() {
+	    lockunlock(false,'div.mainbody,div.vtmainbody','#searchresults');
+	    console.log(arguments);
+	    alert("Search failed or canceled! See console log for details.");
+	},
+	complete: function() {
+	    /* Just safety net */
+	    lockunlock(false,'div.mainbody,div.vtmainbody','#searchresults');
+	    window.txhr = null;
+	}
     });
 }
+async function close_tickets(search) {
+    if(!search)
+	search = "Email Bounce";
+    let morepages = 1;
+    let csrf = getCookie('csrftoken');
+    let enddate = new Date().toISOString();
+    enddate = enddate.replace(/T.*/,'');
+    let pbody = "csrfmiddlewaretoken=" + csrf + "&new_status=4";
+    let hm = get_modal();
+    let postbody = "csrfmiddlewaretoken="+csrf+"&new_status="+4
+    let hdr = {'Content-type': 'application/x-www-form-urlencoded'};
+    hm.append("<h4> Do not close this window </h4>");
+    hm.append("<p> See Javascript console log for any failures</p>");
+    hm.append("<ul class='tempul'><li><h5>Starting Tickets</h5></li></ul>");
+    let ul = hm.find('.tempul');
+    ul.find("li > h5").append(" for <i>"+search+"</i> ");
+    while(morepages > 0) {
+	await $.post('/vince/ticket/results/',
+	       {csrfmiddlewaretoken: csrf,
+		owner: 5,
+		tag:"",
+		page: 1,
+		datestart:"2000-01-01",
+		status:    1, dateend: enddate,
+		wordSearch:    search},
+	       function(d) {
+		   let reader = $($.parseHTML(d));
+		   let total = parseInt(reader.find('#resultTotal').html())
+		   let els = reader.find('.vulnerability-list a');
+		   morepages = total - els.length;
+		   if(els.length < 1) {
+		       ul.append("<li><h5>Nothing found to close!</h5></li>");
+		       morepages = 0;
+		       return;
+		   }
+		   ul.append("<li>Closing tickets <span class='mc'></span> "+
+			     "of total ["+total+"] </li>");
+                   els.each(
+		       async function(i,x) {
+			   let si = String(i+1);
+			   ul.append($("<li>").addClass("sm " + si ).
+				     html("Closing " + si + " Ticket </li>"));
+			   let csrf = getCookie('csrftoken');
+			   let req = new Request(x.href+"update/",
+						 {redirect: 'manual'});
+			   await fetch(req,
+				 { method:"POST",
+				   headers: hdr,
+				   body: pbody })
+			       .then(function(b) {
+				   hm.find('li.sm'+si).html("Complete " +
+							     b.text()) 
+			       });
+			   
+                       });
+	       });
+    }
+    finish_modal(hm);
+}
+
 
 $(document).ready(function() {
 
-    $(document).keyup(function(e) {
-	if (e.key === "Escape") { 
-	    if('txhr' in window && 'abort' in window.txhr) {
-		console.log("Aborting search because user hit Escape");
-		window.txhr.abort();
-		delete window.txhr;
-	    }
-	}
-    });
-    
     $(document).on("click", '.search_page', function(event) {
 	var page = $(this).attr('next');
 	nextPage(page);
diff --git a/vince/static/vince/js/vince.js b/vince/static/vince/js/vince.js
index cdb0425..bd1ff31 100644
--- a/vince/static/vince/js/vince.js
+++ b/vince/static/vince/js/vince.js
@@ -76,6 +76,20 @@ function delaySearch(callfun,wait) {
 	    }, wait);
     };
 }
+function deepGet(obj,idir) {
+  let x= obj;
+  let y = idir.split(".");
+  y.every(function(d) { 
+    if (typeof(x) == "object" && d in x) {
+	x = x[d];
+	return true;
+    } else {
+	x = null;
+	return false;
+    }});
+    return x;
+}
+
 
 function asyncLoad(fdiv,furl,fmethod,pdiv,formpost,silent) {
     /* asyncload from furl(URL) to fdiv(Content div identifier) whose
@@ -190,6 +204,44 @@ function pageAsyncLoad(e) {
     }
 }
 
+function get_modal() {
+    let hm = $('#txmodal');
+    if(hm.length != 1) {
+	$('body').append($('<div>').addClass("reveal").
+	    attr({"id": "xmodal",
+		  "role": "dialog",
+		  "aria-hidden": "true",
+		  "data-close-on-click": "false",
+		  "data-close-on-esc": "false",
+		  "data-yeti": "modal",
+		  "data-resize": "modal"}).
+	    css({"border": "2px solid #007dac",
+		 "border-radius": "12px"}));
+        let _ = new Foundation.Reveal($('#xmodal'));
+        _.open();
+	$('#xmodal').append($('<div>').attr({"id": "txmodal"}).
+			    css({"padding": "12px"}))
+        hm = $('#txmodal');
+    }
+    hm.html("<button class='button small primary tempbutton showli' " +
+	    " style='display:none'>" +
+	    "Show All Results</button>&nbsp; &nbsp;");
+    hm.append("<button class='close-button tempbutton closem'" +
+	      " style='display:none'> X </button>")
+    hm.find('.showli').on('click', function() {
+	$('#txmodal li').show();
+    });
+    hm.find('.closem').on('click', function() {
+	$('#xmodal').foundation('close');
+    });    
+    $('#xmodal').foundation('open');
+    return hm;
+}
+function finish_modal(hm) {
+    hm.find('.tempbutton').show();
+    hm.append("<p>Operation complete, you may close this window</p>");
+}
+
 $(function () {
 
     /*$('span[title]').qtip({
@@ -380,6 +432,148 @@ $(function () {
 	    .find('input[type="checkbox"]')
 	    .prop('checked',$(e.target).prop('checked'));
     });
-    
+    function json_pretty(d) {
+	return JSON.stringify(d,null,'\t')
+    }
+    function msg_card(el,msg,level) {
+	$(el).html(msg).removeClass('hide').addClass('card-'+level);
+	if(level == "bad") {
+	    $(el).on('click',function() { $('#xmodal').foundation('close'); })
+	}
+    }
+    function load_cvedata(cvetype) {
+	$('a.cvetab').attr("aria-selected","false");
+	$('a.cvetab.'+cvetype).attr("aria-selected","true");
+	let cvenew = $('#cve5data').data(cvetype);
+	if(cvenew && deepGet(cvenew,'containers.cna')) {
+	    $('#cve5data').val(json_pretty(cvenew.containers.cna));
+	}
+    }
+    $('#rejectcve5').on('click', function() {
+	if(confirm("Reject this CVE and remove any public reference "+
+		   " in the CVE Program?")) {
+	    let href = $('#cve5json').attr('href');
+	}
+	    
+    });
+    $('.cve_status').each(function(_,el) {
+	if($(el).data("origin")) {
+	    $.getJSON($(el).data("origin")).done(function(d) {
+		if(('state' in d) && (d.state != "PUBLISHED"))
+		    return;
+		if(('dateUpdated' in d) && d.dateUpdated) {
+		    try {
+			let depoch = Date.parse(d.dateUpdated);
+			let dtext = new Date(depoch).toLocaleString();
+			$(el).html("<br>&nbsp;")
+			    .append($('<span>')
+				    .html("PUBLISHED on " + dtext)
+				    .addClass("goodtext"));
+		    } catch(err) {
+			console.log("Ignore error on published data "+err)
+		    }
+		}
+	    });
+	}
+    });
+    $('#publishcve5').on('click',function() {
+	let hm = get_modal();
+	hm.append("<h4><u>Submit CVE5 JSON To CVE Program</u></h4>");
+	hm.append($('<small>')
+		  .html("If needed edit and update JSON before submission. " +
+		       "Use the Tabs to compare CVE data in VINCE and " +
+			"in the CVE Services API")); 
+	hm.append($('<a>').addClass("dashboard-nav-card hide"));
+	hm.append($('<ul>').addClass("tabs hide")
+		  .append($('<li>').addClass("tabs-title")
+			  .append($('<a>').html("CVE VINCE")
+				  .addClass('cvevince cvetab')
+				  .attr("aria-selected","true"))
+			  .on('click', function(e) {
+			      load_cvedata('cvevince');
+			  }))
+		  .append($('<li>').addClass("tabs-title")
+			  .append($('<a>').html("CVE Program")
+				  .addClass('cveservices cvetab'))
+			  .on('click', function(e) {
+                              load_cvedata('cveservices');
+                          }
+			     ))); 
+	hm.append($('<textarea>')
+		  .attr({id:"cve5data",
+			 autocomplete:"off",
+			 autocorrect:"off",
+			 autocapitalize:"off",
+			 spellcheck: "false"})
+		  .css({height: "20em",
+			width: "100%",
+			border: "1px solid grey"})); 
+	let href = $('#cve5json').attr('href');
+	let el = hm.find(".dashboard-nav-card");
+	if(! href) {
+	    msg_card(el,"Missing CVE reference","bad");
+	    return;
+	}
+	$.getJSON(href,function(d) {
+	    if(deepGet(d,'containers.cna')) {
+		let cvedata = d.containers.cna;
+		/* Store full data both local vince version and
+		   remote cveservice version 
+		*/
+		$('#cve5data').val(json_pretty(cvedata))
+		    .data("cvevince",d);
+		if(deepGet(cvedata,"x_generator.origin")) {
+		    $.getJSON(deepGet(cvedata,"x_generator.origin"))
+			.done(function(d) {
+			    $('#cve5data').data("cveservices",d);
+			    hm.find('ul.tabs').removeClass('hide');
+			});
+		}
+		let btnSubmit = $('<button>').addClass('button primary')
+		    .html("Publish");
+		btnSubmit.on('click',function() {
+		    let msg = "This CVE will go fully public immediately! "+
+			"\nAre you Sure?";
+		    el.addClass('hide');
+		    if(confirm(msg))
+			$.ajax({'type':"POST",
+				'url': href + "submit/",
+				'data': $('#cve5data').val(),
+				contentType: 'application/json',
+				dataType: 'json'})
+			.done(function(ret) {
+			    let m = [{output: ret},{input:cvedata}];
+			    $('#cve5data').val(json_pretty(m));
+			    if("error" in ret) {
+				msg_card(el,"Error: "+ret.error,"bad");
+				$('#cve5data').addClass('is-invalid-input');
+			    } else if("message" in ret) {
+				msg_card(el,"Result: "+ret.message,"good");
+				$('#cve5data').removeClass('is-invalid-input');
+				if('updated' in ret) {
+				    $('#cve5data')
+					.data('cveservices',ret.updated);
+				    load_cvedata('cveservices');
+				}
+				
+			    } else {
+				/* the card-cr class looks like warning*/
+				msg_card(el,"Result: "+ret.message,"cr")
+			    }
+			});
+		});
+		let btnCancel = $('<button>').addClass('close-button')
+		    .html("X")
+		    .on('click',function() {
+			$('#xmodal').foundation('close');
+		    });
+		let l = $('<div>').addClass('row')
+		    .append($('<div>').addClass("columns large6 text-right")
+			    .append(btnSubmit)
+			    .append(btnCancel));
+		hm.append(l);
+	    }
+	});
+    });
 
 });
diff --git a/vince/templates/vince/case.html b/vince/templates/vince/case.html
index 2c2a904..f49012e 100644
--- a/vince/templates/vince/case.html
+++ b/vince/templates/vince/case.html
@@ -30,6 +30,7 @@
   <div class="row">
     <div class="large-10 medium-8 small-12 columns">
       <h2>{% if case.team_owner %}{{ case.team_owner.name }} {% endif %}Case <span id="vutitle">{{ case.vu_vuid }} - {{ case.title }}</span> {% autoescape off %}{{ case.get_status_html }}{% endautoescape %}</h2>
+      <input type="hidden" id="vuid" name="vuid" value="{{ case.vu_vuid }}">
     </div>
     <div class="large-2 medium-4 small-12 columns text-right">{% if case.lotus_notes %}{% else %}<a class="button cmu small-only-expanded primary" href="{% url 'vinny:vincase' case.id %}">View in VinceComm</a>{% endif %}</div>
   </div>
diff --git a/vince/templates/vince/case_summary.html b/vince/templates/vince/case_summary.html
index 348dcfb..1749474 100644
--- a/vince/templates/vince/case_summary.html
+++ b/vince/templates/vince/case_summary.html
@@ -175,13 +175,14 @@
 	<div class="large-9 medium-12 small-12 columns">
 	  <button class="button cmu tiny" id="addnewvendor" href="{% url 'vince:addvendor' %}"> <i class="fas fa-plus"></i> Add Vendor </button>
 	  <!--<a href="{% url 'vince:editvendorlist' case.id %}"><button class="button cmu tiny"><i class="fas fa-pencil-alt"></i> Edit Vendor</button></a>-->
-	  <button class="button cmu tiny" id="select-all-vendors"> Select All </button>
-	  <button class="button cmu tiny" id="deselect-all-vendors"> Deselect All </button>
+	  <button class="button cmu tiny" id="select-all-vendors" title="Select all" alt="Select all"> <i class="fas fa-check"></i> &nbsp; All </button>
+	  <button class="button cmu tiny" title="Unselect all" alt="Unselect all" id="deselect-all-vendors"> <i class="fas fa-square"></i>&nbsp; All </button>
 	  <button class="button cmu tiny" id="remove-vendor"> <i class="fas fa-trash"></i> Remove Vendor </button>
-	  <a href="{% url 'vince:approveall' case.id %}" id="approveall" class="button cmu tiny"><i class="fas fa-check"></i> Approve all</a>
+	  <a href="#" data-href="{% url 'vince:approveall' case.id %}" id="approveall" class="button cmu tiny"><i class="fas fa-thumbs-up"></i> Approve all</a>
 	  {% if case.lotus_notes %}
 	  {% else %}
 	  <a href="#" class="button cmu tiny" id="notifyvendors"><i class="fas fa-paper-plane"></i> Send Notifications</a>
+	  <a href="#" class="button cmu tiny" id="notifyall"><i class="fas fa-paper-plane"></i> Notify All</a>	  
 	  {% endif %}
 	  {% if case.lotus_notes %}{% else %}
 	  <a class="button cmu tiny" href="{% url 'vinny:groupchatcase' vc_case.id %}">Start Group Thread</a>
diff --git a/vince/templates/vince/casevendors.html b/vince/templates/vince/casevendors.html
index fa28a4e..ad15ccf 100644
--- a/vince/templates/vince/casevendors.html
+++ b/vince/templates/vince/casevendors.html
@@ -12,7 +12,8 @@
 
 <div class="row">
   <div class="large-12 columns">
-    <p class="text-center"><b><a href="#" class="allvendors">{{ vendors.count }} vendors</a> | {% with notify=vendors|notified_filter %} {% if notify < vendors.count %}<a href="#" class="notnotified" title="filter vendors that have not been notified" style="color:red" >{{ notify }} notified </a>{% else %}{{ notify }} notified {% endif %}{% endwith %} {% if zero_user_vendors %}| <a href="#" style="color:red" title="filter vendors with no users" class="vendorsnousers">{{ zero_user_vendors }} vendors with no users </a> {% endif %} | <a href="#" title="filter vendors that have viewed the case" class="vendorsseen">{{ vendors|seen_filter }} seen</a> | <a href="#" title="filter vendors that have provided status/statement" class="vendorsresponded">{{ vendors|stmt_filter }} responded</a> | <a href="#" style="color:green" class="vendorapproved">{{ vendors|approved_filter }} approved</a> | {% with r=vendors|requires_approval_filter %} {% if r > 0 %}<a href="#" style="color:red" class="reqapproval">{{ r }} require approval </a>{% else %} {{ r }} require approval {% endif %}{% endwith %}</b></p>
+    <p class="text-center"><b><a href="#" class="allvendors">{{ total }} vendors</a> |  {% if is_notified < total %}<a href="#" class="notnotified" title="filter vendors that have not been notified" style="color:red" >{{ is_notified }} notified </a>{% else %}{{ is_notified }} notified {% endif %} {% if zero_user_vendors %}| <a href="#" style="color:red" title="filter vendors with no users" class="vendorsnousers">{{ zero_user_vendors }} vendors with no users </a> {% endif %} | <a href="#" title="filter vendors that have viewed the case" class="vendorsseen">{{  has_seen }} seen</a> | <a href="#" title="filter vendors that have provided status/statement" class="vendorsresponded">{{  has_responded }} responded</a> | <a href="#" style="color:green" class="vendorapproved">{{ is_approved }} approved</a> | {% if needs_approval > 0 %}<a href="#" style="color:red" class="reqapproval">{{ needs_approval }} require approval </a> {% endif %}</b>
+    </p>
   </div>
 </div>
 <div id="vendor_notify" action="{% url 'vince:vnotifydraft' case.id %}"></div>
diff --git a/vince/templates/vince/cveform.html b/vince/templates/vince/cveform.html
index 5071de6..c01098d 100644
--- a/vince/templates/vince/cveform.html
+++ b/vince/templates/vince/cveform.html
@@ -30,7 +30,7 @@ <h2>Create a CVE</h2>
     <ul class="breadcrumbs">
       <li><a href="{% url 'vince:case' vul.case.id %}#vuls">Case</a></li>
       <li><a href="{% url 'vince:vul' vul.id %}">Vulnerability</a></li>
-      <li><span class="show-for-sr">Current: </span> Edit CVE</li>
+      <li><span class="show-for-sr">Current: </span> Edit CVE (JSON5)</li>
     </ul>
   </nav>
   </div>
@@ -137,16 +137,16 @@ <h5>Error submitting form: <b>{{ error }}</b></h5>
 		{% render_field subform.name class="form-control" %}
 	      </td>
 	      <td>
-		<label for="cve_version_num">Version Number: <span class='required'>*</span></label>
+		<label for="cve_version_num">Version (or Starts): <span class='required'>*</span></label>
 		{% render_field subform.version_value class="form-control" %}
 	      </td>
 	      <td>
-		<label for="cve_version_num">Version Affected: </label>
+		<label for="cve_version_num">Range Type: </label>
 		{% render_field subform.version_affected class="form-control" %}
 	      </td>
 	      
 	      <td> 
-		<label for="cve_version_name">Version Name:</label>
+		<label for="cve_version_name">Range End:</label>
 		{% render_field subform.version_name class="form-control" %}
 	      </td>
 	      <td></td>
diff --git a/vince/templates/vince/vul.html b/vince/templates/vince/vul.html
index c04cdf9..e920bfe 100644
--- a/vince/templates/vince/vul.html
+++ b/vince/templates/vince/vul.html
@@ -29,7 +29,7 @@
       <h2><i class="fas fa-skull"></i> {{ vul.vul }} <a href="{{ vul.case.get_absolute_url }}">({{ vul.case.get_vuid }})</a></h2>
     </div>
     <div class="large-4 columns text-right">
-      <a href="{% url 'vince:editvul' vul.id %}" class="openeditmodal"><button class="button cmu"><i class="fas fa-pen"></i> Edit Vulnerability</button></a>
+      <!-- Removed link to Edit Vulnerability -->
     </div>
   </div>
 </div>
@@ -96,14 +96,20 @@ <h3 class="section-title">{% if vul|cve_complete %}<i title="All information is
     {% if vul.cveallocation %}
     <a title="edit cve json file" class="button default small" href="{% url 'vince:cve' vul.cveallocation.id %}"><i class="fas fa-pen"></i> Edit CVE Record</a>
     {% if vul|cve_complete %}
-    <a class="downloadcvefile button default small" href="{% url 'vince:download_cve' vul.cveallocation.id %}" title="download json file"><i class="fas fa-file-download"></i>  Download CVE JSON</a>{% endif %}
+    <a class="downloadcvefile button default small" href="{% url 'vince:download_cve' vul.cveallocation.id %}" title="download json file">
+      CVE(4) JSON <i class="fas fa-file-download"></i>
+    </a>
+    <a class="downloadcvefile button default small" id="cve5json" title="download"  href="{% url 'vince:download_cve5' vul.cveallocation.id %}" download="VINCE-CVE-{{ vul.cve }}.json">
+      CVE(5) JSON <i class="fas fa-file-download"></i>
+    </a>
+    {% endif %}
     {% else %}
     <a title="Create New CVE" href="{% url 'vince:newcve' vul.id %}" class="button default small">Create CVE JSON</a>
     {% endif %}
   </div>
 </div>
 <div class="row">
-  <div class="large-12 columns">
+  <div class="large-6 columns">
     {% if vul.cveallocation.cvereservation and vul.cve %}
     {% if vul.cveallocation.cvereservation.cve_id != vul.vul %}
     <div class="callout alert">The CVE ID reserved for this vulnerability ({{ vul.cveallocation.cvereservation.cve_id }}) does not match the CVE ID provided for this vulnerability.</div>
@@ -111,7 +117,10 @@ <h3 class="section-title">{% if vul|cve_complete %}<i title="All information is
     {% endif %}
     <b>CVE:</b><span id="exportId">{% if vul.cve %} CVE-{{ vul.cve }} {% else %} Unspecified {% endif %}</span>
     <br/>
-    <b>Status:</b> {% if vul.cveallocation.cvereservation %}<span class="goodtext">RESERVED by {{ vul.cveallocation.cvereservation.user_reserved.usersettings.preferred_username }} on {{ vul.cveallocation.cvereservation.time_reserved|date:"Y-m-d" }} </span>{% elif vul.cve %}CVE not obtained through VINCE{% else %}CVE not obtained{% endif %}
+    <b>Status:</b> {% if vul.cveallocation.cvereservation %}<span class="cvestatus goodtext">RESERVED by {{ vul.cveallocation.cvereservation.user_reserved.usersettings.preferred_username }} on {{ vul.cveallocation.cvereservation.time_reserved|date:"Y-m-d" }} </span>{% elif vul.cve %}CVE not obtained through VINCE{% else %}CVE not obtained{% endif %}
+    {% if cve_status %}
+    <span class="cve_status" data-origin="{{ cve_status }}"></span>
+    {% endif %}
     <br/>
     <b>Date Public</b>: {{ vul.cveallocation.date_public|date:"Y-m-d" }}
     <br/>
@@ -141,14 +150,46 @@ <h3 class="section-title">{% if vul|cve_complete %}<i title="All information is
     {% if vul.cveallocation.cveaffectedproduct_set.all|length > 0 %}
     <b>Products:</b><br/>
     {% for product in vul.cveallocation.cveaffectedproduct_set.all %}
-    {{ product.name }}, {{ product.organization }}, {% if product.version_name %}{{ product.version_name }}{% endif %} {% if product.version_affected %}{{ product.version_affected }}{% endif %} {{ product.version_value }}<br/>
+    <ol type="1">
+        <li>&nbsp; {{ product.organization }} - {{ product.name }}
+            <ol type="a">
+              <li>
+		{% if product.version_name and product.version_affected %}
+		Range 
+		{% endif %}
+		{{ product.version_value }}
+		{% if product.version_affected %}
+		{{ product.version_affected }}
+		{% endif %} 
+		{% if product.version_name %}
+		{{ product.version_name }}
+		{% endif %}
+                </li>
+            </ol>
+        </li>
+    </ol>
     {% endfor %}
     {% else %}
     <b class="required">No products</b>
     {% endif %}
   </div>
+  <div class="large-6 columns text-right">
+    <!--
+    <a title="Reject this CVE"
+       id="rejectcve5" class="button small cmu">
+      <i class="fas fa-ban"></i> Reject CVE5
+    </a>
+    -->
+    {% if vul|cve_complete %}
+    <a title="Publish/Update CVE via CVE services API"
+       id="publishcve5" class="button small primary">
+      <i class="fas fa-upload"></i> Publish CVE5
+    </a>
+    {% endif %}
+  </div>
 </div>
 
+
 <hr>
 <div class="row">
   <div class="large-12 columns">
diff --git a/vince/templates/vince/vuls.html b/vince/templates/vince/vuls.html
index ba1830c..39f8ad2 100644
--- a/vince/templates/vince/vuls.html
+++ b/vince/templates/vince/vuls.html
@@ -25,7 +25,7 @@ <h2>Case <a href="{{ case.get_absolute_url }}"> {{ case.get_vuid }} </a>Vulnerab
     </div>
   </div>
 </div>
-
+  <div class="reveal large" id="largemodal" data-reveal data-close-on-click="false"></div>
 <div class="row">
   <div class="large-12 columns">
     {% for message in messages %}
diff --git a/vince/urls.py b/vince/urls.py
index ffb5dfa..fa097a5 100644
--- a/vince/urls.py
+++ b/vince/urls.py
@@ -152,6 +152,8 @@
     re_path(r'^cve/(?P<vul>[0-9]+)/create/$', views.CVEFormView.as_view(), name='newcve'),
     re_path(r'^cve/create/$', views.CVEFormView.as_view(), name='newcve'),
     re_path(r'^cve/(?P<pk>[0-9]+)/download/$', views.DownloadCVEJson, name='download_cve'),
+    re_path(r'^cve/(?P<pk>[0-9]+)/cve5/$', views.CreateCVE5Json, name='download_cve5'),
+    re_path(r'^cve/(?P<pk>[0-9]+)/cve5/submit/$', views.submitCVE5JSON.as_view(), name='submit_cve5'),        
     re_path(r'^cve/(?P<pk>[0-9]+)/edit/$', views.EditCVEView.as_view(), name='cve'),
     path('case_template/new/', views.NewCaseTemplate.as_view(), name='newtmpl'),
     path('case_template/filter/', views.CaseTemplateFilterView.as_view(), name='filtertmpl'),
@@ -325,7 +327,7 @@
     path('manage/bounces/', views.VINCEBounceManager.as_view(), name='bouncemanager'),
 ]
 try:
-    if settings.MULTIURL_CONFIG or settings.VINCE_NAMESPACE == "vince":
+    if settings.MULTIURL_CONFIG:
         urlpatterns.extend([
             path('login/', cogauth_views.COGLoginView.as_view(template_name='vince/tracklogin.html'), name="login"),
             path('login/mfa/', cogauth_views.MFAAuthRequiredView.as_view(), name='mfaauth'),
@@ -338,8 +340,8 @@
             path('logout/', auth_views.LogoutView.as_view(template_name='vince/logout.html'), name="logout"),
         ])
         
-except Exception as e:
-    print("Error when trying to detect VINCE_NAMESPACE %s" %(str(e)))
+
+except:
     urlpatterns.extend([
         path('login/', auth_views.LoginView.as_view(template_name='vince/login.html'), name='login'),
         path('logout/', auth_views.LogoutView.as_view(template_name='vince/logout.html'), name="logout")
diff --git a/vince/views.py b/vince/views.py
old mode 100644
new mode 100755
index ecedf69..22e4010
--- a/vince/views.py
+++ b/vince/views.py
@@ -94,10 +94,16 @@
 from vince.settings import VULNOTE_TEMPLATE
 from collections import OrderedDict
 from django.utils.http import is_safe_url
+from lib.vince import utils as vinceutils
+from rest_framework.views import APIView
+import pathlib
+import mimetypes
 
 logger = logging.getLogger(__name__)
 logger.setLevel(logging.DEBUG)
 
+def json_error(msg):
+    return JsonResponse({"error":msg})
 
 def get_cve_info(context,acc):
     context['cve_service'] = acc
@@ -132,6 +138,48 @@ def object_to_json_response(obj, status=200):
         data=obj, status=status, safe=False, json_dumps_params={'ensure_ascii': False},
     )
 
+
+def filterDateFields(GET,initial={}):
+    date_from = GET.get('date_from')
+    if date_from:
+        try:
+            initial['datestart'] = DateField().clean(date_from)
+        except Exception as e:
+            logger.info(f"Error while parsing date {e}")
+    date_to = GET.get('date_to')
+    if date_to:
+        try:
+            initial['dateend'] = DateField().clean(date_to)
+        except Exception as e:
+            logger.info(f"Error while parsing date {e}")
+    return initial
+
+
+def filterDateTimeFields(POST,res,crit='created__range'):
+    enddate = DateTimeField().clean(datetime.now()) + timedelta(days=1)
+    startdate = DateTimeField().clean('1970-01-01')
+    doFilter = False
+    if 'dateend' in POST:
+        v = POST['dateend']
+        try:
+            enddate = DateTimeField().clean(v) + timedelta(days=1)
+            doFilter = True
+        except Exception as e:
+            logger.info(f"Error when parsing date field error {e} for {v}")
+    if 'datestart' in POST:
+        v = POST['datestart']
+        try:
+            startdate = DateTimeField().clean(v)
+            doFilter = True
+        except Exception as e:
+            logger.info(f"Error when parsing date field error {e} for {v}")
+    if doFilter:
+        try:
+            res = res.filter(**{crit :(startdate,enddate)})
+        except Exception as e:
+            logger.info(f"Filtering failed for DateTimeField error {e}")
+    return res
+
 @register.filter(name='leading_zeros')
 def leading_zeros(value, desired_digits):
     return str(value).zfill(desired_digits)
@@ -1291,18 +1339,17 @@ def test_func(self):
 
     def get(self, request, *args, **kwargs):
         try:
-            attachment = Attachment.objects.filter(uuid=self.kwargs['path']).first()
+            file_uuid = self.kwargs['path']
+            attachment = Attachment.objects.filter(uuid=file_uuid).first()
             # if the UUID is not valid, this will throw a ValidationError
         except:
             raise Http404
 
         if attachment:
             filename = attachment.filename
-            # do this for old files
-            filename = filename.replace("\r", "")
-            filename = filename.replace("\n", "")
-            filename = filename.strip()
             mime_type = attachment.mime_type
+            filename = vinceutils.safe_filename(filename,file_uuid,mime_type)
+                    
             response = HttpResponseRedirect(attachment.access_url, content_type = mime_type)
 
             #test URL
@@ -1311,7 +1358,7 @@ def get(self, request, *args, **kwargs):
                 if not(attachment.file.storage.exists(str(attachment.uuid))):
                     raise Http404
                 else:
-                    url = attachment.file.storage.url(str(attachment.uuid), parameters={'ResponseContentDisposition': f'attachment; filename="{attachment.filename}"'})
+                    url = attachment.file.storage.url(str(attachment.uuid), parameters={'ResponseContentDisposition': f'attachment; filename="{filename}"'})
                     response = HttpResponseRedirect(url)
 
             response['ResponseContentDisposition'] = f"attachment; filename=\"{filename}\""
@@ -1613,16 +1660,8 @@ def post(self, request, *args, **kwargs):
             statuslist = self.request.POST.getlist('status')
             res = res.filter(status__in=statuslist)
 
-        if 'datestart' in self.request.POST:
-            # add a day to dateend since it translates to 0AM
-            enddate = DateTimeField().clean(self.request.POST['dateend']) + timedelta(days=1)
-            if self.request.POST['datestart']:
-                res = res.filter(created__range=(DateTimeField().clean(self.request.POST['datestart']),
-                                                 enddate))
-            elif 'dateend' in self.request.POST:
-                if self.request.POST['dateend']:
-                    res = res.filter(created__range=(DateTimeField().clean('1970-01-01'),
-                                                     enddate))
+        res = filterDateTimeFields(self.request.POST,res,'created__range')
+
         if 'queue' in self.request.POST:
             queuelist = self.request.POST.getlist('queue')
             res = res.filter(queue__id__in=queuelist)
@@ -1756,14 +1795,7 @@ def post(self, request, *args, **kwargs):
 
         page = self.request.POST.get('page', 1)
 
-        if 'datestart' in self.request.POST:
-            # add a day to dateend since it translates to 0AM
-            enddate = DateTimeField().clean(self.request.POST['dateend']) + timedelta(days=1)
-            if self.request.POST['datestart']:
-                res = res.filter(date__range=(DateTimeField().clean(self.request.POST['datestart']),enddate))
-            elif 'dateend' in self.request.POST:
-                if self.request.POST['dateend']:
-                    res = res.filter(date__range=(DateTimeField().clean('1970-01-01'), enddate))
+        res = filterDateTimeFields(self.request.POST,res,'date__range')
 
         if 'user' in self.request.POST:
             userlist = self.request.POST.getlist('user')
@@ -1794,13 +1826,7 @@ def get_context_data(self, **kwargs):
         context['triage_user'] = get_triage_users(self.request.user)
         assignable_users = User.objects.filter(is_active=True, groups__name='vince').order_by(User.USERNAME_FIELD)
 
-        date_from = self.request.GET.get('date_from')
-        initial = {}
-        if date_from:
-            initial['datestart'] = DateField().clean(date_from)
-        date_to = self.request.GET.get('date_to')
-        if date_to:
-            initial['dateend'] = DateField().clean(date_to)
+        initial = filterDateFields(self.request.GET,{})
         if self.request.GET.get('user'):
             initial['user'] = int(self.request.GET.get('user'))
         form = ActivityFilterForm(initial=initial)
@@ -1825,13 +1851,8 @@ def get_context_data(self, **kwargs):
 
         readable_queues = TicketQueue.objects.filter(queuepermissions__group__in=self.request.user.groups.all(), queuepermissions__group_read=True).distinct()
 
-        date_from = self.request.GET.get('date_from')
-        initial = {}
-        if date_from:
-            initial['datestart'] = DateField().clean(date_from)
-        date_to = self.request.GET.get('date_to')
-        if date_to:
-            initial['dateend'] = DateField().clean(date_to)
+        initial = filterDateFields(self.request.GET,{})
+
         if self.request.GET.get('owner'):
             initial['owner'] = int(self.request.GET.get('owner'))
         queue = self.request.GET.get('queue')
@@ -2081,14 +2102,9 @@ def post(self, request, *args, **kwargs):
                 vt_results = vt_results.filter(caseaction__vendor__in=vendorlist)
             if participantlist:
                 vt_results = vt_results.filter(caseaction__title__icontains="Participant")
-            if 'datestart' in self.request.POST:
-                enddate = DateTimeField().clean(self.request.POST['dateend']) + timedelta(days=1)
-                if self.request.POST['datestart']:
-                    vt_results = vt_results.filter(date__range=(DateTimeField().clean(self.request.POST['datestart']), enddate))
-            elif 'dateend' in self.request.POST:
-                if self.request.POST['dateend']:
-                    vt_results=vt_results.filter(date__range=(DateTimeField().clean('1970-01-01'),
-                                                     enddate))
+
+            vt_results = filterDateTimeFields(self.request.POST,vt_results,'dat__range')
+
             if keyword:
                 vt_results = vt_results.filter((Q(title__icontains=keyword) | Q(comment__icontains=keyword)))
                 print("AFTER KEYWORDS SEARCH")
@@ -2114,7 +2130,7 @@ def post(self, request, *args, **kwargs):
                           reverse=True)
 
         paginator = Paginator(activity, 10)
-        return render(request, self.template_name, {'activity': activity, 'total': activity.count(), 'case': case, 'allow_edit': True})
+        return render(request, self.template_name, {'activity': activity, 'total': len(activity), 'case': case, 'allow_edit': True})
 
 
 class CaseFilterResults(LoginRequiredMixin, TokenMixin, UserPassesTestMixin, generic.ListView):
@@ -2153,15 +2169,7 @@ def post(self, request, *args, **kwargs):
                 res = res.filter(status__in=statuslist)
 
 
-        if 'datestart' in self.request.POST:
-            enddate = DateTimeField().clean(self.request.POST['dateend']) + timedelta(days=1)
-            if self.request.POST['datestart']:
-                res = res.filter(created__range=(DateTimeField().clean(self.request.POST['datestart']),
-                                                 enddate))
-            elif 'dateend' in self.request.POST:
-                if self.request.POST['dateend']:
-                    res = res.filter(created__range=(DateTimeField().clean('1970-01-01'),
-                                                     enddate))
+        res = filterDateTimeFields(self.request.POST,res,'created__range')
 
         if 'owner' in self.request.POST:
             ownerlist = self.request.POST.getlist('owner')
@@ -2229,14 +2237,8 @@ def get_context_data(self, **kwargs):
         context = super(CaseFilter, self).get_context_data(**kwargs)
 
         assignable_users = User.objects.filter(is_active=True, groups__name='vince').order_by(User.USERNAME_FIELD)
-        context['casepage']=1
-        date_from = self.request.GET.get('date_from')
-        initial = {}
-        if date_from:
-            initial['datestart'] = DateField().clean(date_from)
-        date_to = self.request.GET.get('date_to')
-        if date_to:
-            initial['dateend'] = DateField().clean(date_to)
+        context['casepage'] = 1
+        initial = filterDateFields(self.request.GET,{})
         owner = self.request.GET.get('owner')
         if self.request.GET.get('owner'):
             initial['owner'] = int(owner)
@@ -2881,8 +2883,8 @@ def post(self, request, *args, **kwargs):
         unmute = False
         settings = user.usersettings.settings
         if user.usersettings.settings.get('muted_cases'):
-            logger.debug(f"User {user} has muted cases {muted_cases}")
             muted_cases = user.usersettings.settings['muted_cases']
+            logger.debug(f"User {user} has muted cases {muted_cases}")
             if case.id in muted_cases:
                 #this case has already been muted, unmute this case:
                 muted_cases.remove(case.id)
@@ -5763,7 +5765,6 @@ def get_context_data(self, **kwargs):
         #Assume we have not vrf_url unless we get one from below methods
         context['vrf_url'] = None
         context['vincecomm_link'] = None
-        
         if hasattr(context['case'],'case_request') and context['case'].case_request:
             if hasattr(context['case'].case_request,'caserequest'):
                 context['cr'] = context['case'].case_request.caserequest
@@ -6566,27 +6567,21 @@ def	test_func(self):
     def get_context_data(self, **kwargs):
         context = super(CaseVendors, self).get_context_data(**kwargs)
         case = get_object_or_404(VulnerabilityCase, id=self.kwargs['pk'])
-        context['vendors'] = VulnerableVendor.casevendors(case).order_by('vendor')
-        context['vendorsjs'] = [obj.as_dict() for obj in context['vendors']]
-
-        zero_user_vendors = 0
-        #update dictionary to show which vendor group has active users
-        for vjs in context['vendorsjs']:
-            cid = vjs['contact_id']
-            vc_contact = VinceCommContact.objects.using('vincecomm').filter(vendor_id=cid).first()
-            if vc_contact:
-                groupcontact = GroupContact.objects.using('vincecomm').filter(contact=vc_contact).first()
-                if groupcontact:
-                    count = User.objects.using('vincecomm').filter(groups=groupcontact.group).count()
-                    if count == 0:
-                        zero_user_vendors += 1
-                    vjs.update({'users':count})
-                    continue
-            vjs.update({'users': 0})
-            zero_user_vendors += 1
-
-        context['zero_user_vendors'] = zero_user_vendors
-
+        summary = VulnerableVendor.casevendors(case).aggregate(
+            total=Count('id'),
+            is_notified=Count('id',filter=Q(contact_date__isnull=False)),
+            has_seen=Count('id',filter=Q(seen=True)),
+            has_responded=Count('id',filter=Q(statement_date__isnull=False)),
+            is_approved=Count('id',filter=Q(approved=True)),
+            needs_approval=Count('id',filter=Q(statement_date__isnull=False,
+                                               approved=False)))
+        for x in summary:
+            context[x] = summary[x]
+        vcase = Case.objects.using("vincecomm").filter(vuid=case.vuid).first()
+        if vcase:
+            context['zero_user_vendors'] = CaseMember.objects.using("vincecomm").filter(case=vcase,group__user__isnull=True).count()
+        else:
+            context['zero_user_vendors'] = 0
         context['case'] = case
         return context
 
@@ -10277,7 +10272,7 @@ def form_valid(self, form):
             if getattr(contact,pvar) != self.request.POST.get(pvar,getattr(contact,pvar)):
                 _add_activity(self.request.user, 3, contact, f"modified {pvar}")
                 some_changes=True
-        newcomment = self.request.POST.get('comment',"")
+        new_comment = self.request.POST.get('comment',"")
         if contact.comment != new_comment:
             if not((contact.comment == None) and (newcomment == '')):
                 if newcomment == "":
@@ -11675,7 +11670,7 @@ def post(self, request, *args, **kwargs):
                 form.add_error(None, "At least one Product is required")
                 return self.form_invalid(form)
         else:
-            logger.debug(f"Form errors in {self.__class__.__name__} si {f.errors}")            
+            logger.debug(f"Form errors in {self.__class__.__name__} is {form.errors}")
             return self.form_invalid(form)
 
     def form_valid(self, form):
@@ -12419,6 +12414,15 @@ def get_context_data(self, **kwargs):
         user_groups= self.request.user.groups.exclude(groupsettings__contact__isnull=True)
         context['vul_tags'] = [tag.tag for tag in context['vul'].vulnerabilitytag_set.all()]
         context['allowed_tags'] = [tag.tag for tag in TagManager.objects.filter(tag_type=4).filter(Q(team__in=user_groups)|Q(team__isnull=True)).order_by('tag').distinct('tag')]
+        if hasattr(context['vul'],'cve') and context['vul'].cve:
+            cve = context['vul'].cve.upper()
+            if cve.find("CVE-") < 0:
+                cve = f"CVE-{cve}"
+            if cvelib.CveApi.ENVS.get(settings.CVE_SERVICES_API):
+                cve_url = cvelib.CveApi.ENVS.get(settings.CVE_SERVICES_API)
+                if cve_url[-1] != '/':
+                    cve_url = cve_url + '/'
+                context['cve_status'] = f"{cve_url}cve-id/{cve}"
         return context
 
 class VendorStatusListView(LoginRequiredMixin, TokenMixin, UserPassesTestMixin, generic.TemplateView):
@@ -12993,14 +12997,7 @@ def post(self, request, *args, **kwargs):
 
         page = self.request.POST.get('page', 1)
 
-        if 'datestart' in self.request.POST:
-            # add a day to dateend since it translates to 0AM
-            enddate = DateTimeField().clean(self.request.POST['dateend']) + timedelta(days=1)
-            if self.request.POST['datestart']:
-                res = res.filter(created__range=(DateTimeField().clean(self.request.POST['datestart']), enddate))
-            elif 'dateend' in self.request.POST:
-                if self.request.POST['dateend']:
-                    res = res.filter(created__range=(DateTimeField().clean('1970-01-01'), enddate))
+        res = filterDateTimeFields(self.request.POST,res,'created__range')
 
         if 'queue' in self.request.POST:
             queuelist = self.request.POST.getlist('queue')
@@ -13033,12 +13030,7 @@ def get_context_data(self, **kwargs):
         bounces = FollowUp.objects.filter(title__istartswith="Email Bounce Notification", ticket__status__in=[Ticket.OPEN_STATUS, Ticket.REOPENED_STATUS])
         context['pbounces'] = BounceEmailNotification.objects.filter(bounce_type=BounceEmailNotification.PERMANENT, action_taken=False)
         date_from = self.request.GET.get('date_from')
-        initial = {}
-        if date_from:
-            initial['datestart'] = DateField().clean(date_from)
-        date_to = self.request.GET.get('date_to')
-        if date_to:
-            initial['dateend'] = DateField().clean(date_to)
+        initial = filterDateFields(self.request.GET,{})
         queue = self.request.GET.get('queue')
         if queue:
             queue = TicketQueue.objects.filter(title=queue).first()
@@ -13698,16 +13690,7 @@ def post(self, request, *args, **kwargs):
             ownerlist = self.request.POST.getlist('user')
             res = res.filter(user__id__in=ownerlist)
 
-        if 'datestart' in self.request.POST:
-            # add a day to dateend since it translates to 0AM
-            enddate = DateTimeField().clean(self.request.POST['dateend']) + timedelta(days=1)
-            if self.request.POST['datestart']:
-                res = res.filter(created__range=(DateTimeField().clean(self.request.POST['datestart']),
-                                                 enddate))
-            elif 'dateend' in self.request.POST:
-                if self.request.POST['dateend']:
-                    res = res.filter(created__range=(DateTimeField().clean('1970-01-01'),
-                                                     enddate))
+        res = filterDateTimeFields(self.request.POST,res,'created__range')
 
         if 'wordSearch' in self.request.POST:
             if self.request.POST['wordSearch']:
@@ -13735,13 +13718,7 @@ def test_func(self):
     def get_context_data(self, **kwargs):
         context = super(EmailFilterView, self).get_context_data(**kwargs)
         context['emailpage'] = 1
-        date_from = self.request.GET.get('date_from')
-        initial = {}
-        if date_from:
-            initial['datestart'] = DateField().clean(date_from)
-        date_to = self.request.GET.get('date_to')
-        if date_to:
-            initial['dateend'] = DateField().clean(date_to)
+        initial = filterDateFields(self.request.GET,{})
         if self.request.GET.get('user'):
             initial['user'] = int(self.request.GET.get('user'))
         if self.request.GET.get('method'):
@@ -14269,6 +14246,164 @@ def DownloadCVEJson(request, pk):
         response["Pragma"] = "must-revalidate"
         return response
 
+@login_required(login_url="vince:login")
+@user_passes_test(is_in_group_vincetrack, login_url='vince:login')
+def CreateCVE5Json(request, pk):
+    if is_in_group_vincetrack(request.user):
+        cve = CVEAllocation.objects.filter(id=pk).first()
+        cvss = VulCVSS.objects.filter(vul = cve.vul).first()
+        if not cve:
+            return JsonResponse({})
+
+        cvss = VulCVSS.objects.filter(vul = cve.vul).first()
+        cna = {}
+        if cve.title:
+            title = cve.title
+        else:
+            title = cve.cve_name
+        
+        cna["title"] = title
+        cna["descriptions"] = [{"lang": "en","value": cve.vul.description }]
+        cna["source"] = {"discovery": cve.source if cve.source else "UNKNOWN"}
+        affected = []
+        products = cve.cveaffectedproduct_set.all()
+        for p in products:
+            affect = {"vendor": p.organization,
+                      "product": p.name,
+                      "versions": [{
+                          "status": "affected",
+                          "version": p.version_value
+                          }]
+                      }
+            if p.version_affected and p.version_name:
+                affect["versions"][0][p.version_affected] = p.version_name
+                affect["versions"][0]["versionType"] = "custom"
+            affected.append(affect)
+        cna["affected"] = affected
+        problems = []
+        if cve.cwe:
+            for cwe in json.loads(cve.cwe):
+                problems.append({"descriptions": [
+                    {
+                        "lang": "en",
+                        "description": cwe
+                    }
+                ]})
+        if problems:
+            cna["problemTypes"] = problems
+        refs = []
+        if cve.references:
+            for ref in json.loads(cve.references):
+                if type(ref) is dict and "url" in ref:
+                    refs.append({"url": ref["url"]})
+        if refs:
+            cna["references"] = refs
+        metrics = []
+        if cvss:
+            if cvss.score:
+                cvss_score = float(cvss.score)
+            else:
+                cvss_score = 0            
+            metrics.append({
+                "format": "CVSS",
+                "scenarios": [
+                    {
+                        "lang": "en",
+                        "value": "GENERAL"
+                    }
+                ],
+                "cvssV3_1": {
+                    "version": "3.1",
+                    "attackVector":cvss_translator(cvss.AV, "AV"),
+                    "attackComplexity":cvss_translator(cvss.AC, "AC"),
+                    "privilegesRequired":cvss_translator(cvss.PR, "PR"),
+                    "userInteraction":cvss_translator(cvss.UI, "UI"),
+                    "scope":cvss_translator(cvss.S, "S"),
+                    "confidentialityImpact": cvss_translator(cvss.C, "C"),
+                    "integrityImpact":cvss_translator(cvss.I, "I"),
+                    "availabilityImpact":cvss_translator(cvss.A, "A"),
+                    "vectorString":cvss.vector,
+                    "baseScore":cvss_score,
+                    "baseSeverity":cvss.severity.upper()
+                }})
+        if metrics:
+            cna["metrics"] = metrics
+        cve_id = cve.cve_name.upper()
+        if cve_id.find("CVE-") < 0:
+            cve_id = f"CVE-{cve_id}"
+        cna["x_generator"] = {"engine": "VINCE "+settings.VERSION}
+        if cvelib.CveApi.ENVS.get(settings.CVE_SERVICES_API):
+            cve_url = cvelib.CveApi.ENVS.get(settings.CVE_SERVICES_API)
+            if cve_url[-1] != '/':
+                cve_url = cve_url + '/'
+            cna["x_generator"]["env"] = settings.CVE_SERVICES_API
+            cna["x_generator"]["origin"] = f"{cve_url}cve/{cve}"
+
+        cve5 = {"dataType": "CVE_RECORD",
+                "dataVersion": "5.0",
+                "cveMetadata": {
+                    "cveId": cve_id,
+                    "assignerOrgId": "00000000-0000-0000-0000-000000000000",
+                    "state": "PUBLISHED"
+                },
+                "containers": {
+                    "cna": cna
+                }
+                }            
+        return JsonResponse(cve5)
+
+class submitCVE5JSON(LoginRequiredMixin, UserPassesTestMixin, APIView):
+
+    def test_func(self):
+        return is_in_group_vincetrack(self.request.user)
+
+    
+    def post(self, request, *args, **kwargs):
+        
+        my_teams = self.request.user.groups.exclude(groupsettings__contact__isnull=True)
+        cve = CVEAllocation.objects.filter(id=self.kwargs.get('pk',"")).first()
+        
+        account = CVEServicesAccount.objects.filter(team__in=my_teams).first()
+
+        if not account:
+            return json_error("No CVE Services Account available")
+        if not cve:
+            return json_error("No Matching CVE data found")
+        if not cve.cve_name:
+            return json_error("This CVE does not have a CVE Number allocated")
+        
+        cve_lib = cvelib.CveApi(account.email, account.org_name,
+                                account.api_key, env=settings.CVE_SERVICES_API)
+        if not cve_lib.ping() is None:
+            return json_error("CVE services down")
+        try:
+            cve_json = json.loads(request.body)
+        except Exception as e:
+            logger.info(f"No JSON body found for {self.__class__.__name__} {request.body} Error is {e}")
+            return json_error(f"Error No JSON body or an incorrect JSON body submitted")
+        try:
+            cve_id = cve.cve_name.upper()
+            if cve_id.find("CVE-") < 0:
+                cve_id = f"CVE-{cve_id}"
+            cve = cve_lib.show_cve_id(cve_id)
+            if 'state' in cve and cve['state'] == "PUBLISHED":
+                ret = cve_lib.update_published(cve_id,cve_json)
+            else:
+                ret = cve_lib.publish(cve_id,cve_json)
+            return JsonResponse(ret)
+        except Exception as e:
+            #25299 cross reference number
+            logger.info(f"CVE5 25299 JSON submitted error {e}")
+            if hasattr(e,"errors"):
+                return json_error(str(e.errors))
+            elif hasattr(e,'response') and hasattr(e.response,'content'):
+                if type(e.response.content) == bytes:
+                    return json_error(e.response.content.decode())
+                return json_error(str(e.response.content))
+            return json_error("Error 25299 CVE JSON Submission failed")
+            
+            
+    
 class ReadEmailAdminView(LoginRequiredMixin, TokenMixin, UserPassesTestMixin, generic.FormView):
     login_url = "vince:login"
     template_name = "vince/process_email.html"
diff --git a/vinny/forms.py b/vinny/forms.py
index 4fdcd28..46839b1 100644
--- a/vinny/forms.py
+++ b/vinny/forms.py
@@ -148,6 +148,7 @@ class SendMessageUserForm(forms.ModelForm):
     subject = forms.CharField(
         required = True,
         label=_('Subject'),
+        max_length=Thread._meta.get_field('subject').max_length,
     )
 
     case = forms.ChoiceField(
diff --git a/vinny/models.py b/vinny/models.py
index 633e8fb..3a66642 100644
--- a/vinny/models.py
+++ b/vinny/models.py
@@ -57,6 +57,7 @@
 import mimetypes
 from django.dispatch import Signal
 import io
+from lib.vince import utils as vinceutils
 
 logger = logging.getLogger(__name__)
 logger.setLevel(logging.DEBUG)
@@ -634,7 +635,8 @@ def __str__(self):
         return '%s' % self.filename
 
     def _get_access_url(self):
-        url = self.file.storage.url(self.file.name, parameters={'ResponseContentDisposition': f'attachment; filename="{self.filename}"'}, expire=10)
+        filename = vinceutils.safe_filename(self.filename,str(self.uuid),self.mime_type)
+        url = self.file.storage.url(self.file.name, parameters={'ResponseContentDisposition': f'attachment; filename="{filename}"'}, expire=10)
         return url
     
     access_url = property(_get_access_url)
@@ -690,6 +692,7 @@ def __str__(self):
 
 
 def update_filename(instance, filename):
+    filename = vinceutils.safe_filename(filename)
     if instance.vrf_id:
         new_filename = "vrf%s_%s" % (instance.vrf_id, filename)
     else:
diff --git a/vinny/static/vinny/js/request.js b/vinny/static/vinny/js/request.js
index 144d85c..a166b1a 100644
--- a/vinny/static/vinny/js/request.js
+++ b/vinny/static/vinny/js/request.js
@@ -105,19 +105,4 @@ $(document).ready(function() {
     
     initTooltipster(".vendor-participant", umProfileStore, displayUserCard);
 
-        $('#moreVendor').click(function(e) {
-        $("#hidevendors").toggle();
-        $("#moreVendors").toggle();
-        $("#lessVendors").toggle();
-        e.preventDefault();
-    });
-
-     $('#lessVendor').click(function(e) {
-        $("#hidevendors").toggle();
-        $("#moreVendors").toggle();
-        $("#lessVendors").toggle();
-        e.preventDefault();
-
-    });
-    
 });
diff --git a/vinny/static/vinny/js/vincecomm.js b/vinny/static/vinny/js/vincecomm.js
index 608a444..d1b4b80 100644
--- a/vinny/static/vinny/js/vincecomm.js
+++ b/vinny/static/vinny/js/vincecomm.js
@@ -253,5 +253,123 @@ $(function () {
 	    .find('input[type="checkbox"]')
 	    .prop('checked',$(e.target).prop('checked'));
     });
+    function filter_navli(e) {
+	let li = $(e.target || e.srcElement);
+	li.parent().find('.fa-check').css('opacity',0);
+	li.find('.fa-check').css('opacity',1);
+	let partdiv = li.closest('.participant_type');
+	let all = partdiv.find('.participant').not('.pheader');
+	let moreless = partdiv.find(".moreless");
+	let data = moreless.data();
+	if('asyncdivid' in data)
+	    $('#' + data.asyncdivid).show()
+	if(li.hasClass('all')) {
+	    all.show();
+	    moreless.show();
+            let all_count = all.length
+	    li.find('.count').html(all_count);
+	} else {
+	    all.hide();
+	    moreless.hide();
+	    let aclass = $(li).data('class');
+	    all.find('.'+aclass).closest('.participant').show()
+	}
+    }
+    function activate_navli(nav) {
+	let partdiv = $(nav).closest('.participant_type');
+	let all = partdiv.find('.participant').not('.pheader');
+	let all_count = all.length;
+	
+	$(nav).find('li li').each(function(_,li) {
+	    $(li).off('click');
+	    $(li).on('click',filter_navli);
+	    if($(li).hasClass('all')) {
+		$(li).find('.count').html(all_count);
+		$(li).find('.fa-check').css('opacity',1);
+	    } else {
+		let aclass = $(li).data('class');
+		if(aclass) {
+		    let count = partdiv.find('.'+aclass).length;
+		    $(li).find('.count').html(count);
+		}
+		$(li).find('.fa-check').css('opacity',0);		
+	    }
+	})
+    }
+    $('nav.cdown').each(function(_,nav) {
+	activate_navli(nav);
+    });
 
+    async function asyncshowall(adiv,clicked) {
+	let dad = $(adiv).parent();
+	if(clicked) {
+	    $(adiv).hide();	    
+	    dad.find('.asyncshowless').show();
+	}
+	let data = dad.data(); 
+	if('asyncdivid' in data) {
+	    let asyncdiv = $('#' + data.asyncdivid);
+	    if(clicked)
+		asyncdiv.show();
+	    let href = data.href;
+	    let rowdiv = data.rowdivclass;
+	    let pdiv = data.parentdivclass;
+	    let total = parseInt(dad.find('.showallcount').html());
+	    let batch = parseInt(data.batchcount);
+	    if(isNaN(batch))
+		batch = 20;
+	    let count = $('.'+data.parentdivclass + ' .' +
+			  data.rowdivclass).length;
+	    let maxloop = 1000;
+	    let loop = 0;
+	    let nav = $('.'+pdiv).find("nav.cdown");
+	    /* Hide the filter till all the rows are loaded */
+	    if(count < total)
+		$(nav).hide();
+	    while ( count < total) {
+		if(loop > maxloop) {
+		    console.log("Breaking due to too many loops");
+		    break;
+		}
+		loop++;
+		let hurl = href + "?start=" + String(count-1) + 
+		    "&end=" + String(count + batch); 
+	        
+		await $.get(hurl).done(function(w) {
+		    asyncdiv.append(w);
+		    count = $('.'+data.parentdivclass +
+			      ' .' + data.rowdivclass).length;
+		});
+	    }
+	    if(count >= total) {
+		console.log("Activate the filter button");
+		if(nav)
+		    activate_navli(nav[0]);
+		$(nav).show();
+	    }
+	}
+    }
+    
+    $('.asyncshowall').each(function(_,adiv) {
+	$(adiv).on('click',function(e) {
+	    asyncshowall(adiv,true);
+            e.preventDefault();
+	    e.stopPropagation();
+	});
+	asyncshowall(adiv,false);
+    });
+
+    $('.asyncshowless').on('click',function(e) {
+	$(this).hide();
+	let dad = $(this).parent();	
+	dad.find('.asyncshowall').show()
+	let data = dad.data();
+        if('asyncdivid' in data) {
+            let asyncdiv = $('#' + data.asyncdivid);
+	    asyncdiv.hide();
+	}
+        e.preventDefault();
+	e.stopPropagation();
+    });
+    
 });
diff --git a/vinny/static/vinny/js/vinny.js b/vinny/static/vinny/js/vinny.js
index 29cd63b..71f1ef7 100644
--- a/vinny/static/vinny/js/vinny.js
+++ b/vinny/static/vinny/js/vinny.js
@@ -480,26 +480,4 @@ $(document).ready(function() {
 
     });
     
-    $('#moreVendor').click(function(e) {
-	e.preventDefault();
-	$.ajax({
-            url: $(this).attr("href"),
-            success: function( data ) {
-		$("#hidevendors").toggle();
-		$("#moreVendors").toggle();
-		$("#lessVendors").toggle();
-                $("#hidevendors").html(data);
-            }
-        });
-	
-    });
-
-     $('#lessVendor').click(function(e) {
-        $("#hidevendors").toggle();
-        $("#moreVendors").toggle();
-	$("#lessVendors").toggle();
-        e.preventDefault();
-
-    });
-    
 });
diff --git a/vinny/templates/vinny/allvendors.html b/vinny/templates/vinny/allvendors.html
index 80e1632..362f3bf 100644
--- a/vinny/templates/vinny/allvendors.html
+++ b/vinny/templates/vinny/allvendors.html
@@ -2,7 +2,7 @@
 {% for vendor in vendors %}
 
   {% if vendor.group.groupcontact.contact.vendor_name %}
-  <div class="participant">
+  <div class="participant type_vendor">
         <div class="participant-pic">
           {% autoescape off %}{{ vendor|grouplogo:"profile-pic" }}{% endautoescape %}
         </div>
diff --git a/vinny/templates/vinny/case.html b/vinny/templates/vinny/case.html
index 9db054d..72649eb 100644
--- a/vinny/templates/vinny/case.html
+++ b/vinny/templates/vinny/case.html
@@ -29,7 +29,7 @@ <h3> <span id="case_title">Case {{ case.get_title }}</span> {% autoescape off %}
     </div>
     <div class="large-3 medium-3 columns small-12 text-right">
       {% if vincetrack %}
-      <a class="button cmu" href="{% url 'vince:case' case.vince_id %}">VINCETrack</a>
+      <a class="button cmu primary small" href="{% url 'vince:case' case.vince_id %}">VINCETrack</a>
       {% else %}
       <a href="{% url 'vinny:sendmsg' 2 case.id %}"><button class="default button small-only-expanded">Private Message Coordinators</button></a>
       {% endif %}
@@ -225,7 +225,7 @@ <h3>Case Discussion</h3>
 	<div class="hidden" id="paginate_by">{{ paginate_by }}</div>
 	{% if num_posts > 10 %}
 	<a href="#" class="expandreplies">Show all</a>
-	<span id="showall">Showing all {{ total_posts }} posts</span>
+	<span id="showall">Showing all <span id="postcount">{{ total_posts }}</span> posts</span>
 	{% endif %}
       </div>
     </div>
@@ -263,12 +263,12 @@ <h3>Case Discussion</h3>
   </div><!-- 9 columns -->
 
   <div class="large-3 columns">
-    <div class="participant_type">
+    <div class="participant_type type_coordinators">
       <div class="row column">
 	<h4>Coordinators</h4>
       </div>
       {% for coordinator in coordinators %}
-      <div class="participant">
+      <div class="participant type_coordinator">
 	<div class="participant-pic">
 	  {% if coordinator.participant %}
 	  {% autoescape off %}{{ coordinator.participant|userlogo:"profile-pic" }}{% endautoescape %}
@@ -288,7 +288,7 @@ <h4>Coordinators</h4>
       </div>
       {% endfor %}
     </div>
-    <div class="participant_type">
+    <div class="participant_type type_reporters">
       <div class="row column">
 	{% if participants|length > 1 %}
 	<h4>Reporters</h4>
@@ -297,7 +297,7 @@ <h4>Reporter</h4>
 	{% endif %}
       </div>
       {% for participant in participants %}
-      <div class="participant">
+      <div class="participant type_reporter">
 	<div class="participant-pic">
 	  {% if participant.participant %}
 	  {% autoescape off %}{{ participant.participant|userlogo:"profile-pic" }}{% endautoescape %}
@@ -320,15 +320,36 @@ <h4>Reporter</h4>
       {% endfor %}
     </div>
     {% if vendors %}
-    <div class="participant_type">
+    <div class="participant_type type_vendors">
       <div class="row column">
-	<h4>Vendors</h4>
+	<h4>Vendors
+	  <nav role="navigation" class="cdown" id="vendorfilter">
+	    <ul>
+	      <li><a><i class="fas fa-filter"></i></a>
+		<ul class="dropdown">
+		  <li class="affected" data-class="alert">
+		    <i class="fas fa-check"></i>
+		    Affected(<span class="count"></span>)
+		  </li>
+		  <li class="not_affected" data-class="success">
+		    <i class="fas fa-check"></i>
+		    Not Affected(<span class="count"></span>)
+		  </li>
+		  <li class="all">
+		    <i class="fas fa-check"></i>
+		    All(<span class="count"></span>)
+		  </li>
+		</ul>
+	      </li>
+	    </ul>
+	  </nav>
+	</h4>
       </div>
       {% if simulation %}
       {% elif user.is_staff %}
-      <div class="participant">
+      <div class="participant pheader">
         <div class="addfilebutton">
-          <a href="{% url 'vinny:groupchatcase' case.id %}" class="button default text-center"><i class="fa fa-plus"></i> Private Thread</a>
+          <a href="{% url 'vinny:groupchatcase' case.id %}" class="button default text-center small"><i class="fa fa-plus"></i> Private Thread</a>
         </div>
       </div>
       {% endif %}
@@ -337,7 +358,7 @@ <h4>Vendors</h4>
       <div id="hidevendors">
 	{% endif %}
       {% if vendor.group.groupcontact.contact.vendor_name %}
-      <div class="participant">
+      <div class="participant type_vendor">
 	<div class="participant-pic">
 	  {% autoescape off %}{{ vendor|grouplogo:"profile-pic" }}{% endautoescape %}
 	</div>
@@ -356,12 +377,11 @@ <h4>Vendors</h4>
       {% endfor %}
       {% if vendors|length > 5 %}
       </div>
-      <div class="row columns">
-        <div id="moreVendors">
-          <a href="{% url 'vinny:loadvendors' case.id %}" id="moreVendor">SHOW ALL {{num_vendors}}</a>
+      <div class="row column moreless" data-asyncdivid="hidevendors"  data-parentdivclass="type_vendors" data-rowdivclass="type_vendor" data-href="{% url 'vinny:loadvendors' case.id %}" data-batchcount="20">
+        <div id="moreVendors" class="asyncshowall">
+	  <a id="moreVendor" href="#"> SHOW ALL [<span id="vendorcount" class="showallcount">{{num_vendors}}</span>]</a>
         </div>
-        <div id="lessVendors">
-          <a href="#" id="lessVendor">SHOW LESS</a>
+        <div id="lessVendors" class="asyncshowless" data-asyncdivid="hidevendors"><a href="#" id="lessVendor">>SHOW LESS</a>
         </div>
       </div>
       {% endif %}
@@ -370,7 +390,7 @@ <h4>Vendors</h4>
     <div class="large reveal" id="largemodal" data-reveal></div>
     <div class="reveal" id="modal" data-reveal></div>
 
-    <div class="participant_type">
+    <div class="participant_type type_documents">
       <div class="row">
 	<div class="large-12 columns">
 	  <h4>Documents </h4>
@@ -378,12 +398,12 @@ <h4>Documents </h4>
       </div>
       <div class="participant">
 	<div class="addfilebutton">
-	  <a href="{% url 'vinny:addfile' case.id %}" class="uploadfile button default text-center"><i class="fa fa-plus"></i> Add file</a>
+	  <a href="{% url 'vinny:addfile' case.id %}" class="uploadfile button default text-center small"><i class="fa fa-plus"></i> Add file</a>
 	</div>
       </div>
       <div class="reveal" id="upload-file" data-reveal></div>
       {% for attachment in attachments %}
-      <div class="participant">
+      <div class="participant type_document">
 	<div class="participant-pic">
 	  {% if attachment.file %}
           <div class="profile-pic text-center imgpreview"><span class="logo-initial">{% autoescape off %}{{ attachment.file.filename|showfileicon }}{% endautoescape %}</span></div>
@@ -414,9 +434,9 @@ <h4>Notifications <span class="helptooltip" title="Is this case too chatty?  Tur
       <div class="participant">
 	<div class="addfilebutton">
 	  {% if case_muted %}
-	  <a href="{% url 'vinny:mute' case.id %}" class="mutecase button default text-center"><i class="fas fa-volume-up"></i> Unmute Case</a>
+	  <a href="{% url 'vinny:mute' case.id %}" class="mutecase button default text-center small"><i class="fas fa-volume-up"></i> Unmute Case</a>
 	  {% else %}
-	  <a href="{% url 'vinny:mute' case.id %}" class="mutecase button default text-center"><i class="fas fa-volume-mute"></i> Mute Case</a>
+	  <a href="{% url 'vinny:mute' case.id %}" class="mutecase button default text-center small"><i class="fas fa-volume-mute"></i> Mute Case</a>
 	  {% endif %}
 	</div>
       </div>
diff --git a/vinny/views.py b/vinny/views.py
index 0ffdb8e..f32f04a 100644
--- a/vinny/views.py
+++ b/vinny/views.py
@@ -88,6 +88,7 @@
 from botocore.exceptions import ClientError
 from botocore.client import Config
 from lib.vince.m2crypto_encrypt_decrypt import ED
+from lib.vince import utils as vinceutils
 
 # Create your views here.
 
@@ -570,11 +571,13 @@ def test_func(self):
         raise Http404
 
     def get(self, request, *args, **kwargs):
-        attachment = VinceAttachment.objects.filter(uuid=self.kwargs['path']).first()
+        file_uuid = self.kwargs['path']
+        attachment = VinceAttachment.objects.filter(uuid=file_uuid).first()
         if attachment:
             mime_type = attachment.mime_type
             response = HttpResponseRedirect(attachment.access_url, content_type = mime_type)
-            response['Content-Disposition'] = f"attachment; filename=\"{attachment.filename}\""
+            filename = vinceutils.safe_filename(attachment.filename,file_uuid,mime_type)
+            response['Content-Disposition'] = f"attachment; filename=\"{filename}\""
             response["Content-type"] = mime_type
             response["Cache-Control"] = "must-revalidate"
             response["Pragma"] = "must-revalidate"
@@ -595,7 +598,8 @@ def get(self, request, *args, **kwargs):
             if not(mime_type):
                 mime_type = 'application/octet-stream'
             response = HttpResponseRedirect(report.user_file.url, content_type = mime_type)
-            response['ResponseContentDisposition'] = f"attachment; filename=\"{report.user_file.name}\""
+            filename = vinceutils.safe_filename(report.user_file.name,file_uuid,mime_type)
+            response['ResponseContentDisposition'] = f"attachment; filename=\"{filename}\""
             response["Content-type"] = mime_type
             response["Cache-Control"] = "must-revalidate"
             response["Pragma"] = "must-revalidate"
@@ -2295,10 +2299,17 @@ def get_context_data(self, **kwargs):
         if self.request.GET.get("start","").isdigit():
             start = int(self.request.GET.get("start"))
         try:
-            context['vendors'] = CaseMember.objects.filter(case=case, coordinator=False, reporter_group=False).order_by("group__groupcontact__contact__vendor_name")[start:]
+            #There is one additional group that is created in
+            #casemember that has group__name as vuid. This happens
+            #to be the reporter.
+            vendors = CaseMember.objects.filter(case=case, coordinator=False, reporter_group=False).exclude(group__name=case.vuid).order_by("group__groupcontact__contact__vendor_name") 
         except Exception as e:
             logger.debug("Vendor name ordering failed error: {e}")
-            context['vendors'] = CaseMember.objects.filter(case=case, coordinator=False, reporter_group=False).order_by("group__name")[start:]
+            vendors = CaseMember.objects.filter(case=case, coordinator=False, reporter_group=False).exclude(group__name=case.vuid).order_by("group__name")
+        end = vendors.count()
+        if self.request.GET.get("end","").isdigit():
+            end = int(self.request.GET.get("end"))
+        context['vendors'] = vendors[start:end]
         context['case'] = case
         return context
     
@@ -2323,18 +2334,25 @@ class CaseView(LoginRequiredMixin, TokenMixin, UserPassesTestMixin, generic.Temp
     login_url="vinny:login"
 
     def test_func(self):
-        case = get_object_or_404(Case, id=self.kwargs['pk'])
-        if self.kwargs.get('vendor'):
-            cm = get_object_or_404(CaseMember, id=self.kwargs['vendor'])
-            return _is_my_case(self.request.user, self.kwargs['pk']) and PendingTestMixin.test_func(self) and self.request.user.is_staff
-        return _is_my_case(self.request.user, self.kwargs['pk']) and PendingTestMixin.test_func(self)
+        if Case.objects.filter(id=self.kwargs['pk']):
+            if self.kwargs.get('vendor'):
+                if CaseMember.objects.filter(id=self.kwargs['vendor']):
+                    return _is_my_case(self.request.user, self.kwargs['pk']) and PendingTestMixin.test_func(self) and self.request.user.is_staff
+            return _is_my_case(self.request.user, self.kwargs['pk']) and PendingTestMixin.test_func(self)
 
     def handle_no_permission(self):
         """ If test_func fails call this for a friendly response. Use
-        404.html which has generci error to avoid Case enumeration. """
-        
+        404.html which has generic error to avoid Case enumeration. """
+
+        if (not self.request.user.is_authenticated) or self.request.user.is_anonymous:
+            url = self.request.build_absolute_uri()
+            ip = vinceutils.get_ip(self.request)
+            logger.debug(f"Unauthenticated user from {ip} requesting {url} redirect to login")
+            return super(CaseView, self).handle_no_permission()
+
         ctx = {"VINCECOMM_BASE_TEMPLATE": settings.VINCECOMM_BASE_TEMPLATE,
                "user": self.request.user}
+
         try:
              if 'render_to_response' in globals():
                  return render_to_response("vinny/404.html",ctx)
@@ -2348,10 +2366,11 @@ def handle_no_permission(self):
     def get_context_data(self, **kwargs):
         context = super(CaseView, self).get_context_data(**kwargs)
         context['unread_msg_count'] = 0
-        case = get_object_or_404(Case, id=self.kwargs['pk'])
+        #Already checked in test_func if Case exists 
+        case = Case.objects.get(id=self.kwargs['pk'])
         #content = VendorNotificationContent.objects.filter(case=case).first()
         context['case'] = case
-        context['casepage']=1
+        context['casepage'] = 1
         context['today'] = timezone.now
         #context['content'] = content
         vuls = []
@@ -4293,6 +4312,8 @@ def get_object(self):
     def handle_no_permission(self):
         caseid = self.kwargs['vuid']
         logger.info(f"Case permissions denied for user {self.request.user} for {caseid}")
+        if (not self.request.user.is_authenticated) or self.request.user.is_anonymous:
+            return JsonResponse({"error": "Authentication not provided or missing"})
         return JsonResponse({"error": "Report/Case identified either does not exist or you do not have permissions to view it"})
 
     def finalize_response(self, request, response, *args, **kwargs):