Skip to content

36 results for “EPSS”

ListGrid
What you seeeverything
RecentOldestAddedA–Z
All types36Articles13Advisories11Repos6Write-ups3Threads2Papers1
“EPSS”
x.comadvisory🛡️ Security

lee1981 (@lee1981b) on X

CVE-2026-103780 is a stack-based buffer overflow (CWE-121) in Dell PowerProtect Data Domain / DD OS. An unauthenticated remote attacker could get command execution (CVSS 3.1 9.8, Dell DSA-2026-416). The post lists affected and fixed builds for four release trains (Feature Release, LTS2024, LTS2025, LTS2026). It adds KEV, EPSS and SSVC status, plus six defensive checks. The vulnerable service is not public.

Dell PowerProtect Data DomainDD OSCVSS+2
CVE-2026-103780CVE-2026-86400CVE-2026-86397+5

Blue Team & Detection, Cloud & Infra· Added 31 Oct 2026, published 29 Oct 2026

x.comadvisory🛡️ Security

lee1981 (@lee1981b) on X

CVE-2026-92885 is a critical (CVSS 3.1 9.8, CWE-287) authentication bypass in the Qode Membership WordPress plugin, versions through 2.0.6.2. A misspelled variable in the Facebook token-verification guard skips provider checks, so an unauthenticated attacker with a public nonce can get a session cookie for an existing account, including an administrator. The post gives the fix (2.0.6.3, bundled in Bridge 30.9), KEV/EPSS/SSVC status, and a SOC log-correlation and remediation plan.

WordPressQode MembershipBridge+3
CVE-2026-92885CWE-287Wordfence+4

AppSec, Identity & Access, Blue Team & Detection· Added 31 Oct 2026, published 28 Oct 2026

x.comadvisory🛡️ Security

lee1981 (@lee1981b) on X

CVE-2026-115905 is a ZIP cloaking flaw in the Rust zip crate (zip-rs/zip2), rated CVSS v4.0 10.0 and affecting versions below 9.0.5. ZipArchive reads central-directory metadata while ZipStreamReader reads local headers, so a crafted archive can pass filename inspection and then overwrite a different file during streaming extraction. Version 9.0.5 adds consistency checks, but ZipStreamReader::new leaves them off by default, and extraction is not atomic, so files can be written before an error is raised. The post covers CWE-20 and CWE-436, KEV and EPSS status, Debian status and a six-step investigation trail.

Rustzip crateCargo+3
CVE-2026-115905CWE-20CWE-436+3

AppSec, Blue Team & Detection· Added 29 Oct 2026, published 27 Oct 2026

x.comarticle🛡️ Security

lee1981 (@lee1981b) on X

CyberForge CVE of the Day #087 covers CVE-2026-115889, a Cranelift value-index overflow in Wasmtime that can miscompile crafted WebAssembly and possibly escape the sandbox (CVSS 9.9, CWE-197 and CWE-843). Affected: below 36.0.19, and 37.0.0 up to but excluding 43.0.0; fixes are 36.0.19 and 43.0.0. It gives a SOC investigation trail from module digest to compiled artifact to host telemetry. EPSS is 0.454%, with no KEV entry.

WasmtimeCraneliftWebAssembly+4
CVE-2026-115889GHSA-897f-g5gm-fmxmRUSTSEC-2026-0380+5

AppSec, Blue Team & Detection· Added 28 Oct 2026, published 26 Oct 2026

x.comarticle🛡️ Security

lee1981 (@lee1981b) on X

CyberForge Weekly CVE Rundown #007 covers six CVEs from 19 to 24 October 2026: SiteGuard command injection (CVE-2026-106931), DB-GPT (CVE-2026-77932), Siemens Software Center DLL side-loading (CVE-2026-110936), Cisco Expressway (CVE-2026-76466), Node.js Brotli (CVE-2026-111497) and Arista VeloCloud (CVE-2026-114625). Each entry gives defender actions, fixed versions, exploitation status and primary-source links. Updated 25 October 2026 with CISA KEV and EPSS findings.

SiteGuardDB-GPTSiemens Software Center+4
CVE-2026-106931CVE-2026-77932CVE-2026-110936+10

Blue Team & Detection, AppSec, Threat Intel· Added 27 Oct 2026, published 25 Oct 2026

x.comadvisory🛡️ Security

lee1981 (@lee1981b) on X

CyberForge CVE of the Day #084 analyses CVE-2026-76466, a CVSS 9.8 flaw in clustered Cisco Expressway-C and Expressway-E. Persistent database cookies and weak client-certificate validation allow root OS command execution over the network. The fix is X15.5.20 (X14 and earlier must migrate), with no workaround. It adds a per-peer SOC investigation trail, reachability checks and exposure status from CISA SSVC, KEV and EPSS.

Cisco ExpresswayCVSSNVD+2
CVE-2026-76466CWE-798cisco-sa-vcs-static-cred-hr7EWZ8t+2

Blue Team & Detection, Cloud & Infra· Added 24 Oct 2026, published 22 Oct 2026

x.comadvisory🛡️ Security

lee1981 (@lee1981b) on X

CVE-2026-77932 affects DB-GPT through 0.8.2 (dbgpt-app). The /api/v1/chat/react-agent route accepts unauthenticated requests because get_user_from_headers returns an admin-role user, and the ReAct agent can reach unsandboxed Python and shell tools. Lasso reported root in the webserver container in a lab. The post gives CVSS 9.8 and 9.3, no verified fix (0.8.2 is still the latest release), no KEV match, no EPSS data, and a SOC hunting trail.

DB-GPTPythonDocker+3
CVE-2026-77932CWE-306Lasso+4

AI Security, AppSec, Blue Team & Detection· Added 23 Oct 2026, published 20 Oct 2026

x.comarticle🛡️ Security

lee1981 (@lee1981b) on X

CyberForge Weekly CVE Rundown #006 covers six CVEs from 12-17 October 2026: BotSharp default signing key, GitLab CI/CD regex compiler overflow (CVSS v3.1 10.0), Ivanti Connect Secure auth bypass, Cisco Secure Email Gateway, BeyondTrust Remote Support and the Linux kernel PwnEscape guest-to-host bug. It gives fixed versions, KEV and EPSS status as of 18 October, and separates patch verification from compromise investigation.

GitLabIvanti Connect SecureCisco Secure Email Gateway+3
CVE-2026-108860CVE-2026-97229CVE-2026-104935+9

Blue Team & Detection, Threat Intel· Added 20 Oct 2026, published 18 Oct 2026

x.comadvisory🛡️ Security

lee1981 (@lee1981b) on X

CyberForge CVE of the Day #080 covers CVE-2026-99999 ("PwnEscape"), a Linux kernel IPv4 checksum-completion flaw. Crafted checksum metadata can trigger a deferred write into an already-validated IPv4 header, which allows host memory disclosure from a guest or microVM over virtio-net and TAP. It gives upstream fixed branches (5.10.272 to 7.2.11), Amazon Linux, Red Hat and Ubuntu status, CVSS 9.3, EPSS 0.211% and a SOC investigation trail. No IOCs were verified.

Linux kernelKVMFirecracker+6
CVE-2026-99999PwnEscapesandbox escape+5

Cloud & Infra, Blue Team & Detection· Added 19 Oct 2026, published 17 Oct 2026

x.comthread🛡️ Security

lee1981 (@lee1981b) on X

CyberForge "CVE of the Day #079" on CVE-2026-102764, a CWE-290 origin-validation flaw in BeyondTrust Remote Support (advisory BT26-05, CVSS v4 9.3) that allows appliance file operations. It summarises Mandiant/GTIG's exploited intrusion chain (SAWFLY web shell, BARECLAW backdoor, root escalation, persistence) and gives an investigation trail: patch-state verification (BT26-05-RS), evidence preservation, hunting leads with SHA-256 hashes and YARA rules, permission/session correlation, and remediation including clean redeployment and credential rotation. It separates vendor facts from the intrusion's observed behaviour and notes that KEV and EPSS have no entries.

BeyondTrust Remote SupportYARASIEM+2
CVE-2026-102764BT26-05CWE-290+7

Blue Team & Detection, Threat Intel· Added 18 Oct 2026, published 16 Oct 2026

x.comadvisory🛡️ Security

lee1981 (@lee1981b) on X

CyberForge "CVE of the Day #076" covers CVE-2026-97229, a CVSS 10.0 integer overflow (CWE-190) in GitLab CE/EE's CI/CD regular expression compiler. It can lead to conditional unauthenticated code execution on the GitLab server. It lists the affected trains (19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2) and the 19.3.4 vs 19.3.5 Ona-regression discrepancy. It also gives six SOC checks: scoping, log preservation (Workhorse/Rails/Sidekiq, correlation_id), server-effect hunting, request-to-process correlation, upgrade and running-state verification. It notes that exploit details are unverified, no KEV listing exists and EPSS data is unavailable.

GitLabCVSSEPSS+2
CVE-2026-97229CWE-190CISA KEV+3

AppSec, Blue Team & Detection· Added 15 Oct 2026, published 13 Oct 2026

endorlabs.comarticle🛡️ Security

Executive Order 14028 SBOM Requirements: What to Comply With and How | Endor Labs

Explains what Executive Order 14028 requires for SBOMs. It covers the NTIA Minimum Elements (seven data fields, automation support, practices and processes) and the SPDX, CycloneDX and SWID formats. It also covers who must comply and how OMB M-26-05 (January 2026) rescinded the standardized self-attestation mandate while agencies can still require SBOMs by contract. It then argues an SBOM is only a starting point and recommends adding reachability analysis, EPSS, VEX and safe-upgrade remediation. The last part promotes Endor Labs.

SBOMSPDXCycloneDX+1
Executive Order 14028NTIANIST+10

GRC, Supply Chain· Published and added 12 Oct 2026

aws.amazon.comarticle🛡️ Security

GuardDuty Extended Threat Detection has added five new indicators to surface attack sequences

Explains five new indicator types (MALICIOUS_PACKAGE, MISCONFIGURATION, REACHABILITY, SENSITIVE_DATA, VULNERABILITY) that GuardDuty Extended Threat Detection attaches to attack sequence findings, sourced from Inspector, VPC Reachability Analyzer, Macie and Security Hub. Walks through an EKS compromise (AttackSequence:EKS/CompromisedCluster) that only became a CRITICAL finding thanks to the new context, and a cryptomining EC2 case. Lists observed CVEs with EPSS scores, frp/Burp Collaborator artifacts, and response advice such as EPSS-weighted patching, isolating reachable hosts and rotating IAM credentials.

Amazon GuardDutyAmazon InspectorAWS Security Hub+5
CVE-2022-1471CVE-2024-4577CVE-2024-34351+13

Cloud & Infra, Blue Team & Detection· Published and added 12 Oct 2026

endorlabs.compaper🛡️ Security

2024 Dependency Management Report | Endor Labs

Endor Labs' 2024 report on open-source dependency management and vulnerability prioritization. It reports that under 9.5% of vulnerabilities are reachable at function level, and that combining reachability with EPSS cuts noise by about 98%. It also finds Python phantom dependencies (up to 60% of dependencies and 85% of vulnerabilities for some tenants), 18% of npm OSV entries lacking CVE aliases, 69% of advisories published after the fix release (median 25 days), and 47% of advisories with no code-level info. For Java, 24% of fixes need a major version bump and 95% of upgrades carry breaking changes. Written by a vendor, so the prioritization conclusions favor its product.

Endor LabsOSVNVD+4
CVE-2023-41080CVE-2017-12159CVE-2023-36566+10

Supply Chain, AppSec· Published and added 12 Oct 2026

x.comadvisory🛡️ Security

lee1981 (@lee1981b) on X

CyberForge's CVE of the Day #075 covers CVE-2026-108860, a critical (CVSS 9.1 v3.1 / 9.3 v4.0) authentication bypass in SciSharp BotSharp through 5.2.0. WebStarter ships a published default HMAC JWT signing secret (CWE-321), so anyone holding it can forge bearer tokens that impersonate known users, including administrators. The post sets out how to confirm the effective key and serving build, a six-step SOC investigation trail, and remediation by rotating the secret. No verified fixed release, KEV entry or EPSS data existed at cutoff, and the linked research is static-only.

BotSharpASP.NET CoreJWT+5
CVE-2026-108860CWE-321VulnCheck+2

AppSec, Identity & Access, Blue Team & Detection· Added 13 Oct 2026, published 12 Oct 2026

x.comadvisory🛡️ Security

lee1981 (@lee1981b) on X

CyberForge CVE of the Day #074 analyses CVE-2026-85097, a CVSS 9.8 unauthenticated file upload to PHP execution flaw (CWE-434) in the Bricksforge WordPress plugin through 3.1.8.9. Wordfence names 3.1.8.10 as the fix, and a separate vendor 4.0.1 Pro Forms upload-security notice has no verified mapping to the CVE. It gives a defender workflow: scope versions, preserve edge/origin logs, inspect resulting files and PHP-FPM handling, and verify the patched version is serving. It also separates KEV (no match), EPSS (0.312%) and SSVC (exploitation none) from compromise evidence.

WordPressPHPCVSS+2
CVE-2026-85097CWE-434Wordfence+4

Blue Team & Detection, AppSec· Added 11 Oct 2026, published 10 Oct 2026

x.comadvisory🛡️ Security

lee1981 (@lee1981b) on X

CyberForge's CVE of the Day #073 covers CVE-2026-102255, a critical (CVSS 10.0) pre-authentication SSRF / confused-deputy flaw (CWE-918, CWE-441) in the SonicWall SMA1000 Work Place interface, per advisory SNWLID-2026-0017. It lists affected platform hotfixes (12.4.3-03526 and older, 12.5.0-02952 and older), fixed floors (12.4.3-03670, 12.5.0-03082), no workaround, and the exploitation picture (no known exploitation, not in KEV, EPSS 0.477%, SSVC automatable). It gives a six-step SOC playbook covering appliance scoping, AMC log preservation, hunting appliance-originated internal requests, correlating receiving-service changes, patching, and verifying every node, and it separates exposure, a lead, confirmed compromise and telemetry gaps.

SonicWallSMA1000CVSS+3
CVE-2026-102255CVE-2026-102256CVE-2026-102257+7

Blue Team & Detection, AppSec· Added 12 Oct 2026, published 9 Oct 2026

x.comwriteup🛡️ Security

lee1981 (@lee1981b) on X

A detailed "CVE of the Day" thread analyzing CVE-2026-76471, a critical (CVSS 9.8) Cisco advisory covering insufficient NX-API input validation (CWE-122 heap-based buffer overflow) on Nexus 3000/9000 standalone NX-OS and a lower-severity credentialed variant on UCS 6300 Fabric Interconnects via UCS Manager XML API. It compiles Cisco's fixed-software versions per platform, notes the temporary Live Protect shield lp00074, and walks through a six-step SOC evidence-preservation and correlation playbook (scoping affected devices, preserving logs/crash artifacts, reviewing API/shield telemetry, correlating device outcomes, remediating, and verifying post-patch state) while flagging that CISA KEV and FIRST EPSS had no data on the CVE at research time.

CVSSNVDCISA KEV+1
CVE-2026-76471

Cloud & Infra· Published and added 8 Oct 2026

aws.amazon.comarticle🛡️ Security

Configuring your AI vulnerability harness, Part 2: The steering file

AWS Security Blog's second post in a series on building an "AI vulnerability harness" explains the configuration (steering file) that stops an AI model from hallucinating vulnerabilities and inflating severity during security code review. It details five configuration sections — structural verification of findings, an evidence-based confidence formula (weighting confirmed taint flow at 0.30), infrastructure-aware severity multipliers for controls like AWS WAF and IAM, CISA KEV/EPSS threat-intel boosting, and a four-tier priority classification — and reports validation numbers (e.g., unsteered models fabricated code paths in ~30% of findings; steered confidence of HIGH without structural confirmation was only 34% exploitable vs 89% with confirmed taint). The steering file is shipped as a Kiro steering file, a Kiro skill, and a CLAUDE.md for Claude Code, with full source in a linked GitHub repo.

KiroClaude CodeAWS WAF+3

AI Security, AppSec· Published and added 7 Oct 2026

aws.amazon.comwriteup🧠 AI

Configuring your AI vulnerability harness, Part 2: The steering file

Part 2 of an AWS Security Blog series detailing the design of a "steering file" — a persistent instruction set (deployable as a Kiro steering file, Kiro skill, or Claude Code CLAUDE.md) that constrains an LLM performing vulnerability triage. It walks through five configuration sections: requiring structural/dataflow verification before reporting findings, replacing self-reported confidence with a weighted formula based on binary structural signals (e.g., 0.30 weight for confirmed taint flow), mapping infrastructure controls (AWS WAF, IAM) to severity multipliers with a 0.15 floor, incorporating CISA KEV and EPSS threat-intelligence boosts capped at +0.50, and a four-tier priority classification that suppresses low-confidence P3 findings. Validation against a 10-vulnerability test app showed the steered model eliminated fabricated findings and correctly downgraded mitigated vulnerabilities while preserving full severity for a command injection reachable only via authenticated access.

KiroClaude CodeCursor+7
CISAEPSS

prompting, coding-agents· Added 8 Oct 2026, published 7 Oct 2026

x.comwriteup🛡️ Security

lee1981 (@lee1981b) on X

CyberForge CVE-of-the-Day #070 on CVE-2026-61500 in Rejetto HFS 3.0.0–3.2.0. The default Koa session-signing key came from Math.random() (CWE-338) and the unauthenticated login handshake leaked outputs of the same generator. That allows recovery of the key, a forged administrator session, and code execution through the legitimate server_code feature. It covers scoring (CVSS 9.8/9.3, EPSS, KEV status), the 3.2.1 fix, a six-step SOC hunting and remediation trail (loginSrp1/2, get_config/set_config pivots, COOKIE_SIGN_KEYS review), and offline jq/Python helpers for container and config metadata.

Rejetto HFSKoaDocker+2
CVE-2026-61500CWE-338VulnCheck+6

Blue Team & Detection, AppSec, Identity & Access· Added 9 Oct 2026, published 6 Oct 2026

x.comthread🛡️ Security

lee1981 (@lee1981b) on X

A detailed breakdown of CVE-2026-102710 (CVSS v4.0 9.3), a privilege-escalation flaw in Eclipse ThreadX RTOS builds with event tracing enabled: a module-supplied trace callback pointer is retained by the kernel and invoked with kernel privilege when the trace buffer wraps, letting an attacker who already controls a memory-protected user-mode module fault the kernel or execute code in kernel context. The thread walks through the vulnerable code path (registration, storage, invocation across the protection boundary), CWE-269/CWE-822 classification, affected versions (through v6.5.1.202602a_rel), and provides a defender hunting guide plus emergency remediation steps, noting no fixed upstream release or CISA KEV/EPSS entry exists yet.

Eclipse ThreadXCVSSNVD+1
CVE-2026-102710CWE-269CWE-822+1

Hardware & RF, Offensive Security, Blue Team & Detection· Published and added 30 Sep 2026

endorlabs.comarticle🛡️ Security

How Should I Prioritize Software Vulnerabilities? | Blog | Endor Labs

Endor Labs blog post comparing five approaches to prioritizing software vulnerabilities: CVSS scoring, CISA's KEV catalog, Carnegie Mellon's SSVC decision tree, FIRST's EPSS exploit-prediction model, and call-graph-based reachability analysis. It cites concrete data (e.g., EPSS v3 threshold of 0.088 catches ~82% of exploited CVEs while requiring remediation of only 7.3% of known CVEs, versus patching most CVSS high/critical issues) and walks through each method's limitations, using examples like CVE-2017-0144 (EternalBlue/NotPetya) and CVE-2004-1464.

CVSSEPSSNVD+2
CVE-2017-0144CVE-2004-1464CISA KEV

AppSec· Published and added 11 Sep 2026

endorlabs.comarticle🛡️ Security

OWASP OSS Risk 1: Known Vulnerabilities | Blog | Endor Labs

First in Endor Labs' 10-part series on the OWASP Top 10 OSS Risks, this piece breaks down "Known Vulnerabilities" (OSS-RISK-1): how CVEs get assigned and disclosed, why the 2017 Apache Struts CVE-2017-5638 unpatched flaw led to the Equifax breach of 145M+ records, and how to compare vulnerability data sources (NVD, GitHub Advisory Database, OSV). It details prioritization methods — CVSS, EPSS, CISA KEV, SSVC, and function-level reachability analysis — and shows a case study where filtering 134K findings down via reachability, fix-availability, production-code, and EPSS thresholds cut remediation work by 99.97%.

Endor LabsNVDOSV+2
CVE-2017-5638EquifaxApache Struts+2

Supply Chain, AppSec· Published and added 11 Sep 2026

endorlabs.comarticle🛡️ Security

Combining EPSS and Reachability Analysis to Optimize Vulnerability Management | Blog | Endor Labs

Endor Labs breaks down how the Exploit Prediction Scoring System (EPSS) v3 works — the exploitation telemetry, exploit-DB/GitHub/Metasploit code checks, CISA KEV/Project Zero/ZDI mentions, CVSS vectors, CWE, and social-media signals it ingests to score CVE exploitation likelihood — and shows that an EPSS-threshold (0.088) remediation strategy fixes the same share of exploited CVEs while patching only ~7.3% of known vulnerabilities versus ~82% under a "fix all high/critical" CVSS approach. It then explains a layered workflow: use reachability analysis (call-graph based) to cut findings by ~80% to what's actually exploitable in your environment, then apply EPSS on that reduced set to rank remaining issues by real-world exploitation likelihood, including for third-party/proprietary code where reachability analysis isn't feasible.

EPSSCVSSNVD+3
CISA KEVCWE-94

AppSec· Published and added 11 Sep 2026

endorlabs.comarticle🛡️ Security

FedRAMP Requirements for Vulnerability Management and Dependency Upgrades | Blog | Endor Labs

An Endor Labs blog post, written by a former JAB Technical Representative, details FedRAMP's Continuous Monitoring vulnerability management requirements: authenticated scanning, monthly dependency inventories, POA&M tracking, and strict remediation SLAs (High CVSS 7.0+ in 30 days, Medium in 90, Low in 180). It also covers FedRAMP's container-specific rules (hardened images, CISA KEV prohibition, pipeline/registry/runtime scanning) and outlines four practical strategies — reachability-based false-positive triage, EPSS-driven risk level adjustments, ROI/complexity-based upgrade prioritization, and developer-side PR gating — before pivoting into an Endor Labs product pitch.

Endor LabsCVSSEPSS
FedRAMPCISA KEVNIST 800-53

GRC, Supply Chain· Published and added 11 Sep 2026

github.comrepo🛡️ Security

mukul975/cve-mcp-server

cve-mcp-server is a Model Context Protocol server that gives Claude direct access to 28 security tools spanning 24 APIs (NVD, EPSS, CISA KEV, OSV.dev, GitHub GHSA, MITRE ATT&CK, AbuseIPDB, GreyNoise, Shodan, VirusTotal, MalwareBazaar, ThreatFox, Ransomwhere, and more), fronted by a one-call triage_cve orchestrator. It computes a composite 0-100 risk score from CVSS, EPSS, KEV status, and PoC availability (with a hard CISA KEV override forcing CRITICAL/≥76), supports dependency scanning via OSV, IP/domain reputation lookups with private-IP blocking, and ships an SSVC v2 gated decision mode plus audit logging and XML-bomb protections via defusedxml.

Model Context ProtocolClaude DesktopClaude Code+9
CVE-2021-44228CVE-2024-3400CVE-2023-44487+3

AI Security, Threat Intel· Published and added 7 Sep 2026

endorlabs.comarticle🛡️ Security

Agentic Development Security: How to Secure Code Your Agents Write | Blog | Endor Labs

Endor Labs blog post defining "agentic development security" — securing code, dependencies, and tool use when AI coding agents generate and merge code autonomously. It cites research showing 45% of LLM-generated code samples fail security tests (Veracode), 34% of AI-recommended dependency versions are hallucinated (Endor Labs), 82% of MCP implementations have path-traversal-prone file operations, and explains reachability analysis plus EPSS scoring as noise-reduction filters for prioritizing exploitable findings.

Endor LabsModel Context ProtocolEPSS
OWASP Top 10 for LLM ApplicationsOWASP Top 10 for Agentic ApplicationsNIST SSDF+7

AI Security, Supply Chain, AppSec· Added 3 Sep 2026, published 2 Sep 2026

github.comrepo🛡️ Security

cyanheads/osv-advisory-mcp-server

osv-advisory-mcp-server is an MCP server that queries the OSV.dev vulnerability database, offering single-package version checks, batch audits of up to 1000 {name, ecosystem, version} tuples for SBOM/lockfile triage, and full advisory record fetch by OSV ID (GHSA/PYSEC/RUSTSEC/GO/DSA/DLA/CVE prefixes). It surfaces CVE aliases, CVSS vectors, derived severity labels, and CWE IDs, and is designed to chain into a companion nist-nvd-mcp-server for CVSS base scores, EPSS probability, and CISA KEV status. It ships as a keyless, no-API-key tool runnable via STDIO or Streamable HTTP, with a public hosted instance and Bun/npx/Docker install paths.

Model Context ProtocolOSVBun+3
CISA KEVEPSSnist-nvd-mcp-server

Supply Chain· Added 1 Sep 2026

cloud.google.comarticle🛡️ Security

AI-Assisted Vulnerability Management

Mandiant/Google Threat Intelligence Group blog outlining a blueprint for safely integrating LLM agents into vulnerability management: defense-in-depth guardrails (input sanitization treating codebases as untrusted, sandboxed workload isolation, JIT scoped machine identities, toxic flow analysis for runtime exfiltration monitoring), a risk-based vulnerability management scoring formula combining CVSS, asset context, and EPSS/threat intelligence, and a "binary vs architectural oracle" framework explaining why AI agents excel at memory-corruption bugs (crash/no-crash feedback) but struggle with authz bypasses and business-logic flaws. It also covers IDE vs CI/CD remediation workflows, post-deployment controls like model pinning and immutable audit logs, and a longer-term push toward memory-safe language migration (e.g., C/C++ to Rust) using LLM assistance.

WizLangChainCVSS+3
NIST AI RMFOWASP Top 10 for LLM ApplicationsSAIF+9

AI Security, AppSec, DevSecOps· Added 3 Sep 2026, published 18 Jul 2026

github.comrepo🛡️ Security

XORCISM-AI/XORCISM

XORCISM is a self-hosted, open-source enterprise risk/exposure management platform (Node.js/TypeScript over SQLite/PostgreSQL/MySQL) that unifies asset inventory, vulnerability management, threat intel (STIX/TAXII), GRC (ISO 27001, NIST CSF/800-53, EBIOS Risk Manager, NIS2, DORA), incident management, and offensive/defensive testing into one continuously recomputed per-asset and enterprise risk score. It chains recon/exploitation tool connectors (nmap, nuclei, Metasploit, sqlmap) into attack-path/choke-point graphs weighted by fusion exploitability (EPSS+CVSS+KEV+public exploits), validates detection coverage via a purple-team loop against 3,750+ Sigma rules and MITRE ATT&CK/D3FEND, and quantifies ransomware impact in dollar terms via a FAIR-style model — with local-only Ollama AI assistants for triage, hunting, and reporting.

Node.jsTypeScriptSQLite+3
APT29SecureCodersRustinel

GRC, Offensive Security, Blue Team & Detection· Published and added 1 Jul 2026

github.comrepo🛡️ Security

RAPTOR

RAPTOR is an autonomous offensive/defensive security research framework built on top of Claude Code that chains static analysis (Semgrep, Coccinelle, CodeQL), binary analysis (radare2, Frida, Z3-based exploit feasibility), LLM-driven multi-stage vulnerability validation, exploit PoC generation, and patch writing into a single workflow against source code or compiled binaries. It also includes an /sca supply-chain command that enriches dependency findings with OSV, CISA KEV, EPSS, and SSVC data and emits CycloneDX SBOMs, and sandboxes LLM-generated/untrusted code execution using Linux namespaces, Landlock, and seccomp. Authored by Gadi Evron, Daniel Cuthbert, Thomas Dullien (Halvar Flake), Michael Bargury, and John Cartwright, it ships 200+ custom static analysis rules and supports multi-model LLM analysis (Claude, GPT, Gemini, Ollama).

Claude CodeSemgrepCodeQL+5
Gadi EvronDaniel CuthbertThomas Dullien+2

AppSec, Offensive Security, AI Security, Supply Chain· Published and added 28 Jun 2026

tenable.comadvisory🛡️ Security

CVE-2026-12773

Tenable CVE entry for CVE-2026-12773, an improper authentication flaw in BerriAI LiteLLM up to 1.59.8. The vulnerable function is UserAPIKeyAuth in litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py in the MCP Proxy component. It is remotely exploitable, a public exploit exists, and scores are CVSS v3.1 9.8 Critical, CVSS v4.0 6.9 Medium and EPSS 0.01017.

LiteLLMModel Context ProtocolPython+2
CVE-2026-12773CWE-287BerriAI

AI Security, AppSec, Identity & Access· Added 26 Jun 2026

github.comrepo🛡️ Security

CVE Lite CLI

CVE Lite CLI is an OWASP Lab Project CLI that scans npm, pnpm, Yarn, and Bun lockfiles against OSV and the npm advisory API and outputs copy-and-run fix commands instead of raw CVE lists, with parent-aware guidance for transitive dependencies. Beyond core CVE scanning it audits override/resolution hygiene, flags maintenance risk (deprecated direct deps and version drag blocking fixes), warns when a suggested fix falls inside a package manager's release-cooldown window (referencing the chalk/debug npm compromise), and emits SARIF, SPDX/CycloneDX SBOMs, and EPSS-based priority tiers, plus a GitHub Action that opens batched fix PRs.

npmpnpmYarn+3
chalk

Supply Chain, DevSecOps· Published and added 31 May 2026

labs.cloudsecurityalliance.orgarticle🛡️ Security

CSA: VulnOps in the Age of AI

Cloud Security Alliance research note arguing that traditional vulnerability management (scan, ticket, patch on a calendar) is breaking under AI-driven vulnerability discovery volume, NVD's April 15, 2026 risk-based triage policy that limits full CVE enrichment to CISA KEV/EO 14028/federal-use software, and compressed disclosure-to-exploitation windows. It defines VulnOps as a flow-oriented operating discipline (borrowing SRE/DevOps metrics like lead time, change-failure rate, and pipeline saturation) built on continuous discovery, EPSS/KEV-based risk prioritization instead of CVSS-only ranking, automated remediation-as-code, and first-class SBOM/supply-chain visibility, while also flagging agentic AI itself (prompt injection, tool-poisoning, MCP command execution) as a new vulnerability class the practice must cover.

NVDCVSSEPSS+2
Big SleepDARPA AI Cyber ChallengeExecutive Order 14028+9

GRC, AI Security, Supply Chain· Added 3 Sep 2026, published 13 May 2026

github.comrepo🛡️ Security

n8n Cybersecurity Workflows

A GitHub repo of n8n automation blueprints for security teams, organized into Red Team/Pentest, Blue Team (SOC/DFIR/TI), AppSec/DevSecOps, and Platform/General categories. Each of the ~90 workflow ideas gives a Purpose, Integrations, and Flow Outline (e.g., subdomain recon hubs, attack-surface diffing, GoPhish campaign launchers, C2 event forwarding, phishing auto-triage, SAST-on-PR with Semgrep, DAST nightly with ZAP, container image policy gates, CVE prioritization with EPSS/KEV) that map to concrete n8n nodes and real security tools like Subfinder, Nmap, Shodan, Trivy, MISP, and VirusTotal.

n8nNmapShodan+3

Offensive Security, Blue Team & Detection, DevSecOps· Published and added 6 May 2026