trivy-enforcer

trivy-enforcer EXPERIMENTAL Kubernetes Operator for Image Assurance It works as Admission Controller protecting unsafe images from being deployed Custom Controller watching ImageVulnerability CRD and scanning the image in the custom resource automatically Setup $ kubectl apply -f manifests/opa.ya...

sonarqube

SonarQube SonarQube is the algorithmic verification platform for code quality and security. Its static analysis applies techniques such as symbolic execution and data and control flow analysis to inspect your code, find bugs, vulnerabilities, and structural problems, and tell you exactly what to...

saffron

Saffron-1: Inference Scaling for LLM Safety Assurance 📖 Paper 🛠️ Dependencies The code was tested under the following dependencies: Python 3.12.3 CUDA 12.2 typingextensions==4.14.0 numpy==2.2.6 torch==2.5.1 huggingfacehub==0.30.2 accelerate==1.1.1 datasets==3.1.0 evaluate==0.4.3...

CVE-2026-7003

WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in parameters.js. Attackers can extract these exposed...

EUVD-2026-114263

WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in parameters.js. Attackers can extract these exposed...

CVE-2026-7003: WIT SynApps Runtime: WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers…

WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in parameters.js. Attackers can extract these exposed...

PT-2026-133789

Name of the Vulnerable Software and Affected Versions WIT SynApps Runtime versions prior to 1.4.12 Description Hardcoded credentials allow unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in the...

PrivacyRaven

Note: This project is on hiatus. PrivacyRaven is a privacy testing library for deep learning systems. You can use it to determine the susceptibility of a model to different privacy attacks; evaluate privacy preserving machine learning techniques; develop novel privacy metrics and attacks; and...

PT-2026-111867

The OpenText™ EnCase SAFE Agents component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response, OpenText™ Information Assurance, and OpenText™ Endpoint Security contains a security vulnerability on the Agents that could allow unauthorized or unauthenticated activi...

OpenText Endpoint Investigator Authorization Issue Vulnerability

OpenText Endpoint Investigator 26.1 and earlier versions, OpenText Endpoint Forensics & Response 26.1 and earlier versions, OpenText Information Assurance 26.1 and earlier versions, and OpenText Endpoint Security 24.1 and earlier versions have an authorization issue vulnerability. This...

SEAL-DT: An End-To-End Security Engineering and Assurance Framework for Cross-Domain Digital Twins

Cyber-physical systems connect physical processes, software, networks and organizations. Securing them requires a clear account of what happened, what was observed, which actions were authorized and what evidence supports each decision. Digital Twin DT descriptions often fail to explain how these...

From Reactive Containment to Proactive Assurance: Lessons from OpenAI, Anthropic, and Google Agent Security Incidents

In 2026, cybersecurity evaluations involving OpenAI, Anthropic, and Google agents reached real systems outside their authorized test scope. The paths were different. OpenAI agents exploited research infrastructure, coordinated across runs, and compromised parts of Hugging Face's production...

HPESBNW05165 rev. 1 - Multiple Vulnerabilities in HPE Telco Intelligent Assurance

Potential Security Impact: Remote: Code Execution, Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Intelligent Assurance FAS/PDO v4.2.17 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2026-100655 |...

Continuous Assurance of Agentic Security Auditors for Software Delivery Decision Gates

Large language model LLM-based repository auditors are increasingly deployed as security controls within continuous integration CI pipelines, where their findings admit, block, or delay software changes. As Agentic Software Development Life Cycle SDLC Security Controls, their non-deterministic...

HPESBNW05146 rev.1 - Multiple Vulnerabilities in HPE Unified OSS Console (UOC) and HPE Unified OSS Console Assurance Monitoring (UOCAM)

Potential Security Impact: Local: Cross-Site Request Forgery CSRF; Remote: Denial of Service DoS, Disclosure of Privileged Information, Gain Unauthorized Access, Unauthorized Privileged Access SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified OSS Console UOC UOC Version...

Vulnerabilities found in Oracle Communications

Oracle has identified 31 vulnerabilities in various Oracle Communications products, including Oracle Communications Unified Assurance, Oracle Communications Cloud Native Core Security Edge Protection Proxy, Oracle Communications MetaSolv Solution Module – ASR, Oracle Communications Service Catalo...

HPESBNW05145 rev.1 - HPE Telco Intelligent Assurance, Multiple Vulnerabilities

Potential Security Impact: Remote: Authentication Bypass, Denial of Service DoS, Unauthorized Data Injection, XML External Entity XXE SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco Intelligent Assurance 4.2.16 and below CVSS Scores: | CVE | CVSS Vector | Base Score | |...

What Keeps Agent Skills from Being Reusable? Evidence from 138K SKILL.Md Files

Under the current standard, Agent Skills are SKILL.md files that combine instructions with supporting resources, enabling Large Language Model LLM agents to reuse procedures beyond a single conversation. Yet many public skills appear to originate from a single task, repository, or conversation,...

crypto: caam - use print_hex_dump_devel to guard key hex dumps

...

HPESBNW05082 rev.1 - HPE Telco Automated Assurance, Multiple Vulnerabilities

Potential Security Impact: Local: Compromise of System Integrity; Remote: Denial of Service DoS, Unauthorized Access to Data, Unauthorized Information Disclosure, Unqualified Configuration Change, local memory corruption SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco...