purify

Purify All-in-one tool for managing vulnerability reports 🎮 Demo 📃 Docs 📹 Quick Vimeo Description The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various even custom tools. Purify is aims to be a tool-agnostic applicatio...

metahub

MetaHub is an automated contextual security findings enrichment and impact evaluation tool for vulnerability management. You can use it with AWS Security Hub or any ASFF-compatible security scanner. Stop relying on useless severities and switch to impact scoring definitions based on YOUR context...

proofs

proofs This repository primarily houses my collection of old and occasional new findings related to CVEs and their references. Around 99% of these discoveries stem from personal endeavors outside of my professional commitments, though there may be occasional overlap. Whenever I come across...

What Is the Difference between Me and You? Benchmarking the Quality Gap between Human-Written and AI-Generated Code

AI coding assistants are becoming co-authors of production software, yet their evaluation centers on functional correctness, leaving open whether their code differs from human code in the quality dimensions dominating lifecycle cost. We compare human-written and AI-generated code at scale: 787,56...

Formal Security Analysis of Agent Protocol Composition

AI agent protocols define how agents use tools, delegate work, and coordinate across software systems, but their security requirements remain incomplete and inconsistently enforced across deployments. We present AgentThread, a source-linked framework for security assurance analysis of agent...

Bastet: A Fine-Grained Expert-Labeled Dataset for DeFi Smart Contract Vulnerability Detection

Smart contract vulnerabilities in Decentralized Finance DeFi protocols resulted in over 1.49 billion USD in confirmed losses in 2024 alone, across 192 incidents 1. As LLM-based vulnerability detection emerges as a promising approach to address these threats, the quality of evaluation datasets has...

snyk-agentic-appsec-poc

Snyk Agentic AppSec POC Proof of concept demonstrating autono...

Quality and Security Signals in AI-Generated Python Refactoring Pull Requests

As AI agents increasingly contribute to code development and maintenance, there is still limited empirical evidence on the quality and risk characteristics of their changes in real-world projects, particularly for refactoring-oriented contributions. It remains unclear how agent-authored refactori...

PickleFuzzer: A Case Study in Fuzzing for Discrepancies between Python Pickle Implementations

Python's native serialization protocol, pickle, is a powerful but insecure format for transferring untrusted data. It is frequently used, especially for saving machine learning models, despite known security challenges. While developers sometimes mitigate this risk by restricting imports during...

ExploitSense

ExploitSense ExploitSense is a local-first vulnerability anal...

PT-2026-33315

Name of the Vulnerable Software and Affected Versions Horilla version 1.5.0 Description An insecure direct object reference in the employee document viewer allows any authenticated user to access uploaded documents of other employees by modifying the document ID in the request. This can lead to t...

PT-2026-33316

Name of the Vulnerable Software and Affected Versions Horilla version 1.5.0 Description An insecure direct object reference in the employee document upload endpoint allows any authenticated user to overwrite, replace, or corrupt another employee's document by changing the document ID in the uploa...

PT-2026-33317

Name of the Vulnerable Software and Affected Versions Horilla version 1.5.0 Description A broken access control issue in the helpdesk attachment viewer allows any authenticated user to view attachments from other tickets by modifying the attachment ID. This flaw can lead to the exposure of...

GitHub expands application security coverage with AI‑powered detections

AI is accelerating software development and expanding the range of languages and frameworks used in modern repositories. Security teams are increasingly responsible for protecting code written across many ecosystems, not just the core enterprise languages traditionally covered by static analysis...

5 Steps to Turn Compliance Checks into Audit Outcomes

Key Takeaways Audit readiness remains reactive in many organizations, even though security and compliance teams generate continuous findings, evidence, and control data across multiple systems. The real challenge is the gap between compliance activity and audit outcomes, where large volumes of da...

EUVD-2025-205038

Not used...

EUVD-2025-203973

A logic issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26.2. An app may be able to access sensitive user data...

EUVD-2020-23270

Malware in sbrugna...

EUVD-2025-8099

Malicious code in bioql PyPI...

CERTFR-2025-ACT-032

creationtimestamp| type| source ---|---|--- 2025-08-04 12:46:14+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3lvl7z56ibm26 2025-08-04 16:38:31+00:00| seen| https://bsky.app/profile/infosecfr.skyfleet.blue/post/3lvlmyiagdq2c...