ship-safe

The independent security agent for AI-written software. It finds issues, investigates whether they are real, and shows you the evidence. Website · Docs · Security & Data Flow · Benchmark · Pricing · Blog · Contribute Ship Safe CLI Ship Safe runs locally in your repo and works in two layers. A...

Software-Component-Verification-Standard

OWASP 소프트웨어 컴포넌트 검증 표준 소프트웨어 컴포넌트 검증 표준SCVS은 소프트웨어 공급망의 위험을 식별하고 줄이는 데 도움이 되는 활동, 통제 및 모범 사례를 식별하기 위한 프레임워크를 구축하려는 커뮤니티 주도 노력입니다. 소프트웨어 공급망의 위험 관리는 악용에 취약한 시스템의 공격 표면을 줄이고, 시정 조치의 장벽으로서 기술 부채를 측정하는 데 중요합니다. 소프트웨어 공급망 보증을 측정하고 개선하는 것은 성공에 매우 중요합니다. 공급망 가시성을 갖춘 조직은 브랜드를 보호하고, 신뢰를 높이고, 시장 출시 시간을 단축하...

boa-detector

boa-detector 이 Zeek 패키지는 HTTP 헤더에서 Boa 웹 서버 문자열을 탐지합니다. 모든 Boa 버전은 취약한 것으로 간주됩니다: https://www.microsoft.com/en-us/security/blog/2022/11/22/vulnerable-sdk-components-lead-to-supply-chain-risks-in-iot-and-ot-environments/ /^Boa/./ 서버 문자열이 관찰되면 이 패키지는 연결의 c$id$resph에 대해...

CVE-2026-12544

A flaw exists in Foreman within the foreman-rake initialization logic located in /usr/share/foreman/config/settings.rb. The vulnerability stems from a code pattern where configuration data is processed through two distinct executable layers, creating a multi-stage execution chain. This allows for...

CVE-2026-55273

In AppendCommentLine of AnnotationProcessor.cpp, there is a possible supply chain risk due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-74017

In AppendCommentLine of AnnotationProcessor.cpp, there is a possible supply chain risk due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-55273

A security vulnerability exists in the Framework component of the Android platform within the AppendCommentLine function of AnnotationProcessor.cpp . The root cause is improper input validation , which introduces a possible supply chain risk . Exploitation of this issue could lead to local escala...

CVE-2026-55273

In AppendCommentLine of AnnotationProcessor.cpp, there is a possible supply chain risk due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-55273

In AppendCommentLine of AnnotationProcessor.cpp, there is a possible supply chain risk due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-88255

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Improper input validation in the AppendCommentLine function within AnnotationProcessor.cpp creates a supply chain risk. This flaw allows for local escalation of...

CVE-2026-55273: Improper Input Validation

In AppendCommentLine of AnnotationProcessor.cpp, there is a possible supply chain risk due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-524767048

In AppendCommentLine of AnnotationProcessor.cpp, there is a possible supply chain risk due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

OpenClaw went viral. Meet the maintainers building and securing it.

What began as a personal experiment quickly became a global open source project with extraordinary momentum. OpenClaw is a personal AI assistant that runs on users' devices and connects with the messaging channels they already use. Started by Peter Steinberger as a weekend project in November 202...

GO-2026-5381 vulnerabilities

Vulnerabilities for packages: aws-otel-collector, certificate-transparency, tempo, splunk-otel-collector, minio-operator, opentelemetry-collector-contrib, istio, node-problem-detector, mcp-grafana, prometheus-pushgateway, minio, k8sgpt, loki, opentelemetry-collector, trillian, telegraf,...

Malicious Package

Overview @kolbo/mcp is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview @years20/n8n-nodes-utils-helper-j is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious code in @stageflight-testbed/a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1072a48305e4a3b7d7da10a09c3842a6976dc23f48c48b743e62e71d35912e36 index.ts defines an exported telemetry function that 1 POSTs process.env and process.env.NODEAUTHTOKEN to a base64-hidden endpoint decoding to...

MAL-2026-12032 Malicious code in add-two-numbers-x7q9m (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 550dfc48a74577d95e53fc64cc296a9cc59a5940edb6eac3f191f41376350635 The package advertises itself as a trivial 'add two numbers' utility but its preinstall lifecycle script enumerates the installer's Desktop directory...

@robit/oaai (>=0.1.0, <=0.2.0), hdra-ai (>=0.1.0, <=0.2.0) +2 more potentially affected by unknown CVE via open-agents-ai (0.187.596)

open-agents-ai NPM version 0.187.596 is affected by a known vulnerability. The following packages have a transitive dependency on open-agents-ai and may be impacted: - @robit/oaai =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0 Source cves: unknown CVE Source advisory: SNYK:JS-OPENAGENTSAI-18550671...

The case for a cooldown: Why Dependabot now waits before issuing version updates

In September 2025, an attacker phished the credentials of a single npm maintainer and published booby-trapped versions of chalk, debug, and around a dozen other packages that are together downloaded more than 2 billion times a week. The code rewrote cryptocurrency wallet addresses inside any...