Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Open Source Vulnerability Management: Fixing Dependency Risk Without Alert Fatigue

bugbunny.ai | blog | #supply-chain | #vulnerability-management | #open-source | #remediation | #sca | #sbom | #dependencies

Summary

Open-source vulnerability management without alert fatigue: build a dependency inventory from manifests, lockfiles and images, then prioritize by reachability and exposure instead of chasing every CVE.
Published
Collected

original ↗

Related coverage

blog · bugbunny.ai
Software Composition Analysis: Beyond Dependency CVE Lists
Software composition analysis beyond CVE lists: build an accurate SBOM, tie dependencies to services and owners, prioritize by reachability, and watch build-time tools and package scripts too.
blog · netspi.com
Open Source Software – Is It the Death of Your Company?
Warns that companies often don't know which open source components their applications contain, covering license risks from permissive to copyleft and the security vulnerabilities buried in OSS.
blog · aikido.dev
SCA Everywhere: Scan and Fix Open-Source Dependencies in Your IDE
Aikido's IDE extension now runs the full SCA workflow: scan manifests and lockfiles for CVEs with safe upgrade ranges, fix via AutoFix, and auto-refresh as lockfiles change.
blog · aikido.dev
Supply Chain Security: The Ultimate Guide to Software Composition Analysis (SCA) Tools
Guide to Software Composition Analysis: with 70–90% of app code from open source, SCA scans direct and transitive dependencies against CVE databases to prioritize real risks over noisy alerts.
blog · aikido.dev
Why Securing Bazel Builds is So Hard (And How to Make It Easier)
Bazel lacks standard lockfiles and manifests, making security scanning painful; Aikido now scans Bazel projects automatically and flags risky dependencies, replacing custom scripts and CI hacks.
blog · borghq.io
How to Prioritise Security Findings That Have No CVE
CVSS, EPSS and KEV are all built around published CVEs, so they cannot score findings in your own application code. This practical guide shows how to rank exploitable issues like tenant boundary flaws in a continuous testing queue.
back