Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-176)

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. Affected Versions: 8.x: All versions from 8.0.0 up to and including 8.19.21 9.x: All version...

reachproof

ReachProof Evidence-backed EU Cyber Resilience Act Article 14...

PT-2026-98409

💻 Опережать атакующего: как находить уязвимости раньше, чем ими воспользуются 15 октября в Санкт-Петербурге пройдёт конференция CNews Петербург: Передовые технологии и кейсы России. На ней Игорь Первушин, руководитель экспертизы СайберОК, выступит с докладом «Опережать атакующего: как находить...

Joern 4.0.637

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

Joern 4.0.636

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

DistillGuard: Malicious NPM Package Detection and API Attack Chain Analysis Via Static Graph and LLM Distillation

The Node.js ecosystem heavily relies on NPM packages, and software supply chain attacks targeting malicious NPM packages are rampant. Malicious code primarily triggers during package installation, import, and runtime. Traditional static analysis fails to understand code semantics; machine...

Automated Abstraction Refinement for Information Flow Security in Embedded Systems

Information flow analysis IFA is a powerful technique for verifying confidentiality and integrity and is therefore highly desirable for security-sensitive embedded systems. However, as these systems are inherently concurrent and time-dependent, existing IFA for embedded systems tend to be either...

Joern 4.0.635

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

PT-2026-97546

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation-controller affected versions not specified Description In the production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying if it...

emba v2.0.4-summer_edition

EMBA The security analyzer for firmware of embedded devices EMBA is designed as the central firmware analysis and SBOM tool for penetration testers, product security teams, developers and responsible product managers. It supports the complete security analysis process starting with firmware...

shannon v3.3.0

!NOTE Cyber verification for Anthropic and OpenAI models: complete your provider's cyber verification program to prevent model failures and refusals during cyber workloads. Shannon is an autonomous, AI pentester for web applications and APIs. It analyzes your source code, identifies attack paths,...

Joern 4.0.633

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

Privacy Leakage through AI-Mediated Analysis of Smartphone Data

Over the past thirty years, the online advertising industry built a large-scale data collection ecosystem, with the goal of tracking a user's online activity to infer their demographics and interests. Traditionally, the ecosystem relied upon the collation and analysis of highly-structured text da...

mobsfscan v1.0.1

mobsfscan mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Android XML, iOS Info.plist, Swift and Objective C Code. mobsfscan uses MobSF static analysis rules and is powered by semgrep and libsast pattern matcher...

Malicious code in @asdfaskdjfksadhfkasf/nadaver2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffa99497d70b8eae199242d576c111b7b351efcf5d81d613e3f7b43eec257f27 The package declares a preinstall lifecycle script that executes index.js on npm install. index.js uses childprocess.exec to run a curl command whose...

Reasoning Topology Matters: A Controlled Study of LLM-Based Cybersecurity Analysis

Large Language Models LLMs are increasingly used in cybersecurity, where accurate analysis often requires multi-step and context-dependent reasoning over complex and heterogeneous data. However, existing prompting approaches typically focus on eliciting reasoning without explicitly considering ho...

Benchmarking Neural Defend ARCAS 1B: A Foundational Multimodal Deepfake Detection Model

AI-generated imagery evolves faster than benchmark-specific detector evaluations, making a single score an incomplete account of generalization. This paper evaluates Neural Defend ARCAS 1B across benchmark families without benchmark-specific parameter updates. We retain native aggregation and...

CodeQL 1.27.0

Discover vulnerabilities across a codebase with CodeQL, an industry-leading semantic code analysis engine. CodeQL lets you query code as though it were data. Write a query to find all variants of a vulnerability, eradicating it forever. Then share your query to help others do the same...

Joern 4.0.631

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

Reversecore_MCP v3.0.4

Reversecore MCP AI-Powered Reverse Engineering & Security Analysis via Model Context Protocol An MCP server that gives AI assistants like Claude and Cursor the ability to perform reverse engineering, malware analysis, vulnerability research, digital forensics, and source code auditing through...