71 matches found
AISVS
OWASP 人工智能安全验证标准 AISVS 本作品采用 知识共享署名-相同方式共享 4.0 国际许可协议进行许可。 什么是 AISVS？ 人工智能安全验证标准 AISVS 是一个由社区驱动的、针对 AI 系统的可测试安全需求目录。它为开发人员、架构师、安全工程师和审计人员提供了一个结构化框架，用于在 AI 应用的整个生命周期中设计、构建、测试和验证其安全性，涵盖从数据收集、模型训练到部署、监控和退役的全过程。 AISVS 借鉴了 OWASP Application Security Verification Standard ASVS...
cornucopia
OWASP Cornucopia 项目 OWASP Cornucopia 是一种形式为卡牌游戏的机制，旨在帮助软件开发团队在敏捷、传统及正式开发流程中识别安全需求。它独立于语言、平台和技术。访问：https://cornucopia.owasp.org/ Web 应用程序版卡牌中的交叉引用涉及以下 OWASP 及其他外部资源的版本： 标准 OWASP 人工智能安全验证标准 v1.0 AISVS OWASP 应用程序安全验证标准 ASVS v4 2019 和 v5 2025...
should-i-trust
should-i-trust Summary should-i-trust is a tool to evaluate OSINT signals for a domain. Requirements should-i-trust requires API keys from the following sources: Censys.io - Free for for first 250/quries/month VirusTotal - Free GrayHatWarFare - Free with limited results Use Case You're part of a...
user-security-stories
用户安全故事 此仓库包含一系列用户安全故事及其验收标准。 用户安全故事 安全验收标准 欢迎 Fork 并贡献更多您认为对社区有益的安全故事和验收标准。 历史 此仓库中的 Markdown 内容最初源自 Post Modern Security 的 PDF，并参考了此 Twitter 线程。 许可证 此仓库中的所有内容均根据 Created Commons Attribution CC BY（许可证）发布，所有代码均根据 Apache 2.0 开源许可证发布。 原始 PDF 许可证 通过 Twitter 提供。...
ASVS
OWASP 应用安全验证标准 本作品采用 知识共享署名-相同方式共享 4.0 国际许可协议 进行许可。 🎉🎉🎉 欢迎使用 ASVS 5.0 版本！ 🎉🎉🎉 于 2025 年巴塞罗那 Global AppSec EU 大会现场直播发布！ 简介 OWASP 应用安全验证标准（ASVS）项目的主要目标是为所有类型的 Web 应用和 Web 服务提供开放的应用安全标准。 ASVS 于 2008 年通过全球社区合作首次发布，定义了一套全面的安全要求，用于设计、开发和测试现代 Web 应用和服务。 继 2019 年发布 ASVS 4.0 以及 2021 年发布小版本更新（v4.0.3）之后，5.0...
SecurityRAT
OWASP Security RAT（需求自动化工具）是一个帮助你在敏捷开发项目中管理安全需求的工具。典型用例包括： 指定你正在开发的软件工件的参数 基于此信息，生成常见安全需求列表 浏览需求列表，选择如何处理这些需求 将状态持久化到 JIRA 工单中（状态以 YAML 文件形式附加） 以批量模式在开发者队列中创建特定需求的 JIRA 工单 随时将主 JIRA 工单导入工具，以查看特定工单的进度 文档 请访问 https://securityrat.github.io。 在线演示 查看我们全新的在线演示： 网址 ：SecurityRAT 用户名 ：demo 密码...
Using LLMs to Elicit Security Requirements for Service-Oriented Cyber Ranges
Cyber ranges are complex environments comprising many interacting components and stakeholders with different security concerns. The Service-Oriented Cyber Range SOR is no exception, particularly when it comes to training scenarios targeting critical infrastructure. Security concerns are translate...
UBUNTU-CVE-2026-73501
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load in openapi3filter/validationhandler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI...
From Backlog Items to Security Guidance: Towards Continuous Security Compliance
Continuous software engineering in regulated domains requires engineering teams to address security throughout the development lifecycle. Yet making security requirements explicit in backlog items is still problematic. Engineers must instead infer security relevance of backlog items from brief,...
A Bayesian Network Approach for Enhancing Security-Focused Decision Support Systems
The adoption and integration of heterogeneous stacks in most of today's open-source based networks brings clear benefits like interoperability and availability of advanced features. Yet, on the other hand the increasing number of interconnecting components and moving parts requires maintaining an...
EUVD-2026-4394
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in pixelgrade Nova Blocks nova-blocks allows DOM-Based XSS.This issue affects Nova Blocks: from n/a through = 2.1.9...
EUVD-2026-4475
Langflow evalcustomcomponentcode Eval Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...
EUVD-2026-3689
In the Linux kernel, the following vulnerability has been resolved: net/sched: schqfq: Fix NULL deref when deactivating inactive aggregate in qfqreset qfqclass-leafqdisc-q.qlen 0 does not imply that the class itself is active. Two qfqclass objects may point to the same leafqdisc. This happens whe...
EUVD-2026-2063
Dreamweaver Desktop versions 21.6 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could leverage this vulnerability to bypass security measures and execute unauthorized code...
EUVD-2026-1237
The iPaymu Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 2.0.2 via the 'checkipaymuresponse' function. This is due to the plugin not validating webhook request authenticity through signature verification or origi...
EUVD-2026-0077
This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure...
EUVD-2026-0137
This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure...
EUVD-2026-0233
This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure...