EuConform

EuConform 🇪🇺 AI 규정 준수를 위한 오픈소스 증거 도구 키트 개방형 증거 형식 • 로컬 편향 평가 • 스키마 검증 • CycloneDX 상호운용성 오프라인 우선 • 개인정보 보호 • 재사용 가능한 아티팩트 • WCAG 2.2 AA 접근 가능 EuConform은 AI 규정 준수를 위한 개방형 증거 형식을 정의하고, 이를 생성, 검증 및 경험적으로 평가할 수 있는 도구를 제공합니다 — 오프라인 및 벤더 독립적으로. !IMPORTANT 법적 고지사항 : 이 도구는 기술적 지침만 제공합니다. 법적 조언을 구성하지 않으며 ,...

cyclonedx-cli

root@kitploit: / / / / / \ |/ / / / / / / / / / / / / / / / / / / / / / / / / / / / // // / // / // / / / / / // / | / // // / /, ///// /////|| /// // Usage: cyclonedx command options Options: --version Show version information -?, -h, --help Show help and usage information Commands: add...

hoppr-cop

Hoppr-Cop SBOM 취약점을 단속하기 위한 도구 Hoppr Cop은 여러 취약점 데이터베이스의 데이터를 집계하여 cyclone-dx Software Bill of MaterialsSBOM로부터 고품질 취약점 정보를 생성하는 CLI 및 Python 라이브러리입니다. 이 프로젝트는 hoppr 생태계의 일부로 제공되지만, 독립형 CLI 또는 Python 라이브러리로도 완전히 사용할 수 있습니다. 자세한 내용은 프로젝트 문서를 참조하십시오. 요구 사항 Hoppr Cop은 CycloneDX 사양 버전 1.3, 1.4, 1.5를...

Dependency Scanning

의존성 및 라이선스 스캔 구성요소 이 구성요소는 CycloneDX 소프트웨어 자재 명세서를 생성하며, GitLab이 프로젝트의 의존성과 해당 라이선스를 식별하는 데 사용됩니다. 이 CycloneDX Software Bill of Materials는 GitLab taxonomy와 호환됩니다. 또한 이 구성요소는 프로젝트 의존성에서 감지된 취약점으로부터 Dependency Scanning report를 생성할 수 있습니다. 요구 사항 이 CI/CD 구성요소는 GitLab dependency scanning 기능, 즉 GitLab...

SBOM-VEX-Taint-Analysis

SBOM → VEX Agent 自动从 SBOM 生成已签名的 CycloneDX VEX 文档，使用安全的多元人工智能管道，依照 OWASP GenAI 安全项目指南构建。 问题 生成一份 SBOM 会发现数百个 CVE。实际上，超过 90% 在特定产品的运行时环境中不可利用。如果没有漏洞可利用性交换（VEX）文档，每个下游工具 —— Dependency-Track、发布闸门、采购清单 —— 都会被误报淹没。 更多技术细节和测试结果请查阅 WIKI。 手动生成 VEX 耗时且无法规模化。一名熟练分析员可能花费数小时评估单个组件。一份生产环境的 SBOM 可能包含 500 到 200...

bomber

bomber is an application that scans SBOMs for security vulnerabilities. Overview So you've asked a vendor for an Software Bill of Materials SBOM for one of their closed source products, and they provided one to you in a JSON file... now what? The first thing you're going to want to do is see if a...

bom-view

BOM View SBOMSoftware Bill of Materials 파일의 소프트웨어 의존성을 표시하는 간단한 정적 웹 애플리케이션입니다. 정적 사이트이므로 GitLab Pages, GitHub Pages, Netlify와 같은 모든 정적 웹 호스팅 서비스에 쉽게 호스팅할 수 있습니다. 기능 SBOM 뷰어 : CycloneDX/SPDX JSON SBOM의 구성 요소를 명확하고 검색 가능한 테이블로 표시합니다. 동적 로딩 : 사이트를 다시 빌드하지 않고 SBOM을 추가하고 표시할 수 있습니다. 주문형 취약점 스캐닝 :...

trivy-plugin-attest

trivy-plugin-attest SBOM 증명 게시 설치 root@kitploit: $ trivy plugin install github.com/aquasecurity/trivy-plugin-attest 사용법 root@kitploit: A Trivy plugin that publish SBOM attestation Usage: attest flags Examples: trivy attest --type PREDICATETYPE --predicate PREDICATEPATH BLOBPATH Publish SBOM...

sbom-sentinel

sbom-sentinel !CIhttps://github.com/MUGHEESM/sbom-sentine...

CVE-2026-55849

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npmexecpath is unset or empty, allowing arbitrary OS command execution with the privileg...

CVE-2026-55849

The CVE affects @cyclonedx/cyclonedx-npm: from 2.1.0 up to 5.0.0, the CLI passes user-supplied --workspace values to a subshell when npm_execpath is unset or empty, enabling arbitrary OS command execution with the invoking user’s privileges. Root cause is unsanitized input used in a shell command...

CVE-2026-55849

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npmexecpath is unset or empty, allowing arbitrary OS command execution with the privileg...

CVE-2026-55849 @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized `--workspace` Argument

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npmexecpath is unset or empty, allowing arbitrary OS command execution with the privileg...

CVE-2026-55849 @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized `--workspace` Argument

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npmexecpath is unset or empty, allowing arbitrary OS command execution with the privileg...

@ajna-inc/npmvc (>=0.1.0, <=0.3.4), @cra-ready/cli (>=0.1.0, <=0.1.1) +3 more potentially affected by CVE-2026-55849 via @cyclonedx/cyclonedx-npm (>=3.1.0, <=4.2.1)

@cyclonedx/cyclonedx-npm NPM version =3.1.0, =0.1.0, =0.1.0, =1.0.8, =1.1.3 - @raj-dev/guardrail 1.0.0 - flatlock 1.2.0 Source cves: CVE-2026-55849 Source advisory: OSV:GHSA-V75R-VX73-82PJ...

@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument

Summary A command injection vulnerability exists in @cyclonedx/cyclonedx-npm when the CLI is invoked with the --workspace option while the environment variable npmexecpath is unset or empty. User‑supplied --workspace values are passed to a subshell without proper sanitization, enabling attackers ...

Command Injection

Overview @cyclonedx/cyclonedx-npm is a Create CycloneDX Software Bill of Materials SBOM from NPM projects. Affected versions of this package are vulnerable to Command Injection via the --workspace argument when the environment variable npmexecpath is unset or empty. An attacker can execute...

@ajna-inc/npmvc (>=0.1.0, <=0.3.4), @cra-ready/cli (>=0.1.0, <=0.1.1) +3 more potentially affected by CVE-2026-55849 via @cyclonedx/cyclonedx-npm (>=3.1.0, <=4.2.1)

@cyclonedx/cyclonedx-npm NPM version =3.1.0, =0.1.0, =0.1.0, =1.0.8, =1.1.3 - @raj-dev/guardrail 1.0.0 - flatlock 1.2.0 Source cves: CVE-2026-55849 Source advisory: SNYK:JS-CYCLONEDXCYCLONEDXNPM-17817903...

PT-2026-51119

Name of the Vulnerable Software and Affected Versions @cyclonedx/cyclonedx-npm versions 2.1.0 through 4.x Description Command injection occurs when the CLI is invoked with the --workspace option while the environment variable npm execpath is unset or empty. In this scenario, user-supplied values...

GHSA-QHH4-458H-XWH2 @cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to a different registry

Docker registry auth substring match forwards credentials to a different registry Repository cdxgen/cdxgen Affected product/package - Ecosystem: npm - Package: @cyclonedx/cdxgen - Reviewed tree version: 12.3.3 - Reviewed commit: b1e179869fd7c6032c3d483c3f7bd4d7154ec22b - Affected file:...