EUVD-2021-0532

Malware in sbrugna...

EUVD-2005-2261

Malware in sbrugna...

Vibe Coding Is the New Open Source—in the Worst Way Possible

As developers increasingly lean on AI-generated code to build out their software—as they have with open source in the past—they risk introducing critical security failures along the way...

EUVD-2022-42683

Malicious code in bioql PyPI...

EUVD-2023-41183

Malicious code in bioql PyPI...

EUVD-2022-0677

Malicious code in bioql PyPI...

EUVD-2025-24884

Malicious code in bioql PyPI...

EUVD-2022-7050

Malicious code in bioql PyPI...

EUVD-2022-2355

Malicious code in bioql PyPI...

EUVD-2022-7147

Malicious code in bioql PyPI...

EUVD-2022-7082

Malicious code in bioql PyPI...

EUVD-2024-43402

Malicious code in bioql PyPI...

EUVD-2024-0455

Malicious code in bioql PyPI...

AI vs. AI: Detecting an AI-obfuscated phishing campaign

Microsoft Threat Intelligence recently detected and blocked a credential phishing campaign that likely used AI-generated code to obfuscate its payload and evade traditional defenses. Appearing to be aided by a large language model LLM, the activity obfuscated its behavior within an SVG file,...

Investigating Security Implications of Automatically Generated Code on the Software Supply Chain

In recent years, various software supply chain SSC attacks have posed significant risks to the global community. Severe consequences may arise if developers integrate insecure code snippets that are vulnerable to SSC attacks into their products. Particularly, code generation techniques, such as...

EvilAI Operators Use AI-Generated Code and Fake Apps for Far-Reaching Attacks

Combining AI-generated code and social engineering, EvilAI operators are executing a rapidly expanding campaign, disguising their malware as legitimate applications to bypass security, steal credentials, and persistently compromise organizations worldwide...

PatchSeeker: Mapping NVD Records to Their Vulnerability-Fixing Commits with LLM Generated Commits and Embeddings

Software vulnerabilities pose serious risks to modern software ecosystems. While the National Vulnerability Database NVD is the authoritative source for cataloging these vulnerabilities, it often lacks explicit links to the corresponding Vulnerability-Fixing Commits VFCs. VFCs encode precise code...

CVE-2025-6519

E3 Site Supervisor firmware version 2.31F01 has a default admin user "ONEDAY" with a daily generated password. An attacker can predictably generate the password for ONEDAY. The oneday user cannot be deleted or modified by any user...

lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other impact.

...

In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations.

...