patch2vuln v1.0 is an open-source CLI tool that automates CVE advisory generation from git patches using local LLMs and deterministic CVSS calculations. It accepts patches from URLs, files, or stdin and produces standardized CVE Record Format 5.2 JSON output while keeping sensitive diffs within local infrastructure.
Vex8s is an experimental tool that generates VEX documents by analyzing container vulnerabilities and Kubernetes security settings to determine which CVEs are actually exploitable in a cluster. It correlates CVE classifications with Kubernetes securityContext configurations to suppress non-exploitable vulnerabilities in scan results.
PatchWing is a tool that automatically generates verified fixes for known CVEs by producing reproducers, patches, and rollback proofs that maintainers can review and merge quickly. It focuses on fixing known bugs rather than discovering new vulnerabilities, demonstrating the approach on three real CVEs with full evidence bundles at minimal cost (~$1.28 per fix).
A security vulnerability was discovered in the constant-time-js JavaScript library, a demonstration tool for side-channel attack prevention. Researcher Yayu Wang reported that the library's conditional-selection functions contained a side-channel flaw undermined by V8 runtime optimizations, which the author patched in version 0.5.0 and disclosed via CVE.