guac

GUAC: アーティファクト構成を理解するためのグラフ 注: GUACは活発に開発中です - 貢献に関心がある方は、貢献ガイドをご覧ください。GUACはOpenSSFのインキュベーションプロジェクトであり、サプライチェーン整合性WGの一部です。 Graph for Understanding Artifact Composition GUAC...

grepmarx

Grepmarx - 애플리케이션 보안 플랫폼 Grepmarx는 크고 알 수 없는 코드베이스에서 취약점을 신속하게 이해, 분석 및 식별할 수 있는 단일 플랫폼을 제공하는 웹 애플리케이션입니다. 기능 SAST 정적 분석 보안 테스트 기능: 여러 언어 지원: C/C++, C, Go, HTML, Java, Kotlin, JavaScript, TypeScript, OCaml, PHP, Python, Ruby, Bash, Rust, Scala, Solidity, Terraform, Swift 여러 프레임워크 지원: Spring,...

toxy

toxy Not actively maintained, may not work with latest node.js runtimes. If you are interested in maintaining toxy, please open an issue. Hackable HTTP proxy to simulate server failure scenarios , systems resiliency testing and unexpected network conditions , built for node.js. It was mainly...

CVE-2026-36340

CVE-2026-36340 Krayin CRM v2.1.5におけるリモートコード実行（RCE）の脆弱性 Krayin CRM v2.1.5におけるリモートコード実行（RCE）の脆弱性 CVE: CVE-2026-36340 深刻度: 重大（Critical） 影響を受ける製品: Krayin CRM v2.1.5 脆弱性の種類: リモートコード実行（RCE） 認証の必要性: あり 概要 Krayin CRM v2.1.5 には、重大なリモートコード実行（RCE）の脆弱性が存在します。...

SCTT-2026-33-0002-DWM-Visual-Field-Singularity

SCTT-2026-33-0002: DWM 視覚野特異点 📡 理論的分類 ID: SCTT-2026-33-0002 研究者: Americo Simoes SimoesCTT 物理学: 定理4.2 - 乱流相転移 TPT 定数: α = 0.0302011 標的: デスクトップウィンドウマネージャー dwm.exe / Windows グラフィックスコンポーネント 置き換え: CVE-2026-20805 & CVE-2026-20871 Visual-Latch パッチ 🚀 概要 SCTT-2026-33-0002 は視覚野特異点 を武器化します。マイクロソフトの最新パッチは AL...

-SCTT-2026-33-0002-DWM-Visual-Field-Singularity

SCTT-2026-33-0002: DWM 視覚野特異点 📡 理論的分類 ID: SCTT-2026-33-0002 研究者: Americo Simoes SimoesCTT 物理学: 定理4.2 - 乱流相転移 TPT 定数: α = 0.0302011 対象: デスクトップウィンドウマネージャー dwm.exe / Windows グラフィックスコンポーネント 置き換え: CVE-2026-20805 & CVE-2026-20871 Visual-Latch パッチ 🚀 概要 SCTT-2026-33-0002 は視覚野特異点 を兵器化します。マイクロソフトの最新パッチは AL...

jsonorg-fp1

json.org CVE-2022-45688 오탐 이 프로젝트에는 json.org 종속성이 포함되어 있으며, 여기에 CVE-2022-45688이 존재합니다. 그러나 취약한 클래스를 호출하지 않습니다. 따라서 이 취약점은 DoS 공격에 악용될 수 없습니다. 메타데이터 기반 소프트웨어 구성 분석은 오탐false positive을 생성하는 반면, 콜그래프 기반 분석은 이 애플리케이션을 취약한 것으로 표시하지 않습니다. 소프트웨어 구성 분석 실행 서로 다른 분석을 실행하기 위한 여러 sh 스크립트가 있으며, 결과 보고서는...

jsonorg-fp2

json.org CVE-2022-45688 오탐지 이 프로젝트에는 CVE-2022-45688 취약점이 있는 json.org 종속성이 포함되어 있습니다. 취약한 클래스를 호출하기는 하지만 입력 데이터가 하드코딩되어 있어 DoS 공격을 유발하기에 적합하지 않습니다. 따라서 이 취약점은 DoS 공격에 악용될 수 없습니다. 메타데이터 기반 및 호출 그래프 기반 소프트웨어 구성 분석은 모두 오탐지를 생성합니다. 애플리케이션의 취약 여부를 정확히 탐지하려면 보다 정교한 프로시저 간 데이터 흐름/테인트 분석이 필요합니다. 취약점을 입증하기...

jsonorg-fn1

json.org CVE-2022-45688 偽陰性 このプロジェクトは、json.org における CVE-2022-45688 を示しています。シンプルなアプリケーション XML2JSONConverter があり、入力からXMLを読み取り、JSONに変換してコンソールにプリティプリントします。 悪意のある入力を使用すると、アプリケーションがスタックオーバーフローでクラッシュします。 テストケース CVE202245688Test はこの動作を示しており、mvn test を実行することで実行できます。 ソフトウェア構成分析の実行...

Runaway Reaction: When Benign Skills Compose into Malicious Behavior

Agent skills package task-specific knowledge and procedures that can be composed to support complex agent tasks, while public marketplaces provide a growing pool of reusable skills. Existing security vetting, however, largely evaluates skills in isolation, leaving composition-induced risks...

CollageAttack: Exploiting Cross-Modal Alignment Flaws in T2I Models through Spatial Text Composition

Text-to-image T2I models have substantially improved in language understanding, in-image text rendering, and visual composition, while their safety mechanisms do not always keep pace with these capabilities. This creates a cross-modal attack surface in which harmful semantics can remain...

ROOT-APP-NPM-CVE-2025-64530 CVE-2025-64530 in @apollo/composition - Patched by Root

Root has patched CVE-2025-64530 in the @apollo/composition package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-M8JR-FXQX-8XX6 GHSA-m8jr-fxqx-8xx6 in @apollo/composition - Patched by Root

Root has patched GHSA-m8jr-fxqx-8xx6 in the @apollo/composition package for Root:npm. Multiple fixed versions available...

PT-2026-96736

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description A stored cross-site scripting XSS issue exists in the admin email composition screen. The organization name setting is interpolated directly into a JavaScript string literal using an unescaped P...

CVE-2026-95682: Improper Neutralization of Input During Web Page Generation

MISP contains a stored cross-site scripting XSS vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated directly into a JavaScript string literal using an unescaped PHP echo: var org = " ";. Because the value was placed inside a double-quoted...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: media: vivid: Changed the size of the composition Syzkaller discovered a bug: BUG: KASAN: Out-of-bounds access to memory during tpgfillplanepattern in drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2608 inline BUG: KASAN:...

Astra Linux – Vulnerability in Thunderbird

Thunderbird unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to this area and did not receive Chrome-level privileges; however, it could be used as a stepping stone for further attacks involving other vulnerabilities. This vulnerability affects...

Linux Distros Unpatched Vulnerability : CVE-2026-88057

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, a...

CVE-2026-88057 Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for...

EUVD-2026-75678

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for...