Open Source Vulnerability News Today

Open-source vulnerability scanners identify security vulnerabilities in apps, networks, and systems. Compare features and functionalities.

The Malicious Packages repository acts as a public database where reports of malicious packages are stored.

Maintainers of the widely used open-source command-line tool cURL and libcurl library that supports key network protocols said two upcoming vulnerabilities are set

The Go-based tool — called OSV-Scanner — provides an automated capability to match a developer’s code and dependencies against lists of known vulnerabilities and deliver instant feedback if patches or updates are needed.

Google said its open-source scanner connects to a vulnerability database, showing developers the security risks in their projects.

Google introduced OSV-Scanner this week, a free tool that lets developers making open-source software scan for known vulnerabilities in the dependencies they use. The scanner checks their...

Learn how you can leverage the data in a software bill of materials (SBOM) document to find vulnerabilities in API dependencies. The post Can SBOM help you attack APIs? appeared first on Dana Epp's Blog.

These commercial and open-source tools will scan code and create software bills of materials automatically.

Recent vulnerabilities such as Log4j2 have called attention to the challenges of securing open-source software, which is used widely by tech companies and other industry enterprises. Google will release the security-vetted versions of open source software packages that it runs itself for industry and government use.