OSSEM

Open Source Security Events Metadata OSSEM A community-led project focused primarily on the documentation, standardization and modeling of security event logs. https://ossemproject.com/intro.html Goals Define and share a common data moel in order to improve the data standardization and...

ATTACK-Tools

ATT&CK™ Tools 🛡️ Utilities for working with the MITRE™ ATT &CK™ framework, including a relational data model and an adversary emulation planning tool. Repository Content ATT &CK™ Data Model – relational schema for representing MITRE™ ATT&CK data, enriched with Red Canary ATOMIC™ tests ATT &CK™ Vie...

[SECURITY] Fedora 45 Update: kitinerary-26.08.2-1.fc45

A library containing itinerary data model and itinerary extraction code...

Spring AI 2.1 Message Parts: Reasoning That Survives the Round Trip

Spring AI: Message Parts Doc | Upgrade Notes | OpenAI Responses Doc | Session Doc Reasoning models do more than think before they answer. They hand part of that thinking back to you and expect to get it back on the next request. Claude signs its thinking blocks. Gemini attaches thought signatures...

Developing Security Metrics for Automated Compliance Checking

To automatically check for compliance with security-related standards, prose requirements must be translated to technical properties to make them measurable. A multitude of metrics have been proposed in past literature, but they are lacking a systematic methodology for their elicitation. Without...

ossem-power-up

OSSEM Una herramienta para evaluar la calidad de los datos, construida sobre el increíble proyecto OSSEM. Misión Responder a la pregunta: Quiero empezar a cazar técnicas ATT&CK, ¿qué fuentes de registro y eventos son más adecuados? Crear transparencia sobre las fortalezas y debilidades de tus...

[SECURITY] Fedora 45 Update: kitinerary-26.08.1-2.fc45

A library containing itinerary data model and itinerary extraction code...

dbnomics-data-model (>=0.11.0, <=0.12.1), git2effort (>=0.1.1, <=0.1.4) +2 more potentially affected by CVE-2026-114095 via dulwich (0.18.6)

dulwich PYPI version 0.18.6 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - dbnomics-data-model =0.11.0, =0.1.1, =0.1.2, =0.9.16, =0.12.24 Source cves: CVE-2026-114095 Source advisory: OSV:GHSA-35MR-4567-66VG...

CVE-2026-63646 CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, GET /mcp/form/config/formKey calls McpController.getMcpField without authentication because ShiroFilter.addPublicPathFilters marks /mcp/ as anonymous and the controller...

EUVD-2026-83442

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, GET /mcp/form/config/formKey calls McpController.getMcpField without authentication because ShiroFilter.addPublicPathFilters marks /mcp/ as anonymous and the controller...

CVE-2026-63646 CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, GET /mcp/form/config/formKey calls McpController.getMcpField without authentication because ShiroFilter.addPublicPathFilters marks /mcp/ as anonymous and the controller...

CVE-2026-63646

CordysCRM , an open-source AI-powered CRM supporting private deployment, exposed the GET /mcp/form/config/{formKey} endpoint to unauthenticated access prior to version 1.7.2 . The root cause is twofold: ShiroFilter.addPublicPathFilters marks all /mcp/** paths as anonymous, and the McpController l...

CVE-2026-85654

Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated application via crafted table, index, or attribute...

CVE-2026-85654

Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated application via crafted table, index, or attribute...

CVE-2026-85654 Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-server

Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated application via crafted table, index, or attribute...

EUVD-2026-71635

Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated application via crafted table, index, or attribute...

CVE-2026-85654 Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-server

Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated application via crafted table, index, or attribute...

CVE-2026-85654: Improper Neutralization of Special Elements Used in a Template Engine

Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated application via crafted table, index, or attribute...

PT-2026-86207

Name of the Vulnerable Software and Affected Versions awslabs.dynamodb-mcp-server versions prior to 2.1.6 Description Improper neutralization of special elements used in a template engine within the CDK generator allows a context-dependent actor to execute arbitrary code on the host deploying the...

CodeQL 2.26.4

Discover vulnerabilities across a codebase with CodeQL, an industry-leading semantic code analysis engine. CodeQL lets you query code as though it were data. Write a query to find all variants of a vulnerability, eradicating it forever. Then share your query to help others do the same...