124 matches found
ASVS
OWASP 应用安全验证标准 本作品采用 知识共享署名-相同方式共享 4.0 国际许可协议 进行许可。 🎉🎉🎉 欢迎使用 ASVS 5.0 版本！ 🎉🎉🎉 于 2025 年巴塞罗那 Global AppSec EU 大会现场直播发布！ 简介 OWASP 应用安全验证标准（ASVS）项目的主要目标是为所有类型的 Web 应用和 Web 服务提供开放的应用安全标准。 ASVS 于 2008 年通过全球社区合作首次发布，定义了一套全面的安全要求，用于设计、开发和测试现代 Web 应用和服务。 继 2019 年发布 ASVS 4.0 以及 2021 年发布小版本更新（v4.0.3）之后，5.0...
OWASP-Model-Card-Security-Standard
OWASP 模型卡安全标准 状态：草案 — OWASP 孵化项目 本标准正在积极开发中。非常欢迎贡献和反馈。 这是什么？ 当你从 HuggingFace 或任何其他仓库下载预训练模型时，你本质上是在信任一个黑盒。你不知道它是在什么数据上训练的，这些数据是否包含个人信息，是否做过对抗性攻击测试，也不知道它已知的失败模式是什么。对大多数业余项目来说，这没问题。但对于任何涉及真实用户、受监管行业或敏感数据的场景——这就真的不行了。 模型卡已经存在了一段时间，而且是个好主意。但现有的格式几乎完全集中在性能指标和公平性考量上。安全在很大程度上是事后才想到的，甚至可能根本没有涉及。...
Agent-Skills-Security-Standard
此存储库没有 README。...
CVE-2026-59647
CVE-2026-59647 : In Bouncy Castle for Java, CRMF/CMP password-MAC honors an unbounded iteration count. Affected: Java version before 1.85; Java LTS before 2.73.12; BC-FJA before bcpkix-fips 1.0.12 (1.0.x), 2.0.12 (2.0.x), and 2.1.12 (2.1.x). Root cause: unbounded iteration in password-based MAC w...
ReCon: A Resource-Constrained Benchmark for LLM-Based Cybersecurity Compliance across Ingestion and Retrieval Pipelines
With the increasingly aggressive cyber threat landscape for governments, businesses, and institutions, as information and/or cybersecurity implementations are increasingly under scrutiny by regulators, it has been pointed out that governance failure is one of the major reasons for a weakened...
Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)
SummaryAuthlib’s JWS verification accepts tokens that declare unknown critical header parameters crit, violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header for example, bork or cnf that strict verifiers reject but Authlib accepts. In...
UBUNTU-CVE-2026-40994
Wss4jSecurityInterceptor initialized its BSP WS-I Basic Security Profile compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level...
GHSA-4XRH-5M3M-328W @hulumi/policies: CIS 1.16 admin policy bypass for inline and attached IAM policies
Impact: @hulumi/policies versions before 1.3.2 did not fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail, so some admin-equivalent policy paths could pass policy evaluation. Patched in 1.3.2: the validator inspects the affected policy shapes and includes...
SL5 Standard for AI Security
Security Level 5 SL5 is a security posture for AI systems that could plausibly thwart top-priority operations by the world's most cyber-capable institutions: those with extensive resources, state-level infrastructure, and expertise years ahead of the public state of the art. The SL5 terminology...
EUVD-2026-4548
The Meta-box GalleryMeta plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mbgallery' custom post type in all versions up to, and including, 3.0.1. This makes it possible for authenticated attackers, with Author-level access and abov...
EUVD-2026-3028
EUVD-2026-3028...
EUVD-2026-3042
EUVD-2026-3042...
EUVD-2026-2284
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid updating zero-sized extent in extent cache As syzbot reported: F2FS-fs loop0: updateextenttreerange: extent len is zero, type: 0, extent 0, 0, 0, age 0, 0 ------------ cut here ------------ kernel BUG at...
EUVD-2026-1786
The BetterDocs plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.3 via the scripts function. This makes it possible for authenticated attackers, with contributor-level access and above, to extract sensitive data including the OpenAI API...
EUVD-2026-1522
Server-Side Request Forgery SSRF vulnerability in nK nK Themes Helper nk-themes-helper allows Server Side Request Forgery.This issue affects nK Themes Helper: from n/a through = 1.7.9...
EUVD-2026-0872
Missing Authorization vulnerability in Codepeople Sell Downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sell Downloads: from n/a through 1.1.12...
EUVD-2026-0137
This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure...
EUVD-2025-205871
A weakness has been identified in youlaitech vue3-element-admin up to 3.4.0. This issue affects some unknown processing of the file src/views/system/notice/index.vue of the component Notice Handler. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The...
Your Guide to PCI DSS 4.0.1 Web Application and API Controls with a Simplified Path to Compliance
Executive Summary PCI DSS 4.0.1 compliance mandates stricter security controls for web applications and APIs. Key updates include maintaining an inventory of custom software PCI 6.3.2 and managing payment page scripts to prevent skimming attacks PCI 6.4.3. Organizations must also adopt risk-based...