cq

cq Code Query，一个通用的代码安全扫描工具。 CQ 扫描代码中的安全漏洞以及安全导向的代码审查人员感兴趣的其他项目。 它将包含所发现问题引用的文本文件输出到一个输出目录。这些输出文件随后可以被审查， 通过 unix 命令行工具（如 grep）进行过滤，或者作为一种“跳转”到代码库中指定 file:line 引用的手段。 一种流行的用法是将输出文件视为“待办事项”列表：在审查过程中删除那些被认为是误报的引用， 或者将引用复制到某个报告文件中，以便详细审查或作为 bug 报告的基础。 该工具极其基础，主要依靠手动操作，并假定使用者对应用程序安全漏洞和代码审查有深入了解。...

bitcoder-v2-research

BitCoder-v2 Research Organization: Bytepro AI Status: Active research — private repository Target: arXiv Q3 2026 + ARC Prize Paper Track Nov 2026 Research Objective Empirically document that the single-prompt ceiling observed in mathematical reasoning SAIR, arXiv:2504.18897 replicates in code...

Zarafa WebApp <=2.0.1.47791 - Cross-Site Scripting

Zarafa WebApp 2.0.1.47791 and earlier contains an unauthenticated reflected cross-site scripting vulnerability. An attacker can execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. id: CVE-2019-7219 info: name: Zarafa WebApp =2.0.1.47791 -...

duo-agentflow-auditor

Duo AgentFlow Auditor AIコードセキュリティ — SASTが見逃す脆弱性をAI生成コードから検出 GitLab Duo Agent プラットフォーム上に構築...

cq

cq Code Query，一款通用的代码安全扫描工具。 CQ 扫描代码以寻找安全漏洞以及安全导向的代码审查者感兴趣的其他项目。 它将包含所发现问题引用的文本文件输出到输出目录。这些输出文件随后可以被审查， 使用 unix 命令行工具（如 grep）过滤，或用作按指定 file:line 引用“跳转”到代码库中的手段。 一种常见的用法是将输出文件视为“待办”列表，在审查时删除引用，并将其视为误报， 或者将引用复制到某个报告文件中，以便详细审查或作为 bug 报告的基础。 该工具极其基础，主要依赖人工，并假定使用者具备应用安全漏洞和代码审查方面的深厚知识。...

MINI-6VGX-C24M-5JJG

Bulletin has no description...

MINI-FPF6-RH63-PC7C

Bulletin has no description...

MINI-PXF8-9G5P-26FJ

Bulletin has no description...

Context-Based Adversarial Attacks on AI Code Generators: Vulnerability Analysis and Implications

AI-powered code generation systems have transformed software development but introduce critical inference-time security vulnerabilities. This research presents a systematic investigation of context-based adversarial attacks, where strategically crafted contextual inputs, including comments,...

Revisiting Vul-RAG: Reproducibility and Replicability of RAG-Based Vulnerability Detection with Open-Weight Models

Large language models LLMs have shown strong potential for automated software vulnerability detection, particularly in retrieval-augmented generation RAG settings. However, for approaches relying on proprietary models and APIs, reproducibility and replicability remain largely unexplored, raising...

How to Compare the Security of Code Written by Humans to LLM-Generated Code

Large language models LLMs are rapidly transforming how software is created and maintained. Comparing LLM-generated code against human-written standards is essential to determine whether these new tools uphold or erode the security baselines established by professional developers. Yet, we lack a...

R+R: Reassessing Java Security API Misuse in Current LLMs: A Replication on JCA and JSSE APIs with External Security Knowledge

The misuse of Java security APIs is a serious security problem in software development. Research in 2024 has shown that this problem is widespread in LLM-generated code. However, it remains unclear whether this phenomenon persists in current models and how external security knowledge affects it...

Budibase 安全漏洞

Budibase is an open-source low-code platform developed by Budibase in the UK. It allows for the creation of internal applications, workflows, and management panels within minutes. Versions of Budibase prior to 3.38.1 contained security vulnerabilities. These vulnerabilities stemmed from the V1 vi...

An Empirical Evaluation of LLM-Generated Code Security across Prompting Methods

The growing use of Large Language Models LLMs for automated code generation has enhanced software development efficiency, but often at the cost of security. Generated code frequently overlooks critical concerns, leaving it vulnerable to issues such as weak encryption and improper input validation...

Security Incentivization: An Empirical Study of How Micropayments Impact Code Security

Security often receives insufficient developer attention because it does not directly generate visible value, leading to underinvestment in practice. We evaluate a countermeasure by team-level incentives tied to measurable security improvements over time. Our semi-automated mechanism aggregates...

Bringing AI Code Security into Qualys ETM

A first-class data model for the next generation of findings AI-driven code security is becoming a real category. Anthropic's Claude Code Security and OpenAI's Codex Security are the leading examples, and more will follow. These tools reason about source code at a depth that traditional SAST cann...

Closing the Security Gap in the Age of Agentic Coding

AI agents are writing more and more code. Ensure it's secure. Learn how Wiz Code plugins and the Green Agent bring machine-speed remediation to your AI-IDE...

How exposed is your code? Find out in minutes—for free

Most security leaders share the same suspicion: there are vulnerabilities in our codebase that we don't know about. The uncomfortable truth is that most code never gets a thorough security review. Vulnerabilities accumulate quietly in active repositories, across languages and teams, often...

CVE-2026-34566 CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within the Page Management functionality when creating or editi...

VibeGuard: A Security Gate Framework for AI-Generated Code

"Vibe coding," in which developers delegate code generation to AI assistants and accept the output with little manual review, has gained rapid adoption in production settings. On March 31, 2026, Anthropic's Claude Code CLI shipped a 59.8 MB source map file in its npm package, exposing roughly...