quantum-security-project

OWASP 양자 보안 프로젝트 오늘 준비하세요. 내일을 보호하세요. 양자 시대의 보안 위험을 실용적이고, 벤더 중립적이며, 위험 기반 방식으로 매핑하는 공식 OWASP 커뮤니티 프로젝트입니다. 과장과 두려움에 대한 해독제입니다. 상태: 부트스트랩 단계. OWASP 양자 보안 위험 Top 10은 초안 v0.1 단계이며 커뮤니티 의견을 기다리고 있습니다. 이는 완성된 목록이 아닌 시작점입니다. 프로젝트 소개 NIST, 영국 NCSC, EU 기관들은 모두 양자 이후 암호화, 암호 민첩성, 지금 수확-나중에...

personal-security-checklist

개인 보안 체크리스트 디지털 생활을 안전하게 지키기 위한 궁극의 팁 목록 🌐digital-defense.io 👉 체크리스트 읽기 👈 목차 체크리스트 웹사이트 API 기여하기 크레딧 라이선스 체크리스트 전체 체크리스트는 CHECKLIST.md에서 읽을 수 있습니다. 원본 데이터를 보거나 편집하려면 personal-security-checklist.yml을 참조하십시오. 웹사이트 체크리스트를 활용하는 가장 쉬운 방법은 웹사이트를 이용하는 것입니다: digital-defense.io 여기서 목록을 탐색하고, 위협 모델별로 필터링하며...

CVE-2026-2256-Threat-Model----ms-agent-Command-Injection

CVE-2026-2256-위협-모델----ms-agent-명령-삽입...

macOS-Security-and-Privacy-Guide

This guide is a collection of techniques for improving the security and privacy of macOS on Apple silicon Macs. It targets experienced users who want security practices commonly used by organizations, but is also suitable for novice users with an interest in privacy and security. For...

sec_review_cve-2024-3094

CVE-2024-3094 오픈 소스 취약점에 대한 전체 보안 검토가 수행되었습니다. 획득한 데이터를 기반으로 다음이 준비되었습니다: 1. 'ThreatModel + SecurityReview' 보고서 – 위협, 공격 경로, 위험 평가 및 공격 표면 축소를 위한 권장 사항에 대한 상세 설명. 2. 검증 테스트 패키지 – 패치 적용 후 취약점 존재/부재를 확인하는 자동화된 테스트 세트. 보고서는 ReportFinal.pdf 파일로 제공됩니다. 출처: 취약한 버전의...

threat-model-cookbook

OWASP Threat Model Cookbook プロジェクト このプロジェクトは、脅威モデルの例を作成し公開することを目的としています。それらは、コード、グラフィカルな表現、テキストによる表現の形をとることができます。モデルは多様なテクノロジー、方法論、テクニックを使用します。 これらのモデルから学んだり、自分自身のモデルを始めるためのベースとして使用したり、あるいはモデルの一部に貢献して拡張したりすることができます。これにより、脅威モデルの共同クックブックとなります。 https://owasp.org/www-project-threat-model-cookbook/...

CVE-2026-82862

Hulumi versions prior to v1.3.2 are affected by a helper script shadowing vulnerability in which the threat-model helper script is resolved from an unsafe root . An attacker can place a malicious file in the workspace directory, causing it to be loaded in place of the intended helper script, resu...

CVE-2026-82862: Untrusted Search Path

Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution...

CVE-2026-12634 Out-of-bounds stack write in the settings NVS backend from over-reported nvs_read length

The NVS backend of the Zephyr settings subsystem subsys/settings/src/settingsnvs.c reads stored setting-name entries into fixed 74-byte stack buffers and NUL-terminates them with bufrc = '\0', where rc is the return value of nvsread. Per its contract, nvsread returns the full stored entry length...

📄 rouille 3.6.2 HTTP Request Smuggling

rouille versions 3.6.2 and earlier contain an HTTP request smuggling vulnerability in the reverse proxy implementation. The proxy forwards the client's Transfer-Encoding header unchanged while forwarding a de-chunked request body, allowing backend request desynchronization and, under certain...

BackendAI vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform.NOTE: The maintainers of BackendAI do not consider this report to fit with their threat model and advise users to follow security advice from...

nebula-mesh: POST /api/v1/hosts/{id}/mobile-bundle response lacks Cache-Control: no-store

internal/api/mobilebundle.go:62-66 sets only Content-Type: application/yaml. The Web-UI sibling at internal/web/handlers.go:1316-1321 sets Cache-Control: no-store, Pragma: no-cache, Expires: 0, X-Content-Type-Options: nosniff — and has a test asserting it. The API path was missed. Affected All...

Exploit for CVE-2026-2256

CVE-2026-...

Microsoft's MDASH AI System Finds 16 Windows Flaws Fixed in Patch Tuesday

Microsoft has unveiled a new multi-model artificial intelligence AI-driven system called MDASH to facilitate vulnerability discovery and remediation at scale, adding that it's being tested by some customers as part of a limited private preview. MDASH, short for m ulti-mod el a gentic s canning h...

MATRA: Modeling the Attack Surface of Agentic AI Systems -- OpenClaw Case Study

LLMs are increasingly deployed as autonomous agents with access to tools, databases, and external services, yet practitioners across different sectors lack systematic methods to assess how known threat classes translate into concrete risks within a specific agentic deployment. We present MATRA, a...

Heimdallr: Characterizing and Detecting LLM-Induced Security Risks in GitHub CI Workflows

GitHub Continuous Integration CI workflows increasingly integrate Large Language Models LLMs to automate review, triage, content generation, and repository maintenance. This creates a new attack surface: externally controllable workflow inputs can shape LLM prompts and outputs, which may in turn...

Revisiting JBShield: Breaking and Rebuilding Representation-Level Jailbreak Defenses

Defending large language models LLMs against jailbreak attacks, such as Greedy Coordinate Gradient GCG, remains a challenge, particularly under adaptive threat models where an attacker directly targets the defense mechanism. JBShield, a recent jailbreak defense with a 0% attack success rate in so...

VulStyle: A Multi-Modal Pre-Training for Code Stylometry-Augmented Vulnerability Detection

We present VulStyle, a multi-modal software vulnerability detection model that jointly encodes function-level source code, non-terminal Abstract Syntax Tree AST structure, and code stylometry CStyle features. Prior work in code representation primarily leverages token-level models or full AST...

Primer on GitHub Actions Security - Threat Model, Attacks and Defenses (Part 1/2)

Understanding and defending your GitHub Actions - from threat model to security controls...

Security and Privacy in Virtual and Robotic Assistive Systems: A Comparative Framework

Assistive technologies increasingly support independence, accessibility, and safety for older adults, people with disabilities, and individuals requiring continuous care. Two major categories are virtual assistive systems and robotic assistive systems operating in physical environments. Although...