CWE-bench v2 adds more coverage quality and transparency
CWE-bench v2 release expands coverage quality and transparency.
Stories per day · 30 days
4 RSS
Relatedbinary-analysis2agent-security1benchmark1cve-enrichment1cvss1cweval1huggingface1inference-time1llm-agents1neural-decompilation1nvd1openclaw1phi-31primevul1prompt-injection1secure-code-generation1vuln-detection1vulnerability-detection1
19 stories, newest first · one card per story
Stories tagged #cwe
VulnLens uses structured explanations for binary vuln detection
On a 526-function PrimeVul test set it reported 75.5% accuracy and 77.2% F1, ahead of DeepSeek V4 Pro and Gemini 2.5 Pro on those metrics.
Study maps OpenClaw agent security failures across Reddit and GitHub
Across 162 Reddit posts and 180 GitHub issues, 521 weakness instances cluster in access control, exposure, injection, and unsafe execution.
VulDec pairs neural decompilation with binary vulnerability detection
Tuned LLM detectors reach macro F1 0.61 on a realistic test set with a 3% vulnerability rate.
SecGent improves secure code generation without dropping required behavior
On CWEval, open-weight models gain 15.5% FS@1 over RAG, and Claude Sonnet 5.5 reaches 92.1%.
Fine-tuned Phi-3.5-mini predicts CVSS and CWE from CVE text
It matched official vectors on 48.8% of 36,325 usable 2024 CVEs after training only on 2022 and 2023.
ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary
ToFu fuzzing found verified semantic bugs in 343 LLM tools across 118 MCP servers.
Cisco NX-OS Software Security Hardening Release: October 2026
Cisco issued an October 2026 NX-OS hardening release for internally found flaws not known to be exploited.
Learning from Failures: A Failure-Driven Prompt Refinement for LLM-Based Vulnerability Analysis
Failure-driven prompt refinement uses recurring LLM mistakes to improve vulnerability analysis on DVJA and Juliet.
Newer and Bigger, but Safer? A Longitudinal Study of the Functionality-Security Gap in LLM-Generated Code
Across 32 LLMs, newer models are safer in absolute terms, but no family closes the code security gap.
Trajectory-Level Security Debt in LLM Coding Agents
A new metric tracks static-analysis security debt across intermediate states of LLM coding agents, not just final code.
SecProbe: Adaptive Evaluation of Coding Agents on Cybersecurity Vulnerabilities
SecProbe adaptively tests coding agents on synthesized vulnerability repairs; frontier models peak at 28.33% success.
Cisco Nexus Dashboard Software Security Hardening Release: September 2026
Cisco released Nexus Dashboard hardening updates for multiple internally discovered vulnerabilities, grouped by CWE and not known to be exploited.
Evaluating the NIST Bugs Framework Against CWE as a Successor for Automated Vulnerability Classification
NIST Bugs Framework evaluation shows it is more structured and automation-friendly than CWE for automated vulnerability classification, with gaps in attribute guidance.
Vulnerability Localization Benchmark: Measuring Agentic Security Analysis at Repository Scale
VLoc Bench tests 27 language models at locating vulnerable files in 290 repositories; best system reaches 0.229 File F1 and 38.4% of tasks unsolved.
An Empirical Security Analysis of Open-Source Software Used in Onboard Satellite Systems
Study of 126 onboard satellite OSS repositories finds 2,827 security findings, 72% medium severity or higher, dominated by memory safety and code quality weaknesses.
AWS puts AI vulnerability detection to the test, and false positives pile up
AWS publicly released its Deception Benchmark (14,822 samples) showing leading AI models falsely flag 41-99% of safe code as vulnerable.
3
The History Is the Detector: Executing CVE Patch History, End-to-End
BUGSTONE-E2E converts CVE patch history into executable LLM-guided detection rules, yielding 1,033 rules and 644 runtime-verified findings across 14 programs.
CISA review makes the case for eliminating vulnerability classes
CISA's FY2024-2025 vulnerability review urges eliminating recurring vulnerability classes, finding 41.5% of 2025 KEV entries map to persistent 'stubborn weaknesses'.