SecureAgentBench: Benchmarking Secure Code Generation under Realistic Vulnerability Scenarios

Large language model LLM powered code agents are rapidly transforming software engineering by automating tasks such as testing, debugging, and repairing, yet the security risks of their generated code have become a critical concern. Existing benchmarks have offered valuable insights but remain...

Improper Handling of Undefined Values

Overview Affected versions of this package are vulnerable to Improper Handling of Undefined Values in the torch.cummin component when compiling a model with Inductor. An attacker can cause the application to crash or become unresponsive by submitting a specially crafted model that triggers a name...

Malicious code in @sev-ui-verse/contact-models (npm)

The package @sev-ui-verse/contact-models was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eafe3e022be23739d479cdfe1e577a7e5b593a528063ce67b8fa1beb911fb2e0 Any computer that has this package installed or running should be considere...

Malicious Package

Overview @sev-ui-verse/ta-product-models is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

Malicious code in @sev-ui-verse/banking-models (npm)

The package @sev-ui-verse/banking-models was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 56743250cac97b219f4137c848e408b6203b996d98ac504aefe79400bed00e37 Any computer that has this package installed or running should be considere...

Malicious code in @sev-ui-verse/invoice-models (npm)

The package @sev-ui-verse/invoice-models was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f330a934831b8458a3b0de11c4efd1a661b00d1e2b7df7aa32b18a2278b789f3 Any computer that has this package installed or running should be considere...

MAL-2025-47530 Malicious code in @sev-ui-verse/banking-models (npm)

The package @sev-ui-verse/banking-models was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 56743250cac97b219f4137c848e408b6203b996d98ac504aefe79400bed00e37 Any computer that has this package installed or running should be considere...

MAL-2025-47532 Malicious code in @sev-ui-verse/contact-models (npm)

The package @sev-ui-verse/contact-models was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eafe3e022be23739d479cdfe1e577a7e5b593a528063ce67b8fa1beb911fb2e0 Any computer that has this package installed or running should be considere...

Malicious code in @sev-ui-verse/ta-product-models (npm)

The package @sev-ui-verse/ta-product-models was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d564367018a2440087b92862c41a4f2acf9fe9faf7c76a896fcf93f35b88642d Any computer that has this package installed or running should be...

Malicious Package

Overview @sev-ui-verse/invoice-models is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

MAL-2025-47547 Malicious code in @sev-ui-verse/ta-product-models (npm)

The package @sev-ui-verse/ta-product-models was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d564367018a2440087b92862c41a4f2acf9fe9faf7c76a896fcf93f35b88642d Any computer that has this package installed or running should be...

Malicious Package

Overview @sev-ui-verse/core-models is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in @sev-ui-verse/core-models (npm)

The package @sev-ui-verse/core-models was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 794fcad76f90e38dc1872c555e02d03512701d4d3a3ffc2a932ce9421fa1de97 Any computer that has this package installed or running should be considered...

SoK: Potentials and Challenges of Large Language Models for Reverse Engineering

Reverse Engineering RE is central to software security, enabling tasks such as vulnerability discovery and malware analysis, but it remains labor-intensive and requires substantial expertise. Earlier advances in deep learning start to automate parts of RE, particularly for malware detection and...

Vision Transformers: the Threat of Realistic Adversarial Patches

The increasing reliance on machine learning systems has made their security a critical concern. Evasion attacks enable adversaries to manipulate the decision-making processes of AI systems, potentially causing security breaches or misclassification of targets. Vision Transformers ViTs have gained...

PyTorch 安全漏洞

PyTorch is a Python package open-sourced by PyTorch. PyTorch suffers from a security vulnerability that stems from mishandling when compiling models containing torch.Tensor.tosparse and torch.Tensor.todense, which can be exploited by an attacker to cause a denial of service...

Investigating Security Implications of Automatically Generated Code on the Software Supply Chain

In recent years, various software supply chain SSC attacks have posed significant risks to the global community. Severe consequences may arise if developers integrate insecure code snippets that are vulnerable to SSC attacks into their products. Particularly, code generation techniques, such as...

STAF: Leveraging LLMs for Automated Attack Tree-Based Security Test Generation

In modern automotive development, security testing is critical for safeguarding systems against increasingly advanced threats. Attack trees are widely used to systematically represent potential attack vectors, but generating comprehensive test cases from these trees remains a labor-intensive,...

Can Federated Learning Safeguard Private Data in LLM Training? Vulnerabilities, Attacks, and Defense Evaluation

Fine-tuning large language models LLMs with local data is a widely adopted approach for organizations seeking to adapt LLMs to their specific domains. Given the shared characteristics in data across different organizations, the idea of collaboratively fine-tuning an LLM using data from multiple...

CyberSOCEval: Benchmarking LLMs Capabilities for Malware Analysis and Threat Intelligence Reasoning

Today's cyber defenders are overwhelmed by a deluge of security alerts, threat intelligence signals, and shifting business context, creating an urgent need for AI systems to enhance operational security work. While Large Language Models LLMs have the potential to automate and scale Security...