vexhub

VEX Hub 是一个集中式仓库，用于收集和管理来自各种开源软件项目的漏洞可利用性交换（VEX）文档。 它作为漏洞信息的综合资源，帮助用户和安全工具跨多个项目和生态系统高效访问和利用 VEX 数据。 VEX Hub 会自动从已注册项目的源代码仓库中检索 VEX 文档。 通过从已注册的软件包 URL（PURL）中识别源代码仓库，VEX Hub 会复制并组织 VEX 文档，使其便于更广泛的社区访问。 快速入门：向 VEX Hub 添加 VEX 文档 1. 创建您的 VEX 文件 1. VEX Hub 支持 OpenVEX 或 CSAF 格式。 2. 将您的 VEX 文件存储在源代码仓库根目录...

node-ip-vex

node-ip-vex このサンプルプロジェクトは、CVE-2024-29415 の脆弱性がある node-ip npm パッケージに依存しています。 しかし、私たちのプロジェクトは脆弱な関数 .isPublic を直接使用していないため、CVE-2024-29415 に対して悪用可能ではありません。 Docker Scout を使用した分析の実行 プロジェクトを Docker イメージとしてパッケージ化できます。 docker buildx build -t felipecruz1638514/node-ip-vex:v1 . そして、Docker Scout...

SBOM-VEX-Taint-Analysis

SBOM → VEX Agent 自动从 SBOM 生成已签名的 CycloneDX VEX 文档，使用安全的多元人工智能管道，依照 OWASP GenAI 安全项目指南构建。 问题 生成一份 SBOM 会发现数百个 CVE。实际上，超过 90% 在特定产品的运行时环境中不可利用。如果没有漏洞可利用性交换（VEX）文档，每个下游工具 —— Dependency-Track、发布闸门、采购清单 —— 都会被误报淹没。 更多技术细节和测试结果请查阅 WIKI。 手动生成 VEX 耗时且无法规模化。一名熟练分析员可能花费数小时评估单个组件。一份生产环境的 SBOM 可能包含 500 到 200...

vex8s

Vex8s このロゴはAI生成ではありません Vex8sは、コンテナの脆弱性とKubernetesの設定を関連付けることでVEXドキュメントを生成し、クラスタ内で実際に悪用可能なCVEを特定します。 これは実験的なプロジェクトであることにご注意ください。状況は急速に変化する可能性があります。 仕組み このプロジェクトは、脆弱性の分類とsecurityContext分析を組み合わせることで、Kubernetesワークロード内の既知のCVEの悪用可能性を評価することを目的としています。 これは以下のコンセプトに基づいています: 各CVEは1つ以上の脆弱性クラスCWEに分類されます...

vexhub-crawler

VEX Hub Crawler vexhub-crawler 是 VEX Hub 的一个组件，用于自动从源代码仓库中检索 VEX 文档。 概述 爬虫根据已注册的 PURLs Package URLs 识别源代码仓库，并将 VEX 文档复制到 VEX Hub。 此过程确保 VEX Hub 为各种软件包维护最新的 VEX 文档集合。 下图以 npm 为例说明了 VEX Hub Crawler 的高级流程： flowchart TD DevDeveloper --|Register package| PLPackage List PL --|Provide packages for...

vex-repo-spec

VEX 仓库规范 v0.1 VEX 仓库规范 v0.1 1. 版本管理 2. 仓库清单 2.1 概述 2.2 文件位置 2.3 模式 2.4 示例 2.5 字段说明与使用说明 主要字段 版本子字段 位置子字段 3. 仓库结构 3.1 文件结构 3.2 index.json 3.3 VEX 文档 3.4 使用说明 目录结构 VEX 文档内容 3.5 更新仓库 4. 仓库分发 4.1 概述 4.2 归档格式 5. 客户端实现指南 5.1 版本选择 5.2 位置选择 5.3 多仓库支持 仓库优先级 5.4 检查更新 5.5 效率策略 本文档中的关键词 "MUST"、"MUST...

pyvex

PyVEX PyVEX 是 VEX IR 的 Python 绑定。 项目链接 项目仓库：https://github.com/angr/pyvex 文档：https://api.angr.io/projects/pyvex/en/latest/ 安装 PyVEX PyVEX 可以通过 pip 安装： pip install pyvex 使用 PyVEX import pyvex import archinfo translate an AMD64 basic block of nops at 0x400400 into VEX irsb =...

supply-chain-security-toolkit

supply-chain-security-toolkit 공급망 보안Supply Chain Security 업...

Toward greater transparency: Expanding machine-readable Vulnerability Exploitability eXchange (VEX)

Starting today, Microsoft is publishing Vulnerability Exploitability eXchange VEX statements for all Microsoft-assigned CVEs. Building on our work with theCommon Security Advisory Framework CSAFand our previousAzure Linux VEX implementation, this latest milestone in the Microsoft Security Respons...

VEX-Bench: Benchmarking LLM Agents for Assessing Exploitability of Software Supply Chain Vulnerabilities

The software supply chain has become an increasingly exposed attack surface because of its reliance on intricate yet fragile dependencies. Existing defenses such as GitHub Dependabot often raise many false alerts because their coarse-grained matching cannot determine whether a vulnerable dependen...

vex8s v0.5.0

Vex8s this logo is not AI generated Vex8s generates VEX documents by correlating container vulnerabilities with Kubernetes settings to determine which CVEs are actually exploitable in your cluster. Please note, this is an experimental project. Things might change quickly. How It Works The project...

SUSE CVE-2026-48089

DevGuard provides vulnerability management for the full software supply chain. Prior to 1.4.2, on a DevGuard API instance with one or more public assets, any authenticated user - including users from a different organization with no membership or role in the affected org/project - can create,...

CGA-6FPR-FWP5-V36W

Bulletin has no description...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization in the authorization process for public assets. An attacker can perform unauthorized actions such as creating, updating, reapplying, and deleting VEX rules, as well as making changes to vulnerability-triage...

CVE-2026-48089

DevGuard provides vulnerability management for the full software supply chain. Prior to 1.4.2, on a DevGuard API instance with one or more public assets, any authenticated user — including users from a different organization with no membership or role in the affected org/project — can create,...

EUVD-2026-38076

DevGuard provides vulnerability management for the full software supply chain. Prior to 1.4.2, on a DevGuard API instance with one or more public assets, any authenticated user — including users from a different organization with no membership or role in the affected org/project — can create,...

CVE-2026-48089: Improper Authorization

DevGuard provides vulnerability management for the full software supply chain. Prior to 1.4.2, on a DevGuard API instance with one or more public assets, any authenticated user — including users from a different organization with no membership or role in the affected org/project — can create,...

GHSA-6P54-FW2F-Q7GF DevGuard has improper authorization on public assets

Impact On a DevGuard API instance with one or more public assets, any authenticated user — including users from a different organization with no membership or role in the affected org/project — can create, update, reapply, and delete VEX rules on those public assets. The same flaw affects the oth...

DevGuard has improper authorization on public assets

Impact On a DevGuard API instance with one or more public assets, any authenticated user — including users from a different organization with no membership or role in the affected org/project — can create, update, reapply, and delete VEX rules on those public assets. The same flaw affects the oth...

PT-2026-48812

Name of the Vulnerable Software and Affected Versions DevGuard versions prior to 1.4.2 Description On API instances with public assets, any authenticated user can perform unauthorized write operations, regardless of their organization, project, or asset membership. This allows attackers to create...