bomber

bomber is an application that scans SBOMs for security vulnerabilities. Overview So you've asked a vendor for an Software Bill of Materials SBOM for one of their closed source products, and they provided one to you in a JSON file... now what? The first thing you're going to want to do is see if a...

depx

depx Malicious package & supply-chain intelligence Features • Installation • Usage • Running depx • JSON • Join Discord depx is a fast, passive supply-chain intelligence CLI. It tells you whether a package is known malicious hijacked publishes, credential stealers, install-script backdoors by...

deptrust

deptrust / / / / / / / / / / / / / / / / / / / // / / // / / // / ,// ./// ,/// // deptrust is a CLI that checks package versions for known vulnerabilities across npm, PyPI, crates.io, Go modules, RubyGems, NuGet, Maven, Packagist, pub.dev, CocoaPods, Hex.pm, Hackage, GitHub Actions, and...

pyscan

Pyscan Pyscan is a highly concurrent vulnerability scanner written in Rust. It automatically traverses your Python project, extracts dependencies across various packaging formats, and cross-references them against the Open Source Vulnerabilities OSV database in a single asynchronous batch request...

osv-scanner

Usa OSV-Scanner para encontrar vulnerabilidades existentes que afecten a las dependencias de tu proyecto. OSV-Scanner proporciona un frontend oficialmente compatible con la base de datos OSV y una interfaz CLI para OSV-Scalibr que conecta la lista de dependencias de un proyecto con las...

async-http-client-check

async-http-client-check Offline checker for the 21 repository-level security advisories oforg.asynchttpclient:async-http-client AsyncHttpClient, "AHC". It tells you which ones your jar is actually exposed to, flags the ones Dependabot and OSV cannot see , and gives one answer per line: 3.0.13 3.x...

google-poc

To reporoduce the CVE-2025-13425 just follow the steps below: Step 1: Clone the fresh osv-scalibr source code: $ git clone https://github.com/google/osv-scalibr Step 2: Remove the code mentioned in fix commit https://github.com/google/osv-scalibr/commit/e67c4e198ca099cb7c16957a80f6c5331d90a672 St...

cve-lite-on-pi

cve-lite-on-pi A short write-up of running CVE Lite CLI against the pi monorepo, and what it found. Background This experiment was prompted by the article "OWASP CVE Lite CLI – New Tool to Scan for Vulnerabilities in Your Projects" CyberSecurityNews. What is CVE Lite CLI? CVE Lite CLI is a...

CTWall

CTWall - ChainThreatWall GitHub release --- As more teams move to virtualized development environments to reduce software supply-chain risk, one challenge remains: malicious dependencies can still slip through and reach production. CTWall ChainThreatWall platform helps Security, DevOps, and Produ...

CVE-2026-102252

A flaw was found in OSV-SCALIBR. This vulnerability allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning a crafted Virtual Machine Disk VMDK image, insufficient validation of archive path entries in the embedded filesystem extractor allows...

CVE-2026-102252

A path traversal vulnerability CWE-22 in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive pat...

CVE-2026-102252 Path Traversal in VMDK Extractor in OSV-SCALIBR

A path traversal vulnerability CWE-22 in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive pat...

CVE-2026-102252

A path traversal vulnerability (CWE-22) exists in the embedded VMDK filesystem extractor within Google OSV-SCALIBR versions 0.3.6 through 0.5.0 . The root cause is insufficient validation of archive path entries , which enables an attacker controlling the scan target to extract files outside of t...

CVE-2026-102252 Path Traversal in VMDK Extractor in OSV-SCALIBR

A path traversal vulnerability CWE-22 in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive pat...

EUVD-2026-89370

A path traversal vulnerability CWE-22 in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive pat...

CVE-2026-102252 Path Traversal in VMDK Extractor in OSV-SCALIBR

A path traversal vulnerability CWE-22 in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive pat...

CVE-2026-102252: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability CWE-22 in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive pat...

PT-2026-102831

A path traversal vulnerability CWE-22 in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive pat...

Never Emitted: Reporter Attribution in GitHub’s Machine-Readable Vulnerability Records

The CVE record format defines a credits container that names who found or reported a vulnerability, with a typed role per entry. The OSV schema defines an equivalent field. GitHub, which assigns CVE identifiers for advisories in its ecosystems, collects this information from reporters, requires...

osv-scanner v2.6.0

Use OSV-Scanner to find existing vulnerabilities affecting your project's dependencies. OSV-Scanner provides an officially supported frontend to the OSV database and CLI interface to OSV-Scalibr that connects a project’s list of dependencies with the vulnerabilities that affect them. OSV-Scanner...