PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Reduce supply chain risk with SBOM-based dependency scanning

about.gitlab.com | blog | #supply-chain | #appsec | #vulnerability-management | #gitlab | #sbom | #cyclonedx | #dependency-scanning
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

GitLab 19.0 makes SBOM-based dependency scanning generally available: it inventories direct and transitive dependencies, traces vulnerable package origins, and ranks findings by real-world exposure.
Published
Collected

Related coverage

blog · about.gitlab.com
Track organization-wide security risk in one dashboard
For enterprises with many top-level groups, GitLab now aggregates vulnerabilities and a single risk score across your entire organization.
blog · aikido.dev
Understanding SBOM Standards: A Look at CycloneDX, SPDX, and SWID
SBOMs need standard formats to be shareable. The article compares CycloneDX, built for security with VEX support; SPDX, the ISO-recognized standard; and SWID tags for software identification.
blog · wiz.io
Supply Chain Zero Days: Closing the Gap Between Publication and Detection
Attackers use compromised npm packages to spread malware in minutes. Discover how Wiz detects malicious packages at publication using AI and dynamic analysis.
blog · borghq.io
How to Prioritise Security Findings That Have No CVE
CVSS, EPSS and KEV are all built around published CVEs, so they cannot score findings in your own application code. This practical guide shows how to rank exploitable issues like tenant boundary flaws in a continuous testing queue.
vulnerability · about.gitlab.com
Pillow CVE-2026-112900: How to find and fix it with GitLab
Upgrade to Pillow 13.0.0, then use dependency scanning, code search, and GitLab Duo Agent Platform to patch every affected Python project in your groups.
blog · about.gitlab.com
What happens when vulnerabilities are discovered faster than you can fix them?
AI is changing how quickly vulnerabilities can be discovered and exploited. The next challenge is bringing that same speed to remediation and prevention
Back