cornucopia

OWASP Cornucopia 项目 OWASP Cornucopia 是一种形式为卡牌游戏的机制，旨在帮助软件开发团队在敏捷、传统及正式开发流程中识别安全需求。它独立于语言、平台和技术。访问：https://cornucopia.owasp.org/ Web 应用程序版卡牌中的交叉引用涉及以下 OWASP 及其他外部资源的版本： 标准 OWASP 人工智能安全验证标准 v1.0 AISVS OWASP 应用程序安全验证标准 ASVS v4 2019 和 v5 2025 OWASP 移动应用安全验证标准 MASVS v2.1 成熟度模型 OWASP DSOMM OWASP SAMM...

ConcoLLMic

ConcoLLMic: 基于智能体（Agent）的混合符号执行（Concolic Execution） 论文 : IEEE S&P 2026 ConcoLLMic 是首个由 LLM 智能体驱动的、语言与理论无关的混合符号执行器。与需要针对特定语言实现、且难以处理约束求解的传统符号执行工具不同，ConcoLLMic： 适用于 任何 编程语言和环境交互 — 支持 C、C++、Python、Java、...，甚至多语言系统；无需额外的环境建模，并能高效处理它们。 处理多样的约束理论 — 包括浮点运算、字符串、结构化数据和位级操作。 实现更优的覆盖率 — 在大约 4 小时内，ConcoLLMic...

ccs

代码凭据扫描器 此脚本旨在扫描大型且多样化的代码库，以查找硬编码凭据或配置文件中的凭据。这些构成严重的安全问题，且极难检测和管理。 本脚本的特定重点是创建一个可直接由开发团队在 CI/CD 流水线中使用的工具，通过当代码中存在凭据时向团队发出警报来管理此问题的修复过程，从而使团队能够立即修复出现的问题。 也可以将该工具用作针对此问题的点扫描器，但由于凭据很可能随时间推移重新出现在代码库中，我们强烈建议将脚本集成到 CI/CD 流程、自动化构建机制或团队定期执行的任何其他定期自动化扫描过程中。 编写此脚本时考虑以下目标： 基于正则表达式且语言无关，无需解析，以便适用于任何代码库...

cornucopia v3.5.2

OWASP Cornucopia project OWASP Cornucopia is a mechanism in the form of a card game to assist software development teams Identify security requirements in Agile, conventional, and formal development processes. It is language, platform, and technology agnostic. Visit: https://cornucopia.owasp.org/...

MalTotal: Cost-Effective and Language-Agnostic Malicious Code Poisoning Detection for Millions of Repositories

The widespread adoption of open source software OSS has introduced significant security risks, with malicious code poisoning attacks increasingly targeting public package registries and open-source platforms. Existing detection approaches, including heuristic-, learning-, and LLM-based methods,...

[SECURITY] Fedora 44 Update: moby-engine-29.6.2-1.fc44

Docker is an open source project to build, ship and run any application as a lightweight container. Docker containers are both hardware-agnostic and platform-agnostic. This means they can run anywhere, from your laptop to the largest EC2 compute instance a nd everything in between =E2=80=94 and...

[SECURITY] Fedora 42 Update: moby-engine-29.1.3-1.fc42

Docker is an open source project to build, ship and run any application as a lightweight container. Docker containers are both hardware-agnostic and platform-agnostic. This means they can run anywhere, from your laptop to the largest EC2 compute instance a nd everything in between =E2=80=94 and...

MalCodeAI: Autonomous Vulnerability Detection and Remediation Via Language Agnostic Code Reasoning

The growing complexity of cyber threats and the limitations of traditional vulnerability detection tools necessitate novel approaches for securing software systems. We introduce MalCodeAI, a language-agnostic, multi-stage AI pipeline for autonomous code security analysis and remediation. MalCodeA...