rev-dep

Rev-dep Capabilities • Installation • Documentation • Exploratory Toolkit • Newsletter Dependency analysis and optimization toolkit for modern JavaScript and TypeScript codebases. Enforce dependency graph hygiene and remove unused code with a very fast CLI. About 📣 As codebases scale, maintaining...

DependencyCheck

Dependency-Check Dependency-Check는 프로젝트의 종속성 내에 포함된 공개적으로 공개된 취약점을 탐지하려는 소프트웨어 구성 분석SCA 도구입니다. 이는 주어진 종속성에 대한 공통 플랫폼 열거CPE 식별자가 있는지 확인하여 수행됩니다. 발견되면 관련 CVE 항목에 연결되는 보고서를 생성합니다. 문서 및 프로덕션 바이너리 릴리스 링크는 github 페이지에서 찾을 수 있습니다. 또한 아키텍처 및 dependency-check 확장 방법에 대한 자세한 정보는 wiki에서 찾을 수 있습니다. 공지 이 제품은 N...

rev-dep

Rev-dep Capabilities • Installation • Documentation • Exploratory Toolkit • Newsletter Dependency analysis and optimization toolkit for modern JavaScript and TypeScript codebases. Enforce dependency graph hygiene and remove unused code with a very fast CLI. About 📣 As codebases scale, maintaining...

VulnReach

VulnReach 런타임 인식 SCA — 단순히 설치된 것이 아니라 실제로 도달 가능한 CVE를 입증합니다. VulnReach는 이제 공식OWASP Project입니다. 🎉 데모 1단계 — SCA가 의존성 전반에서 74개의 CVE를 표면화 2단계 — VulnReach가 실제로 도달 가능한 것을 입증 발견 사항 — CVE별 증거 체인 대시보드 — 9개 저장소에서 42개가 도달 가능한 것으로 확인됨 언어 지원: Python은 완전히 프로덕션 준비 완료되었습니다 taint, AST, route, runtime. Java와...

4062-1

Black Duck CoPilot Gradle/Travis CI 예제 Black Duck CoPilot 통합을 사용하여 프로젝트 의존성의 위험을 분석하는 작동 설정을 보여줍니다. Travis CI 설정 .travis.yml 파일은 생성된 의존성 데이터를 Black Duck CoPilot에 업로드하도록 수정되었습니다: aftersuccess: - bash curl -s https://copilot.blackducksoftware.com/ci/travis/scripts/upload...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: doppler-kubernetes-operator, kubernetes-csi-external-provisioner, pgpool2exporter, aws-otel-collector, kubewatch, pvc-autoresizer, openbao, cerbos, nri-elasticsearch, grafana-image-renderer, kapp-controller, swagger, tekton-chains, kyverno-notation-aws, gitlab-runner...

GO-2024-2899 vulnerabilities

Vulnerabilities for packages: melange, pombump...

GO-2026-5381 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, aws-otel-collector, prometheus-pushgateway, loki, node-problem-detector, minio, certificate-transparency, fluent-bit-plugin-loki, minio-operator, opentelemetry-collector-contrib, amazon-cloudwatch-agent-operator, metrics-server,...

GO-2026-5074 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, zarf, scorecard, dagger, nuclei, zot, pulumi-language-dotnet, kaniko, argo-workflows, skaffold, tfsec, cerbos, pulumi, osv-scanner, kubescape, teleport, trivy-operator, flux-source-controller, witness, act, flux-image-automation-controller,...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +14 more potentially affected by CVE-2026-55487 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.0-beta.3, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =0.3.14 and more Source cves: CVE-2026-55487 Source advisory: OSV:GHSA-5WX6-MG75-V57R...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.5) +21 more potentially affected by CVE-2026-43527 via openclaw (>=2026.3.22, <=2026.4.12)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 - morpho-vault-manager 0.1.0 and more Source cves: CVE-2026-43527 Source advisory: SNYK:JS-OPENCLAW-16420277...

SUSE SLED15 / SLES15 / openSUSE 15 : Recommended update for Maven (SUSE-SU-2025:0719-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:0719-1 advisory. maven-dependency-analyzer was updated from version 1.13.2 to 1.15.1: - Key changes across versions: Bug...

Finding Vulnerabilities in Open Source Projects

The Open Source Security Foundation announced $10 million in funding from a pool of tech and financial companies, including $5 million from Microsoft and Google, to find vulnerabilities in open source projects: The "Alpha" side will emphasize vulnerability testing by hand in the most popular...

Horusec - An Open Source Tool That Improves Identification Of Vulnerabilities In Your Project With Just One Command

Horusec is an open source tool that performs static code analysis to identify security flaws during the development process. Currently, the languages for analysis are: C, Java, Kotlin, Python, Ruby, Golang, Terraform, Javascript, Typescript, Kubernetes, PHP, C, HTML, JSON, Dart. The tool has...