heisenberg-ssc-gha

Heisenberg 依赖健康检查（GitHub Action） 一个轻量级的 PR 防护栏，用于依赖更新。 它仅扫描新增或变更的依赖项（来自您的锁定/清单文件），获取健康与风险信号（deps.dev + 启发式分析），标记新近发布的包，在 PR 上评论一份报告，可选地为安全审查添加标签，并且可以在策略命中时使任务失败。 支持的生态系统： PyPI（poetry.lock、requirements.txt、uv.lock）、npm/yarn（package-lock.json、yarn.lock）、Go（go.mod）。 它的作用 仅检测您在 PR...

boot-jackson-cve

复现 Spring Boot 2.5.10 中的 CVE-2020-36518 执行： root@kitploit: ./mvnw clean verify 它会失败并显示： root@kitploit: ERROR Failed to execute goal org.owasp:dependency-check-maven:7.0.0:check default on project jackson-demo: ERROR ERROR One or more dependencies were identified with vulnerabilities that have a...

emba

EMBA The security analyzer for firmware of embedded devices EMBA is designed as the central firmware analysis and SBOM tool for penetration testers, product security teams, developers and responsible product managers. It supports the complete security analysis process starting with firmware...

MinimalReproducer

经过大量努力，将问题缩减为一个最小复现项目。 这只是一个空项目，用于展示我在公司规定下被迫使用的 dependency-check-maven 的问题。 请检查 pom.xml 并执行验证： mvn org.owasp:dependency-check-maven:RELEASE:aggregate 或者如果您有 NVDAPIKEY 环境变量，可以更快地执行： mvn org.owasp:dependency-check-maven:RELEASE:aggregate -DnvdApiKey=$NVDAPIKEY 然后您会看到大量问题，包括： ... ERROR...

react2shell

React2Shell Vulnerability Checker CVE-2025-55182 Herramienta de detección para Ubuntu Linux y Windows 10/11 Descripción Esta herramienta detecta posibles vulnerabilidades React2Shell CVE-2025-55182 en proyectos de React verificando: Archivos package.json y archivos de bloqueo para paquetes...

CVE-2026-92136

Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2026-92136

Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

EUVD-2026-80760

Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2026-92136

The Jenkins OWASP Dependency-Check Plugin versions 5.6.4 and earlier fail to escape CWE values sourced from Dependency-Check reports when rendering them in the Jenkins UI, enabling a stored cross-site scripting (XSS) attack. An attacker with Item/Configure permission can inject malicious script t...

MINI-VJ4M-QX8Q-33HX

Bulletin has no description...

GO-2026-5746 vulnerabilities

Vulnerabilities for packages: ko, rancher, nerdctl-fips, kpt, podman, skopeo, chainloop-control-plane-fips, ko-fips, envoy-gateway, opentelemetry-operator, aws-otel-collector, trivy-operator-fips, nrdot-collector-k8s-fips, kubedock-fips, datadog-agent, cloudbeat-fips, buildah-fips,...

GO-2026-5668 vulnerabilities

Vulnerabilities for packages: grafana, datadog-agent, docker-credential-gcr, podman, trivy, trivy-operator, skopeo, aws-otel-collector, rancher-agent, spire-server, nerdctl, rancher, zot, envoy-gateway, undock, buildah, opentelemetry-operator, cri-tools, ko, rancher-machine, kpt, kots, portieris,...

EUVD-2022-4126

Malicious code in bioql PyPI...

EUVD-2022-2715

Malicious code in bioql PyPI...

Fedora: Security Advisory (FEDORA-2025-c263d3ebd9)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-28153

Jenkins OWASP Dependency-Check Plugin 5.4.5 and earlier does not escape vulnerability metadata from Dependency-Check reports, resulting in a stored cross-site scripting XSS vulnerability...

CVE-2021-43577

Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

CVE-2018-12036

OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames...

Malicious code in check-dependency-ver-consistency (npm)

--- -= Per source details. Do not edit below this line.=-...

ROS-2-1202

2.1202 Denial of Service in libX11CVE-2021-31535 1. Vulnerability Description: The vulnerability allows a local user to execute a denial of service DoS attack. The vulnerability exists due to insufficient validation of color names in the XLookupColor function. A local user can launch a specially...