Software Vulnerability Detection

Ask about this topic

Overview

The field studies how to find vulnerable code and locate the causes of weaknesses across functions, repositories, smart contracts, binaries, and software dependencies. Approaches range from static analysis and fuzzing to transformers, graph neural networks, and LLM agents that combine code structure, security knowledge, and execution-based checks. Benchmarks increasingly test realistic project and temporal splits, localization, exploit validation, and repair, because performance on curated datasets may not transfer to production code. A central challenge is balancing recall with false positives while ensuring that reported findings are grounded in executable evidence and generalize across projects, languages, and vulnerability types.

Latest papers

CardsList

143 papers17 papers in the last four weeks, up 31% on the four weeks before. 0.1% of all new papers.

  1. Beyond QASecClaw: Agent Scaling, Verifier Feedback, and Evidence Reliability in Software Assurance

    Oct 27, 2026S M Abdulla Al Mamun, Akif Islam, Mohd. Ruhul AmeenLLM Agent VerificationLLM Reliability

    Department of Computer Science, The University of Manchester, United Kingdom · Department of Computer Science and Engineering, University of Rajshahi, Bangladesh · Department of Computer Science and Engineering, Varendra University, Bangladesh

  2. Reva: Real-Time Vulnerability Detection through Contextual Probing of Large Language Models

    Oct 26, 2026Amine Lbath, Massih-Reza AminiSoftware Vulnerability DetectionLanguage Model Probing

    Université Grenoble Alpes, CNRS, France

  3. CyberDual: AI Attackers versus AI Code Reviewers in Real Software Maintenance

    Oct 25, 2026Chenyuan Yang, Hwiwon Lee, Jongseong Kim +4AI Agent Security BenchmarksAutomated Code Review

  4. VulDec: Vulnerability Detection in Binaries via Neural Decompilation

    Oct 24, 2026Francesco Crescenzo Grasso, Pietro Liguori, Roberto Natella +1Software Vulnerability DetectionSoftware Reverse Engineering

    DIETI, Universit`a degli Studi di Napoli Federico II, Via Claudio 21, Naples, 80125, Campania, Italy. · Computer Science, Gran Sasso Science Institute, Viale Francesco Crispi 7, L’Aquila, 67100, Abruzzo, Italy. · Department of Computer Science, University of North Carolina at Charlotte, 9201 University City Blvd, Charlotte, 28223, North Carolina, USA.

  5. Can Agentic Code Review Catch Vulnerabilities Before They Are Merged?

    Oct 24, 2026Yihan Yang, Chenyuan Yang, Zijie Zhao +5AI Agent Security BenchmarksAutomated Code Review

    University of Illinois Urbana-Champaign · Quantum AI & Cyber Security Institute, FPT Corporation; work done during an internship at UIUC.

  6. Trusting the Tool: Asymmetric Deference of LLM Vulnerability Auditors to Static-Analysis Evidence

    Oct 23, 2026ZhiHong Liu, Shuyao GaoLLM AuditingCognitive Bias in Language Models

    Seoul School of Integrated Sciences and Technologies (aSSIST University), Seoul, Republic of Korea · Liaoning Mechanical & Electrical College of Technology, Dandong, Liaoning, China

  7. Self-Evolving Static Analysis via LLM Pseudo-Labeling

    Oct 20, 2026Rui Melo, Andre Duarte, Aditya Oke +5Static Code AnalysisSoftware Vulnerability Detection

    Carnegie Mellon University · FEUP

  8. When Models Know but Can't Linearly Say: Relational Encoding Limits Linear Vulnerability Classification in Code LLMs

    Oct 19, 2026Rui Melo, Andre Catarino, Claudia Mamede +2LLMs for CybersecuritySoftware Vulnerability Detection

    Carnegie Mellon University, Pittsburgh, PA, USA · Faculty of Engineering, University of Porto, Portugal

  9. SPLASH: Contrastive Audit Pressure for Detecting and Localizing Security Hallucinations in Generated Code

    Oct 19, 2026Mirza Masfiqur Rahman, MD Ajwad Akil, Imtiaz Karim +3LLM SecuritySoftware Vulnerability Detection

    Purdue University, USA · University of Texas at Dallas, USA · Cisco Research, USA

  10. Peer Pressure: Execution-Verified Co-Evolution of Attacker and Defender Populations for Code Security

    Oct 17, 2026Khushbu Pahwa, Yubin Ge, Daniele Bonadiman +2AI Agent SecurityAdversarial Training

    AWS AI

  11. CWE-bench: Refocusing Agentic Security from Exploitation to Defense

    Oct 12, 2026Gonzalo Gonzalez-Pumariega, Ajay Jagannath, Adit Jain +3AI Agent SecurityAI Agent Security Benchmarks

  12. Natural Code Transformation Confuses Agents in Vulnerability Analysis

    Oct 9, 2026Jie Zhu, Ronik Bhaskar, Heather Zheng +2AI Agent SecurityAdversarial Robustness

    University of Chicago

  13. Diagnosing Generalization Boundaries in AI-Based Vulnerability Detection via Calibrated Embedding Distances

    Oct 9, 2026Konstantin Ievtushenko, Ralf Lämmel, Jan JürjensSoftware Vulnerability DetectionDistribution Shift

    University of Koblenz, Germany · Fraunhofer ISST, Germany

  14. Learning from Failures: A Failure-Driven Prompt Refinement for LLM-Based Vulnerability Analysis

    Oct 6, 2026Mandana Ghadamian, David MohaisenLLMs for CybersecuritySoftware Vulnerability Detection

    University of Central Florida, Orlando, FL 32816, USA

  15. Correct Verdicts, Flawed Reasoning: Structured Auditing of LLM-based Vulnerability Reasoning

    Oct 5, 2026Boyue Caroline Hu, Kaivalya Ahir, Ronghao Ni +1LLM AuditingSoftware Vulnerability Detection

    Carnegie Mellon University, Pittsburgh, Pennsilvanya, USA

  16. VulValidate: Auditing Function-Level Vulnerability Labels with Executable Evidence

    Oct 4, 2026Leizhen Zhang, Sheng ChenSoftware Vulnerability Detection

    University of Louisiana at Lafayette, USA

  17. Retrieve, Reproduce, Reveal: Dissecting Retrieval-Augmented Software Vulnerability Detection

    Sep 29, 2026Sabrina Kaniewski, Tim Krämer, Julius Bächle +3Software Vulnerability DetectionSoftware Engineering Benchmarks

    Institute for Secure Networked Systems, Esslingen University, Germany · Esslingen University, Germany · Institute for Intelligent Systems, Esslingen University, Germany +1

  18. JevVibe: Efficient Classification-Guided Secure Code Generation

    Sep 28, 2026Arshak Rezvani, Sasha Behrouzi, Ahmad-Reza SadeghiAutomated Program RepairSoftware Vulnerability Detection

    Technical University of Darmstadt, Germany

  19. Cheap to Hypothesize, Costly to Verify: The Defense Surface of Agentic Vulnerability Discovery

    Sep 28, 2026Kaikai Zhang, Zihan Zhang, Yuchong Xie +4Software Vulnerability DetectionCybersecurity

    The Hong Kong University of Science and Technology

  20. SecProbe: Adaptive Evaluation of Coding Agents on Cybersecurity Vulnerabilities

    Sep 27, 2026Xiaonan Luo, Yue Huang, Kehan Guo +9Software Vulnerability DetectionAI Agent Evaluation

    University of Notre Dame · Bake AI · Vanderbilt University +5

  21. A Function-Level Vulnerability Score Measures Flag Rate More Than the Model: Protocol Effects on Paired Benchmarks

    Sep 26, 2026Maciej Cichoń, Bartłomiej DmitrukLLM EvaluationLLMs for Cybersecurity

    Striga, University of Lodz · Striga

  22. AgentXploit: Autonomous Repository-to-Runtime Red-Teaming for AI Agents

    Sep 25, 2026Weida Liang, Shi Qiu, Zhun Wang +6AI Agent AuditingAutomated Red Teaming

    National University of Singapore · University of North Carolina at Chapel Hill · University of California, Berkeley +2

  23. TraceVIC: Causal Reasoning over Code Evolution for Identifying Vulnerability-Inducing Commits

    Sep 22, 2026Fnu Tanish, Samiha Shimmi, Samikshya Chapagain +3Software Vulnerability DetectionRoot Cause Analysis

    Northern Illinois University · MIT Lincoln Laboratory

  24. MobileCybench: Evaluating Agent Vulnerability Discovery via Executable Probes

    Sep 21, 2026Andy K. Zhang, Ava Huang, Joey Ji +21Software Vulnerability DetectionAI Agent Security Benchmarks

    Stanford University · UC Berkeley

  25. SyzHarness: Patch-Based Kernel Bug Reproduction with LLM-Synthesized Fuzzing Harnesses

    Sep 20, 2026Xingyu Li, Juefei Pu, Haonan Li +4Software Vulnerability DetectionLLM-Based Program Synthesis

    University of California, Riverside

  26. Vulnerability Localization Benchmark: Measuring Agentic Security Analysis at Repository Scale

    Sep 14, 2026Aman Priyanshu, Supriti Vijay, Kimia Majd +8Software Vulnerability DetectionAI Agent Security

    1Foundation AI–Cisco Systems Inc. · 3Carnegie Mellon University · †Work done while at Foundation AI +1

  27. Exploring Automated Vulnerability Identification in JavaScript Code Using Large Language Models

    Sep 12, 2026Manit Kaushik, Ishir Bhardwaj, Pranav Gupta +2Software Vulnerability DetectionLLMs for Cybersecurity

    Indraprastha Institute of Information Technology Delhi New Delhi, India

  28. No-Box Vulnerability Analysis: Description-only Detection of Indirect Prompt Injection Vulnerabilities in MCP Servers

    Sep 9, 2026Zehua Zhang, Jie Hu, Pratham Hegde +13MCP SecuritySoftware Vulnerability Detection

    School of Computing and Augmented Intelligence, Arizona State University

  29. Beyond Static Guarantees: Measuring the Static-Pass Dynamic-Fail Gap in Security-Sensitive and LLM-Generated Python Code

    Sep 9, 2026Jessica Pourleyli, Maitreyee Das Urmi, Glaucia MeloSoftware Vulnerability DetectionSoftware Security

    Toronto Metropolitan University Toronto, Canada

  30. SWE-Test: Benchmarking LLM Vulnerability Discovery via Input Prediction

    Sep 5, 2026Yuanxiang Shi, Jiayi Lin, Xuanyong Lin +8Software Vulnerability DetectionAI Agent Security Benchmarks