Security Library
Search security knowledge.
Find security articles, CWE guides, definitions, standards analysis, and product research.
Collections
Start with the question you need to answer.
Security articles
Threat analysis, breach lessons, framework changes, and practical guidance from the Deva Security Team.
CWE guides
Code-level explanations, vulnerable examples, remediations, and compliance mappings for common weakness classes.
OWASP Top 10
Category guides connecting OWASP risks to CWE patterns, incidents, detection methods, and controls.
Research
Citable findings, benchmarks, methodology notes, and original analysis from the Deva Security Team.
Security glossary
Definitions for application security, compliance, AI security, vulnerability management, and secure development.
Product comparisons
Technical comparisons of Deva and adjacent developer, security, and AI coding tools.
Latest analysis
Recently published.
OWASP Top 10:2025 Is Live. SSRF Is Gone, Supply Chain Is #3.
OWASP published the 2025 revision of the Top 10 in May 2026. Three structural changes deserve real attention from anyone writing or auditing application code.
Mini Shai-Hulud: The TanStack Supply Chain Attack That Hit OpenAI, Mistral, and 160+ Packages
A self-propagating supply chain worm compromised TanStack npm packages through GitHub Actions cache poisoning. No credentials stolen, just OIDC tokens extracted from runner memory.
Shift-Left Pentesting: Why Offensive Security Belongs in Your IDE
Traditional penetration testing happens after deployment. A new generation of tools moves attack-surface analysis into the IDE, where the cost of a fix is measured in developer-minutes rather than incident reports.
Copy Fail: 732 Bytes to Root on Every Linux Distribution Since 2017
CVE-2026-31431 is a local privilege escalation in the Linux kernel cryptographic subsystem. A 732-byte Python script can edit a setuid binary in memory and obtain root. CISA added it to KEV on May 7.
Exchange Server XSS-to-Spoofing: CVE-2026-42897 Added to CISA KEV
A cross-site scripting flaw in on-premises Microsoft Exchange Server enables email spoofing via crafted messages. CISA added it to KEV on May 15 with a May 29 federal deadline.
NGINX Rift: An 18-Year-Old Heap Buffer Overflow Just Got a CVE and a PoC
CVE-2026-42945 is a critical heap buffer overflow in NGINX rewrite module that has existed since 2008. CVSS 9.2, public PoC, zero authentication required.