69 matches found
bomber
bomber is an application that scans SBOMs for security vulnerabilities. Overview So you've asked a vendor for an Software Bill of Materials SBOM for one of their closed source products, and they provided one to you in a JSON file... now what? The first thing you're going to want to do is see if a...
dockle
Dockle - Container Image Linter for Security, Helping build the Best-Practice Docker Image, Easy to start Dockle helps you: 1. Build Best Practice Docker images 2. Build secure Docker images Checkpoints includes CIS Benchmarks $ brew untap goodwithtech/dockle who use 0.1.16 or older version $ bre...
cryptoptic
cryptoptic 在量子计算机替你发现之前，先找出代码中隐藏的密码学。 cryptoptic 使用 CodeQL 和 GitHub Actions 扫描一个代码仓库或整个 GitHub 组织，并生成一份清单，列出所有正在使用的密码学函数、它们所属的库以及调用位置。 为什么需要它 具有密码学相关能力的量子计算即将到来，这意味着当今广泛使用的许多算法将无法再保障数据安全。“先收集，后解密”使这成为当下的风险，而非未来的风险。 在组织能够迁移到后量子算法之前，它需要了解密码学在其代码库中的使用情况。cryptoptic...
Insignary Launches Clarity On-Demand: SBOMs, No Annual Commitment Required
Toronto, Canada, 15th July 2026, CyberNewswire...
Insignary Closes SBOM Accuracy Gap With Binary-Level Clarity for Regulatory Risk
Toronto, Canada, 6th July 2026, CyberNewswire...
sbom-risk-analyzer
SBOM-Risk-Analyzer Exploitability-weighted vulnerability pri...
S3C2 Summit 2025-07: Government Secure Supply Chain Summit
Software supply chains, while providing immense economic and software development value, are only as strong as their weakest link. Over the past several years, there has been an exponential increase in cyberattacks specifically targeting vulnerable links in critical software supply chains. The...
GHSA-389R-GV7P-R3RP vulnerabilities
Vulnerabilities for packages: pulumi-language-dotnet, flux-image-automation-controller, nfpm, nuclei, argocd-image-updater, flux-source-controller, pulumi-language-java, witness, osv-scanner, gomplate, src-fingerprint, syft, kots, flux, gitsign, bom, pulumi, terragrunt, trivy-operator,...
GHSA-PMWQ-PJRM-6P5R vulnerabilities
Vulnerabilities for packages: tkn, gh, slsa-verifier, flux-source-controller, falcoctl, tekton-chains, cosign, aactl, docker-compose, buildkitd, gitsign, trivy-operator, bom, zarf, skaffold, vexctl, docker, kyverno, zot, kubescape, teleport, goreleaser, crossplane, rekor, spire-server,...
[SECURITY] Fedora 43 Update: trivy-0.69.3-1.fc43
Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more...
Towards Predicting Multi-Vulnerability Attack Chains in Software Supply Chains from Software Bill of Materials Graphs
Software supply chain security compromises often stem from cascaded interactions of vulnerabilities, for example, between multiple vulnerable components. Yet, Software Bill of Materials SBOM-based pipelines for security analysis typically treat scanner findings as independent per-CVE Common...
GHSA-GM2X-2G9H-CCM8 vulnerabilities
Vulnerabilities for packages: pulumi-language-dotnet, flux-image-automation-controller, nfpm, nuclei, argocd-image-updater, flux-source-controller, pulumi-language-java, witness, osv-scanner, gomplate, src-fingerprint, syft, kots, flux, gitsign, bom, pulumi, trivy-operator,...
CVE-2026-33481
A flaw was found in Syft, a tool for generating Software Bill of Materials SBOM. When Syft scans large or highly compressed archives, it unpacks them into temporary storage. If this process exhausts the temporary storage, Syft fails to properly clean up these files. This can lead to the temporary...
Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
SBOM CVE Scanner - Enhanced Edition A comprehensive Python to...
CVE-2026-25145 melange has a path traversal in license-path which allows reading files outside workspace
melange allows users to build apk packages using declarative pipelines. From version 0.14.0 to before 0.40.3, an attacker who can influence a melange configuration file e.g., through pull request-driven CI or build-as-a-service scenarios could read arbitrary files from the host system. The...
CVE-2026-25145 melange has a path traversal in license-path which allows reading files outside workspace
melange allows users to build apk packages using declarative pipelines. From version 0.14.0 to before 0.40.3, an attacker who can influence a melange configuration file e.g., through pull request-driven CI or build-as-a-service scenarios could read arbitrary files from the host system. The...
Uncovering Hidden Inclusions of Vulnerable Dependencies in Real-World Java Projects
Open-source software OSS dependencies are a dominant component of modern software code bases. Using proven and well-tested OSS components lets developers reduce development time and cost while improving quality. However, heavy reliance on open-source software also introduces significant security...
Altium Enterprise Server security vulnerabilities
Altium Enterprise Server is a localization data management server developed by Altium Corporation in the United States. Version 7.0.3 of Altium Enterprise Server contains a security vulnerability. This vulnerability stems from a stored-xss attack in the Description field of the BOM Viewer, which...