Search: “vulnerability-scoring”

28 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll

SeverityAll critical 0 high 0 medium 0 low 0 info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Your Critical Vulnerabilities Might Not Be Your Biggest Risk

Autonomous penetration testing advocates prioritize exploitable attack paths over raw vulnerability severity for continuous security validation.

The article argues that scanner severity scores lack context: a critical flaw behind strong segmentation may be low priority, while a medium flaw on internet-facing systems can provide a foothold chained toward sensitive data. It positions autonomous penetration testing and attack path validation as the execution layer for continuous security validation, replacing point-in-time assessments. The piece is vendor-authored thought leadership rather than incident or vulnerability news.

The Hacker NewsSep 11, 11:30 UTC · 4d agoIndustry1

Can your coding style predict whether your code is vulnerable?

University of Massachusetts Dartmouth researchers present VulStyle, a stylometry-based vulnerability detector that also exposes benchmark reliability problems.

VulStyle combines stylometric features with syntax-tree structure and source tokens, pre-trained on about 4.9 million functions across seven programming languages and fine-tuned on five vulnerability detection datasets. It beat token-only detectors on some benchmarks but its F1 drops sharply on DiverseVul, which the authors link to noisy labels inflating reported performance across popular datasets. The authors argue style-aware detection should be harder to evade but did not test this empirically, and they note that uniform LLM-generated code may strip away the individual developer style the model depends on.

Help Net SecurityAug 24, 04:21 UTC · 23d agoResearch1

Building a risk-based vulnerability management program that scales

Asimily CEO Shankar Somasundaram outlines a risk-based vulnerability management approach using inventory, attack paths, KEV and EPSS data.

In a Help Net Security video, Asimily CEO Shankar Somasundaram argues patching everything is infeasible as AI-driven attacks inflate vulnerability counts, with one customer finding a thousand unknowns for each known one. He recommends building a full inventory of devices, applications, and data flows, mapping attack paths for reachability, and prioritizing with KEV, EPSS, and business impact. Mitigations include patching, virtual patching via NACs and firewalls, segmentation, and configuration snapshots to detect drift.

Help Net SecurityAug 24, 04:21 UTC · 23d agoIndustry

Quantifying IIoT Sensor Node Criticality by Fusing its Data Criticality and Security Vulnerability

Researchers propose a Dempster–Shafer framework fusing IIoT sensor data criticality with CVSS 4.0/3.1 vulnerability scores to rank node criticality.

The paper introduces a framework that evaluates Industrial IoT sensor node criticality by fusing data criticality and cybersecurity vulnerability scores using Dempster–Shafer (D-S) theory. It was validated on a dataset from red wine production and is claimed to generalize to other industrial settings with minimal modification. Results show criticality rankings derived from CVSS 4.0 scores differ significantly from those derived from CVSS 3.1, underscoring how vulnerability scoring methodology affects security prioritization.

arXiv cs.CRSep 9, 07:03 UTC · 7d agoResearch

The Vulnerability Gap: Why Discovery Is Outrunning Repair

Dark Reading argues AI-accelerated vulnerability discovery and tightening regulation are widening the gap between flaw discovery and repair capacity.

The article argues that AI tooling is increasing the pace at which vulnerabilities are discovered while remediation capacity has not kept up, creating a growing backlog. It frames this widening 'vulnerability gap', combined with a tightening regulatory environment, as an all-hands-on-deck moment for security teams. The piece is analysis and opinion rather than disclosure of a specific flaw.

Dark ReadingAug 24, 14:00 UTC · 22d agoIndustry

Vulnerability Localization Benchmark: Measuring Agentic Security Analysis at Repository Scale

VLoc Bench tests 27 language models at locating vulnerable files in 290 repositories; best system reaches 0.229 File F1 and 38.4% of tasks unsolved.

The Vulnerability Localization Benchmark (VLoc Bench) contains 500 real-world vulnerabilities from 290 repositories across six package ecosystems and 147 CWE categories, pairing pre-fix and post-fix repository snapshots. Agents receive only a CWE description and read-only terminal access to identify affected files, and must confirm absence on patched snapshots. The strongest of 27 language models and four static-analysis tools achieves just 0.229 File F1; 38.4% of tasks receive no correct localization, and effective localizers still report unsupported locations on patched repositories.

arXiv cs.AI / cs.LG / cs.CLSep 14, 17:44 UTC · 1d agoAI research

Evaluating the NIST Bugs Framework Against CWE as a Successor for Automated Vulnerability Classification

NIST Bugs Framework evaluation shows it is more structured and automation-friendly than CWE for automated vulnerability classification, with gaps in attribute guidance.

The paper evaluates NIST SP 800-231's Bugs Framework (BF) against CWE as a target for automated CVE classification using a systematically screened corpus of CVE-to-CWE research. An inter-rater study with 2 subject-matter experts mapping 13 CVEs showed strong agreement on BF's cause and operation axes but only fair agreement on the attribute axis. Automated classification was tested across two LLM deployments under different budgets, and findings support BF as more structured and automation-friendly than CWE, though gaps include under-specified attribute guidance and missing fix commits for closed-source software.

arXiv cs.CRSep 14, 23:18 UTC · 1d agoResearch1

Introducing Continuous Vulnerability Assessment: Real-Time Defense for the AI Threat Era

Wiz launched Continuous Vulnerability Assessment (CVA), alerting customers to exposure against newly published vulnerabilities in real time.

Wiz introduced Continuous Vulnerability Assessment, a capability that detects exposure to newly published vulnerabilities the moment they are disclosed. The company positions CVA as real-time defense for the AI threat era, reducing the window between disclosure and remediation decisions. The item is a vendor product announcement with no incident details.

Wiz BlogSep 1, 10:54 UTC · 14d agoTools

VEX-Bench: Benchmarking LLM Agents for Assessing Exploitability of Software Supply Chain Vulnerabilities

Introduces VEX-Bench, 75 expert-labeled real-world cases testing whether LLM agents can assess supply chain vulnerability exploitability; frontier models reach about 80% F1.

VEX-Bench is the first benchmark evaluating LLM agents on assessing whether upstream dependency vulnerabilities are exploitable in downstream projects, with 75 real-world expert-labeled cases across Python, Java, and Go mined from GitHub. Nine models across three agent harnesses were evaluated; GPT-5.5 and Claude Opus 4.6 reach approximately 80% F1 on binary vulnerability-status classification, but only GPT-5.5 surpasses 70% macro-F1 on fine-grained justification classification. The gap highlights the difficulty of moving beyond binary exploitability calls to explaining exploitability reasons, unlike prior benchmarks targeting zero-day settings.

arXiv cs.CRSep 7, 22:52 UTC · 8d agoResearch1

Toward an Empirical Probabilistic Risk Manifestation Model of Organizational Cybersecurity in SMEs

Empirical study of 22 SME security assessments builds a probabilistic risk model and shows assessments can be cut 24-45% while retaining most critical findings.

Researchers analyzed 281 validated security findings from 22 real-world SME cybersecurity assessments conducted over two years via a pro bono university clinic. They derived an empirical Risk Manifestation Model linking eight organizational security functions to two exposure conditions, five attack mechanisms, and six outcome categories, using probability propagation to identify dominant risk pathways. The dominant pathway runs from asset exposure to credential compromise to unauthorized access, stable under leave-one-organization-out analysis. Retaining six functions reduces assessment burden by 24% while preserving 97% of critical findings; five functions cut burden 45% while preserving 89% of critical findings.

arXiv cs.CRSep 14, 01:15 UTC · 2d agoResearch

AI vulnerability discovery scores the highest impact of 20 emerging risks

Gartner survey of 316 organizations ranks AI-driven vulnerability discovery as the top emerging risk, with tangible impact expected within roughly two years.

Gartner's quarterly survey had 316 risk managers, auditors, and senior executives rank 20 emerging threats in April and May, with AI discovery of cyber vulnerabilities ranked first, up from outside the top five the prior quarter. Respondents scored the impact time frame at 1.92 on a scale where 1 means under a year and 2 means one to two years, and 76% placed it in their top ten, ranking first in all four regions and highest among banking and financial respondents at 78%. The analysis notes AI now finds unknown flaws at volumes patching teams cannot absorb and that exploit development time has collapsed, citing defensive efforts like Anthropic's Project Glasswing and OpenAI's Daybreak. Gartner recommends recalibrating cyber risk impact, revisiting risk appetite, demanding stronger vendor security validation, and moving toward faster automated remediation.

Help Net SecurityAug 26, 00:00 UTC · 21d agoIndustry

Enterprise Applications Carry 4.31x More Critical and High Vulnerabilities

Sonatype reports enterprise applications contain 4.31x more critical and high-severity vulnerabilities as accelerated software creation drives rising vulnerability levels.

Sonatype's analysis found enterprise applications carry 4.31 times more critical and high-severity vulnerabilities. The report links rising vulnerability levels to accelerated enterprise software creation. The findings are part of Sonatype's software supply chain research coverage reported by Infosecurity Magazine.

Infosecurity MagazineAug 18, 15:00 UTC · 28d agoIndustry

TIER: Threat Implicitness Benchmark for Evaluating LLM Safety Behaviors

TIER benchmark shows LLM safety behaviors shift gradually across threat implicitness levels, with jailbreaks exposing the largest robustness gaps.

The TIER benchmark evaluates LLM safety behaviors across four risk domains and four threat levels, from explicit harmful requests to sophisticated jailbreaks, using a six-label behavior scale and two independent LLM judges. Experiments on six open-weight LLMs show safety behaviors evolve gradually across threat levels rather than flipping from refusal to compliance. Models with similar Attack Success Rates can exhibit distinct response distributions, arguing for behavior-aware safety evaluation.

arXiv cs.CRSep 4, 13:13 UTC · 11d agoAI safety & security

You Get What You Sample: Evaluating Sampling Strategies for Web Security Measurements

Evaluation of 500k Tranco and 24.8M Common Crawl hosts shows Top-N domain sampling biases web security measurements; probability sampling yields unbiased estimates.

The study is the first comprehensive investigation of how sampling strategies affect web security measurement conclusions, comparing datasets and strategies across 500k Tranco domains and 24.8M Common Crawl hosts. It shows Top-N selection does not reflect the overall web distribution and may bias observed vulnerability rates, while probability-based strategies yield stable, unbiased prevalence and impact estimates. Hybrid sampling offers no advantage because its deterministic prefix consistently hurts accuracy, and the authors propose an adaptive probability-based strategy effective even when target prevalence is unknown.

arXiv cs.CRSep 10, 08:21 UTC · 6d agoResearch1

Benchmark Scores Are Pipeline-Dependent: A Reliability Audit of Cybersecurity LLM Benchmarks

Audit of eight cybersecurity LLM benchmarks shows evaluation pipeline choices can swing scores by over 80 points and reshuffle most model rankings.

Researchers modeled eight cybersecurity benchmarks as configurable measurement pipelines and audited 10 proprietary, open-weight, and cybersecurity-specialized LLMs. They identified 15 systematic failure modes and showed a single pipeline choice can change a model's score by more than 80 percentage points and alter rankings; semantically similar task pairs rank the same models differently. Under a standardized harness, nine of 10 models shifted at least three ranks on at least one benchmark, motivating pipeline-aware auditing for reliable model evaluation.

arXiv cs.CRSep 8, 14:01 UTC · 7d agoAI research1

Frontier AI: Vulnerability Management's Systemic Revolution

Opinion: frontier AI like Anthropic's Mythos finds and exploits vulnerabilities at machine speed, forcing vulnerability and patch management programs to overhaul prioritization.

The author argues frontier AI models, exemplified by Anthropic's Mythos, can discover zero-days and chain exploits fast enough to overwhelm traditional vulnerability management. The piece recommends moving beyond CVSS, EPSS and KEV toward exposure management (CTEM) and automated, ring-based patch deployment. It also flags hard trade-offs between patching velocity and uptime requirements that organizations must resolve proactively.

The Hacker NewsAug 25, 11:14 UTC · 21d agoIndustry

SEMA-GUARD: Semantic and Graph-Based Vulnerability Detection in Assembly Code

SEMA-GUARD uses semantic analysis and graph neural networks to detect vulnerabilities in assembly code, achieving 85.1% accuracy on a Juliet-derived benchmark.

SEMA-GUARD is a framework that detects vulnerabilities in compiled programs when source code is unavailable, targeting malware, firmware, and embedded systems analysis. It enriches control flow graphs with low-level execution semantics including stack manipulations, memory accesses, and data flow. Evaluated on a Juliet Test Suite set compiled to assembly and split into function-level chunks, it achieves 85.1% accuracy and an F1 score of 0.801, outperforming purely statistical or structural approaches.

arXiv cs.CRSep 15, 14:35 UTC · 20h agoResearch1

Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329

Wiz Research confirms in-the-wild exploitation of three JFrog Artifactory vulnerabilities, chained to gain administrative control, deploy Groovy plugins, and install Rust backdoors.

Wiz Research identified active exploitation of CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329 in JFrog Artifactory between August 15 and September 8, 2026. Attackers chain the anonymous-token exposure (CVE-2026-42018) with the token scope-validation flaw (CVE-2026-42016) to obtain admin-scoped tokens, while CVE-2026-82329 allows unauthenticated administrative access in default configurations. Observed post-exploitation includes persistent administrator accounts created in under five minutes, malicious Groovy plugin deployment, ad-hoc command execution, Rust-based C2 backdoors dropped to writable paths, and webshell uploads. Wiz measured that 59-62% of organizations running Artifactory remained vulnerable to the chained CVEs weeks after disclosure, and the vulnerabilities were already included in CISA KEV.

Wiz Blogupdated Sep 14, 09:27 UTC · 2d agofirst Sep 10, 19:04 UTC · 5d agoExploit / PoC in the wild 7 sources CVE-2026-42016 CVE-2026-42018 CVE-2026-823292· 1 read

An Empirical Analysis of ReDoS Vulnerabilities and ReDoS Detection Tools

Study of NVD data finds ReDoS vulnerabilities growing more prevalent and more likely to be exploited, while five detection tools disagree substantially.

The study compares five publicly available ReDoS detection tools and one regex correction tool across three datasets. An empirical analysis of all ReDoS vulnerabilities reported to the NVD finds they are becoming more prevalent and are much more likely to be exploited than non-ReDoS weaknesses. The detection tools exhibited substantial disagreement on whether a given regex is vulnerable.

arXiv cs.CRSep 9, 15:09 UTC · 6d agoResearch

Towards Scalable and Cost-Efficient Vulnerability Detection: A Study on Automatic Query Generation

A study finds LLM-synthesized CodeQL queries improve average F1-score by 82% over baseline queries, offering scalable vulnerability detection versus direct LLM scanning.

Researchers conducted an empirical study evaluating whether LLMs can synthesize executable CodeQL queries from National Vulnerability Database vulnerability data. LLM-generated queries significantly enhanced baseline CodeQL suites, yielding an 82% improvement in average F1-score across a diverse set of real-world vulnerabilities. A cost-benefit analysis shows direct LLM-based scanning of entire repositories is often computationally and financially prohibitive, while LLM query synthesis offers a scalable and cost-effective alternative for large-scale vulnerability detection.

arXiv cs.CRSep 9, 16:31 UTC · 6d agoResearch1

Critical Langflow Vulnerability Exploited as Attacks on AI Platform Rise

Attacks exploiting CVE-2026-0768, a critical vulnerability in the Langflow low-code AI platform, are rising amid growing adversary attention this year.

CVE-2026-0768 is a critical vulnerability in Langflow, a low-code AI development platform, with exploitation attacks now rising. Dark Reading notes the platform has drawn increasing adversary attention in 2026. Organizations running exposed Langflow instances face elevated risk and should patch promptly and review instances for compromise.

Dark ReadingSep 1, 20:48 UTC · 14d agoExploit / PoC in the wildCVE-2026-07681

Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak models

Cloudflare launches invitation-only Vulnerability Discovery and Remediation within Managed Defense, using OpenAI Daybreak models and WAF context to prioritize and patch vulnerabilities.

Cloudflare announced early access to Vulnerability Discovery and Remediation, an invitation-only service within Cloudflare Managed Defense. The service uses OpenAI Daybreak models, including GPT-5.6 Cyber, via the Daybreak Defense Network to hunt and validate vulnerabilities in customer-authorized codebases across Workers and proxied applications. Findings are prioritized using production traffic, WAF rule, and security event context, and proposed patches and WAF mitigations are automatically checked before customer review.

Cloudflare BlogSep 3, 21:03 UTC · 12d agoTools

8,539 Reasons To Rethink How Vulnerabilities Get Patched

Rapid7 counted 8,539 high and critical CVEs in Q2 2026, double last year, with PoC availability up 76%.

Rapid7's Q2 2026 Threat Landscape Report tallied 8,539 high- and critical-severity vulnerability disclosures, twice the number recorded in Q2 2025, with newly disclosed flaws having public proof-of-concept code up 76% year over year. Of newly exploited vulnerabilities, 62% were network-exploitable and required neither authentication nor user interaction. Fake CAPTCHA and ClickFix social engineering accounted for 31.8% of incident response cases, the United States recorded 881 listed ransomware victims, and APT28 exploited SOHO routers for DNS hijacking while Iranian groups targeted US industrial control and OT systems.

Help Net SecurityAug 20, 00:00 UTC · 27d agoResearch

Identifying a BOLA Vulnerability in Harbor, a Cloud

Unit 42 found a BOLA flaw, CVE-2024-22278 (CVSS 6.4), letting Maintainers improperly alter Harbor project metadata; fixed in versions 2.9.5, 2.10.3, and 2.11.0.

Unit 42 researchers identified a broken object-level authorization flaw, CVE-2024-22278, in Harbor, a CNCF-graduated cloud-native container registry with 1.8 million downloads. The flaw (CVSS 6.4) lets users with the Maintainer role create, update, and delete project metadata, actions reserved for ProjectAdmin, risking data exposure, integrity compromise, and circumvention of vulnerability scanning. Harbor patched the issue in versions 2.9.5, 2.10.3, and 2.11.0. The finding came from Unit 42's automated BOLA detection tool built on generative AI.

Palo Alto Unit 42Aug 17, 12:35 UTC · 29d agoVulnerability CVE-2024-22278

BenchShield: Formal Model-Backed Instrumentation for Reward Integrity in LLM-Agent Evaluation Infrastructure

BenchShield uses lifecycle-model-backed instrumentation to detect reward hacking in LLM-agent benchmarks, lifting full-chain recall to 77-100% at up to 65% lower cost.

The framework grounds reward-hacking detection in a finite lifecycle model of an evaluation's reward-relevant events, combining a static phase-aware taint analysis with runtime infrastructure-side evidence attribution. Evaluation used a human-labeled corpus of 456 adjudicated trajectories drawn from more than 31,000 public agent runs across three benchmarks. BenchShield improves full-chain recall from 23-94% to 77-100% and same-vector coverage from 16-56% to 43-78%, cuts per-task cost by up to 65%, and achieves 96% accuracy detecting reward hacking at runtime.

arXiv cs.CRSep 10, 03:10 UTC · 6d agoAI safety & security1

What vulnerability prioritization looks like when KEV, EPSS, and CVSS disagree

Cohesity field CISO Joye Purser ranks KEV over EPSS over CVSS and urges 24-72 hour patching of exploited internet-facing systems.

In a Help Net Security interview, Cohesity Global Field CISO Joye Purser lays out a vulnerability prioritization framework that puts active exploitation (KEV) first, then exploit likelihood (EPSS), then technical severity (CVSS), adjusted for asset exposure, business criticality, and compensating controls. She endorses 24-72 hour remediation targets for critical exploited internet-facing vulnerabilities and describes the organizational tradeoffs and emergency procedures needed to hit them. The interview also covers honeypot failure modes when deception systems are over-connected or over-trusted, and budget guidance recommending OT/IT segmentation, phishing-resistant MFA, and tested recovery for a 400-person manufacturer.

Help Net SecurityAug 31, 00:00 UTC · 16d agoIndustry

The Vulnpocalypse Is Repricing the Bug Bounty Economy

Surging AI-generated vulnerability reports are driving down bug bounty payouts, threatening the economics of independent security researchers.

Dark Reading argues that a surge of AI-powered vulnerability reports is repricing the bug bounty economy. As programs absorb escalating report volume, payouts for many classes of findings are falling. The trend could undermine the livelihoods of independent full-time bug bounty researchers.

Dark ReadingAug 28, 13:00 UTC · 18d agoIndustry

Mythos Vulnerability Firehose Hits a Human Bottleneck

Analysis of Project Glasswing findings shows only a fraction of discovered vulnerabilities have reached disclosure and even fewer are fixed.

Dark Reading reports that an analysis of Project Glasswing findings shows only a fraction of the vulnerabilities discovered by the program have reached disclosure, and an even smaller number have been fixed. The article examines how the volume of findings from the discovery program is bottlenecked by limited human triage and remediation capacity. The piece highlights growing tension between high-volume vulnerability discovery and the industry's ability to process, disclose and patch reports.

Dark ReadingSep 9, 21:19 UTC · 6d agoResearch