threatspec

threatspec - continuous threat modeling, through code Threatspec is an open source project that aims to close the gap between development and security by bringing the threat modelling process further into the development process. This is achieved by having developers and security engineers write...

owasp-threat-dragon-desktop

OWASP Threat Dragon Threat Dragon is a free, open-source, cross-platform threat modeling application including system diagramming and a rule engine to auto-generate threats/mitigations. It is an OWASP Incubator Project. The focus of the project is on great UX, a powerful rule engine and integrati...

kitty

Introduction | Sulley: Boo? | Boo: Kitty! What is Kitty? Kitty is an open-source modular and extensible fuzzing framework written in python, inspired by OpenRCE's Sulley and Michael Eddington's and now Deja Vu Security's Peach Fuzzer . Goal root@kitploit: When we started writing Kitty, our goal w...

appsec-agent

AppSec Agent وكلاء أمان مدعومون بالذكاء الاصطناعي لمراجعة الكود، وفحص طلبات السحب PR، ونمذجة التهديدات، وتوليد الإصلاحات، والمزيد. يمكنك استخدام AppSec Agent بثلاث طرق:...

awesome-appsec-interview

बेहतरीन AppSec साक्षात्कार संसाधनों, अभ्यास प्रश्नों और अध्ययन सामग्री की एक चयनित सूची जो आपको Application Security Engineer साक्षात्कारों की तैयारी में मदद करेगी, जिसे साक्षात्कार प्रकार के अनुसार व्यवस्थित किया गया है। सामग्री साक्षात्कार अवलोकन सुरक्षित कोड समीक्षा ख़तरा मॉडलिंग कोडिंग और...

crml

CRML — साइबर जोखिम मॉडलिंग भाषा स्थिति: मसौदा। इस परियोजना पर भारी विकास चल रहा है और बिना सूचना के बदल सकता है। हम इनपुट, मुद्दों और योगदान का स्वागत करते हैं। ⚠️ चेतावनी यह कोडबेस वर्तमान में crml-dev-1.3 शाखा पर विकसित किया जा रहा है। नवीनतम कार्य-प्रगति और सत्यता के स्रोत के लिए देखें:...

pytm

pytm: धमकी मॉडलिंग के लिए एक पायथनिक ढांचा परिचय पारंपरिक धमकी मॉडलिंग अक्सर बहुत देर से आती है, या कभी-कभी बिल्कुल नहीं आती। इसके अलावा, मैन्युअल डेटा फ्लो और रिपोर्ट बनाना बेहद समय लेने वाला हो सकता है। pytm का लक्ष्य धमकी मॉडलिंग को बाईं ओर स्थानांतरित करना है, जिससे धमकी मॉडलिंग अधिक स्वचालित...

pytm

pytm: A Pythonic framework for threat modeling Introduction Traditional threat modeling too often comes late to the party, or sometimes not at all. In addition, creating manual data flows and reports can be extremely time-consuming. The goal of pytm is to shift threat modeling to the left, making...

threat-model-cookbook

مشروع كتاب وصفات نماذج التهديدات OWASP يتمحور هذا المشروع حول إنشاء ونشر أمثلة لنماذج التهديدات. يمكن أن تكون في شكل تمثيلات برمجية أو رسومية أو نصية. ستستخدم النماذج تقنيات ومنهجيات وأساليب متنوعة. يمكنك التعلم من هذه النماذج، أو استخدامها كأساس لبدء نماذجك الخاصة، أو المساهمة في بعض النماذج...

apparatus

ASTo - Outil logiciel Apparatus Avis d'archivage - Après l'obtention de mon diplôme de recherche, le dépôt a été archivé. ASTo a eu un impact significatif sur ma recherche. Je tiens à exprimer ma gratitude à tous ceux qui ont contribué à l'améliorer. Cependant, ce n'est pas la fin. Le...

The_Automotive_Threat_Modeling_Template

خلفية تتطلب ورشة عمل لنمذجة التهديدات للتقنيات المرتبطة بالمركبات مخططات تدفق البيانات DFDs بعناصر مخصصة، وتهديدات مصمّمة خصيصاً، وتوصيات محددة. أدى غياب قالب مخصص لنمذجة تهديدات المركبات إلى تطوير قالب نمذجة تهديدات المركبات Automotive Threat Modeling Template، الذي يستفيد من ميزة جديدة في أداة ...

What 50 open source projects taught us about security in the AI era

AI is changing the pace of open source development and the security challenges that come with it. Maintainers are reviewing unfamiliar contributions, managing new attack surfaces, and responding to vulnerabilities with limited time and resources. Session 4 of the GitHub Secure Open Source Fund...

Astra Linux – Vulnerability in Chromium

A heap buffer overflow in WebML in Google Chrome prior to version 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory through a crafted HTML page. Chromium security severity: High...

Important: Red Hat Security Advisory: libyang security update

An update for libyang is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabili...

ThreatForest: Multi-Agent Attack Tree Generation with Pluggable TTP Framework Mapping

Threat modeling is essential for secure software development, yet manual analysis of cloud-native architectures is slow and demands scarce security expertise. We present ThreatForest, a multi-agent system that generates structured attack trees from source code repositories, maps attack steps to...

CVE-2026-42478

An issue was discovered in VrmlDataIndexedFaceSet::TShape in the VRML V2.0 parser in Open CASCADE Technology OCCT V800rc5 allows attackers to cause a denial of service via a crafted VRML file. The issue occurs because malformed VRML input can trigger dereference of a corrupt or unvalidated pointe...

CVE-2026-42480

A stack-based out-of-bounds read vulnerability in VrmlDataScene::ReadLine in the VRML parser in Open CASCADE Technology OCCT V800rc5 allows attackers to cause a denial of service via a crafted VRML file. The issue occurs because the quoted-string escape handler uses ptr++anOffset without proper...

MalTree: Tracing Malware Evolution from Embeddings at Scale

Malware detection remains largely reactive: machine learning models trained on known samples degrade as threats evolve. Understanding evolutionary relationships among malware families can inform proactive defense, but traditional reverse engineering can take months to years to uncover such lineag...

CVE-2026-7453 WRL File Parsing Memory Exhaustion in Autodesk 3ds Max

A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can cause a Stack Exhaustion vulnerability, leading to a denial-of-service condition...

Validating Threat Modeling Results with the Help of Vulnerable Test Applications

Validating threat modeling results remains difficult because completeness is hard to judge without an external oracle. Existing studies often rely on expert-produced reference models and other human baselines, but these can contain omissions or disagreements. This paper evaluates a complementary,...