Endor Labs (Vendor): news timeline & CVEs

12 Best SCA Tools Compared (2026): Features & Pricing

A 2026 SCA comparison highlights Snyk, Sonatype, and Socket across three dependency-risk lanes.

GBHackers compared twelve software composition analysis tools, arguing dependency risk spans known CVEs, malicious packages, and license exposure. Snyk leads the developer-platform lane, Sonatype the repository-firewall lane, and Socket malicious-package detection. Mend is highlighted for Renovate-based remediation, Endor Labs for function-level reachability, and FOSSA and Black Duck for license and legal depth.

GBHackers07:33 UTC · 15h agoIndustry1

Top 10 Best Software Supply Chain Security Tools in 2026 [Ranked & Scored]

A 2026 supply-chain security ranking names Chainguard first, then Sonatype and Snyk.

Cyber Security News ranked ten software supply-chain security tools for 2026, weighting coverage across dependencies, pipelines, artifacts, and base images. Chainguard placed first for continuously rebuilt, signed, low-CVE container images, followed by Sonatype for ingestion control and Snyk for developer breadth. Aqua, JFrog, Endor Labs, and Legit Security were scored for runtime coverage, artifact custody, reachability, and pipeline integrity.

Cyber Security News07:31 UTC · 15h agoIndustry

Top 10 Best SCA Tools in 2026 [Ranked & Scored]

A 2026 ranking of ten SCA tools places Snyk first, then Sonatype and Endor Labs.

Cyber Security News ranks ten software composition analysis tools, weighting triage quality, coverage, remediation automation, pricing clarity, and SBOM support. Snyk scores 9.1, Sonatype 8.9 for repository-firewall controls, and Endor Labs 8.8 for function-level reachability. Mend, Socket, Black Duck, JFrog Xray, Checkmarx, Veracode, and OWASP Dependency-Check complete the list. The scores are editorial and not based on lab testing.

Cyber Security News07:10 UTC · 15h agoTools

Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE

Critical type-confusion flaw in isolated-vm Node.js sandbox (GHSA-864f-rcv7-6rh4) enables guest-to-host escape and potential RCE; fixed in 6.2.0 and 7.0.1.

Endor Labs researcher Cristian-Alexandru Staicu found a type confusion in the ExternalCopy component's handling of the transferList option in isolated-vm, letting sandboxed JavaScript corrupt host-process memory and escalate from controlled-address crashes to full control-flow hijack of the host, i.e., potential remote code execution. The flaw, tracked as GHSA-864f-rcv7-6rh4 with no CVE yet, affects all versions through 7.0.0 of the library, which sees nearly 1 million npm downloads weekly. It was patched in versions 6.2.0 and 7.0.1 released earlier in August 2026, and full exploit details are withheld to prevent attacks. The V8 Isolate boundary itself held; the failure was in the C++ marshalling code bridging host and guest.

The Hacker NewsAug 20, 13:48 UTC · Aug 20, 2026Vulnerability1

Endor Labs

Timeline4 articles

Appears with

12 Best SCA Tools Compared (2026): Features & Pricing

Top 10 Best Software Supply Chain Security Tools in 2026 [Ranked & Scored]

Top 10 Best SCA Tools in 2026 [Ranked & Scored]

Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE