Carnegie Mellon University Software Engineering Institute

09/04/2026

A New CERT Vulnerability Note: Casdoor authentication server is vulnerable to authorization bypass - https://kb.cert.org/vuls/id/889462

09/03/2026

The appeal of applying AI to MBSE is apparent. Our latest post explores how to integrate AI without weakening engineering rigor -

The appeal of applying AI to MBSE is apparent. This post explores how to integrate AI without weakening engineering rigor.

09/02/2026

Check out the latest Tactical Guide in the Software Acquisition Go Bag, "The Key to SWP Success: The User Agreement" -https://www.sei.cmu.edu/documents/6567/The_Key_to_SWP_Success_The_User_Agreement.pdf

Collaboration among the Program Management Office, the Product Team, and users is paramount to the success of software acquisition. The user agreement is the cornerstone of that collaboration and a key document for programs on the Software Acquisition Pathway. Even those not on the SWP, but who are using Agile development methods, should consider developing and adopting a user agreement to get commitment from users to participate throughout the software development lifecycle.

09/01/2026

A New CERT Vulnerability Note: Hugging Face Transformers library writes remote code to disk prior to consent check - https://kb.cert.org/vuls/id/456290

08/31/2026

A New CERT Vulnerability Note: Remote Code Ex*****on and Arbitrary File Read Vulnerabilities in Kaltura Servers - https://kb.cert.org/vuls/id/308749

08/28/2026

As open‑source ecosystems grow ever more central to modern software development, the traditional view of Coordinated Vulnerability Disclosure (CVD) as a “nice‑to‑have” becomes dangerously inadequate.

In a recent talk at the 38th Annual FIRST Conference, “From CVD to Secure Releases: Automating Security from Source to Releases,” the SEI's Vijay Sarvepalli and Christopher Cullen argue that CVD must evolve: not just to notify, but to actively secure software supply chains, builds, releases, and audit tools. By integrating CVD into developer workflows on platforms such as GitHub, GitLab, and public registries like npm and PyPI, we can shift security “left,” enforce continuous policy checks, and ensure that disclosure actually leads to safer software in production -

Vijay Sarvepalli (Software Engineering Institute, US), Christopher ...

08/27/2026

ICYMI: Watch yesterday's webcast, "Intro to the SEI CERT Secure Coding Standard for Fortran." The SEI CERT Division's David Svoboda and Codee founder Manuel Arenaz discuss the new secure coding standard for one of the oldest high-level programming languages still in active use. Fortran remains a cornerstone of scientific, engineering, and high-performance computing software in critical applications areas. The SEI CERT Coding Standard for Fortran leverages expertise in secure coding practices and provides well-documented and enforceable coding guidelines to audit Fortran software -

SEI CERT Fortran Coding Standardhttps://cmu-sei.github.io/secure-c...

08/26/2026

A New CERT Vulnerability Note: Konami's Metal Gear Online 3 contains a heap-based buffer overflow - https://kb.cert.org/vuls/id/728712

08/26/2026

A New CERT Vulnerability Note: Remote Code Ex*****on and Arbitrary File Read Vulnerabilities in Kaltura Servers - https://kb.cert.org/vuls/id/308749?_gl=1

08/26/2026

Creating high-fidelity digital twins is costly and time consuming. A new class of volumetric modeling techniques is changing this paradigm, enabling the creation of photorealistic visual models and geometrically accurate 3D meshes from real-world data. In a free webcast on September 23, the SEI's Matthew Walsh and Dominic Ross will explore one emerging approach—3D Gaussian Splatting (3DGS)—and discuss how organizations can leverage these models for applications such as simulation, training, visualization, autonomous systems, and digital engineering - https://events.zoomgov.com/ev/Ar0op7hNVc4K8fSz7l3iW_hJGIrODVMMdZnXvQ988EyByLhEAS1e~AgtG_qMxlXUry2PMlaX7lpzOu8fMSNs1Rh5gQDC14_H0jYPZTp7jB56njw