ASVS

OWASP アプリケーションセキュリティ検証標準 この作品は クリエイティブ・コモンズ 表示 - 継承 4.0 国際 ライセンス の下で提供されています。 🎉🎉🎉 ASVS バージョン 5.0 へようこそ! 🎉🎉🎉 Global AppSec EU Barcelona 2025 のステージでライブ公開! はじめに OWASP アプリケーションセキュリティ検証標準 ASVS プロジェクトの主な目的は、あらゆる種類の Web アプリケーションおよび Web サービス向けのオープンなアプリケーションセキュリティ標準を提供することです。 ASVS は 2008...

OWASP-Model-Card-Security-Standard

OWASP モデルカードセキュリティ標準 ステータス: ドラフト — インキュベーション中の OWASP プロジェクト この標準は活発に開発中です。貢献とフィードバックを歓迎します。 これは何ですか？ HuggingFace...

Agent-Skills-Security-Standard

このリポジトリには README がありません。...

CVE-2026-59647

CVE-2026-59647 : In Bouncy Castle for Java, CRMF/CMP password-MAC honors an unbounded iteration count. Affected: Java version before 1.85; Java LTS before 2.73.12; BC-FJA before bcpkix-fips 1.0.12 (1.0.x), 2.0.12 (2.0.x), and 2.1.12 (2.1.x). Root cause: unbounded iteration in password-based MAC w...

Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)

SummaryAuthlib’s JWS verification accepts tokens that declare unknown critical header parameters crit, violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header for example, bork or cnf that strict verifiers reject but Authlib accepts. In...

UBUNTU-CVE-2026-40994

Wss4jSecurityInterceptor initialized its BSP WS-I Basic Security Profile compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level...

GHSA-4XRH-5M3M-328W @hulumi/policies: CIS 1.16 admin policy bypass for inline and attached IAM policies

Impact: @hulumi/policies versions before 1.3.2 did not fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail, so some admin-equivalent policy paths could pass policy evaluation. Patched in 1.3.2: the validator inspects the affected policy shapes and includes...

SL5 Standard for AI Security

Security Level 5 SL5 is a security posture for AI systems that could plausibly thwart top-priority operations by the world's most cyber-capable institutions: those with extensive resources, state-level infrastructure, and expertise years ahead of the public state of the art. The SL5 terminology...

EUVD-2026-4548

The Meta-box GalleryMeta plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mbgallery' custom post type in all versions up to, and including, 3.0.1. This makes it possible for authenticated attackers, with Author-level access and abov...

EUVD-2026-3028

EUVD-2026-3028...

EUVD-2026-3042

EUVD-2026-3042...

EUVD-2026-2284

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid updating zero-sized extent in extent cache As syzbot reported: F2FS-fs loop0: updateextenttreerange: extent len is zero, type: 0, extent 0, 0, 0, age 0, 0 ------------ cut here ------------ kernel BUG at...

EUVD-2026-1786

The BetterDocs plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.3 via the scripts function. This makes it possible for authenticated attackers, with contributor-level access and above, to extract sensitive data including the OpenAI API...

EUVD-2026-1522

Server-Side Request Forgery SSRF vulnerability in nK nK Themes Helper nk-themes-helper allows Server Side Request Forgery.This issue affects nK Themes Helper: from n/a through = 1.7.9...

EUVD-2026-0872

Missing Authorization vulnerability in Codepeople Sell Downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sell Downloads: from n/a through 1.1.12...

EUVD-2026-0137

This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure...

EUVD-2025-205871

A weakness has been identified in youlaitech vue3-element-admin up to 3.4.0. This issue affects some unknown processing of the file src/views/system/notice/index.vue of the component Notice Handler. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The...

Your Guide to PCI DSS 4.0.1 Web Application and API Controls with a Simplified Path to Compliance

Executive Summary PCI DSS 4.0.1 compliance mandates stricter security controls for web applications and APIs. Key updates include maintaining an inventory of custom software PCI 6.3.2 and managing payment page scripts to prevent skimming attacks PCI 6.4.3. Organizations must also adopt risk-based...

EUVD-2025-203622

Missing Authorization vulnerability in Milestone Systems XProtect VMS allows users with read-only access to Management Server to have full read/write access to MIP Webhooks API...

Weak Enforcement and Low Compliance in PCI~DSS: A Comparative Security Study

Although credit and debit card data continue to be a prime target for attackers, organizational adherence to the Payment Card Industry Data Security Standard PCI DSS remains surprisingly low. Despite prior work showing that PCI DSS can reduce card fraud, only 32.4% of organizations were fully...