starboard

Starboard is joining Trivy. We've announced our plans to discontinue Starboard and merge it into Trivy. Starboard CLI has been reintroduced as trivy kubernetes command and starboard-operator with a focus on trivy capabilities is available as Trivy-Operator. We will not be accepting new...

BackupOperatorToolkit

BackupOperatorToolkit Usage The BackupOperatorToolkit BOT has 4 different mode that allows you to escalate from Backup Operator to Domain Admin. Use "runas.exe /netonly /user:domain.dk\backupoperator powershell.exe" before running the tool. Service Mode The SERVICE mode creates a service on the...

nebula

Nebula Cybersecurity harness built around the operator Acknowledgement First, I would like to thank Almighty God, who is the source of all knowledge. Without Him, this would not be possible. Use Nebula only on systems and networks you own or are explicitly authorized to test. Key features One...

CVE-2026-40564

CVE-2026-40564: SSRF via FlinkSessionJob.spec.job.jarURI in flink-kubernetes-operator The Apache Flink Kubernetes Operator does not check the spec.job.jarURI field on FlinkSessionJob or FlinkDeployment resources. Anyone who can create one of those resources can set jarURI to any URL. When the...

renovate-operator

Renovate: The Kubernetes-Native Way Run Renovate on your own infrastructure with CRD-based scheduling, parallel execution, auto-discovery, and a built-in UI. If you self-host Renovate and already run Kubernetes, this operator gives you the control and observability that plain self-hosted setups...

backup_dc_registry

Backup Operator Registry Backup to Domain Compromise A simple POC that abuses Backup Operator privileges to remote dump SAM, SYSTEM, and SECURITY hives. Research credit to: @filipdragovic Ported from @mpgn Windows PoC Usage This proof of concept is a modified version of impacket/examples/reg.py a...

EUVD-2026-109422

Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuery. Its subscription hash omits constraints next to a $or operator, including the Session owner filter and beforeSubscribe constraints, so distinct subscriptions are grouped...

osiris

⬡ OSIRIS Open Source Intelligence & Reconnaissance Integrated System A real-time global intelligence dashboard that aggregates live flight tracking, CCTV networks, earthquake monitoring, conflict zone mapping, and 24/7 news feeds into a single GPU-accelerated interface. Live Demo · Report Bug ·...

GeckoDroid

GeckoDroid Mobile client for Adaptix C2 Framework. Full operator access from your Android device. What it does GeckoDroid gives you control over your Adaptix C2 server from anywhere. Instead of sitting at your desktop client, you can manage operations on the go. Agents - See all connected agents...

GHSA-J6QF-3M9C-VWJ3 vulnerabilities

Vulnerabilities for packages: tkn-fips, redpanda-console, gitness, cloudflared-fips, gotrue-fips, kyverno-policy-reporter-ui-fips, crossplane, neuvector-sigstore-interface-fips, cloudflared, drone, teleport, chainloop-cli, crossplane-cli, mariadb-operator, ratify-fips, step-issuer-fips, zitadel,...

CVE-2026-114437 vulnerabilities

Vulnerabilities for packages: tkn-fips, redpanda-console, gitness, cloudflared-fips, gotrue-fips, kyverno-policy-reporter-ui-fips, crossplane, neuvector-sigstore-interface-fips, cloudflared, drone, teleport, chainloop-cli, crossplane-cli, mariadb-operator, ratify-fips, step-issuer-fips, zitadel,...

wikipedia-c2

Wikipedia-C2 Wikipedia C2 Blog Post This is a demo project to demonstrate Command and Control utilizing Wikipedia. After Josh Abraham's demo of C2 utilizing Slack and ICMP, I thought I'd explore what other options in the internet's top sites could be used for C2. After reviewing Wikipedia's API, ...

trivy-enforcer

trivy-enforcer EXPERIMENTAL Kubernetes Operator for Image Assurance It works as Admission Controller protecting unsafe images from being deployed Custom Controller watching ImageVulnerability CRD and scanning the image in the custom resource automatically Setup $ kubectl apply -f manifests/opa.ya...

freebsd-CVE-2026-7270

Ref https://github.com/califio/publications/tree/main/MADBugs/freebsd-CVE-2026-7270 CVE-2026-7270 FreeBSD local privilege escalation viaexecargsadjustargs OOB memmove An operator-precedence bug in execargsadjustargs sys/kern/kernexec.c, present since 2013 lets any local user escalate to root on a...

gitea-restore-file-open

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · gitea-restore-file-open gitea-restore-file-open Gitea 1.27.3 - Gitea CVE-2026-59765 put a hostmatcher HTTP client on OpenWithClient. The file:// branch ignores that client and calls os.Open. Restore of a dump has no...

cdn-ip-scanner

CDN IP Scanner V3.0 High Accuracy • Ultra Fast • Real-Time 🌐 Language: English | فارسی Install • Features • Usage • What's new • Developers • Donate 📚 Table of Contents 1. Overview 2. Features 3. Installation npm app Windows / macOS / Linux — step by step Android app Linux server Release files &...

CloudGarrison

CloudGarrison Multi-Cloud Posture Workbench CloudGarrison is an offline-capable operator console designed for local evidence analysis, multi-cloud posture planning, and isolated simulations across AWS, Azure/Entra ID, GCP, Kubernetes, identity graphs, and detection engineering platforms. This loc...

fusionpbx_rce_vulnerability

Prelude This simple code tries to complete the implementation of the chained vulnerability introduced by Dustin Cobb at RCE Using Caller ID – Multiple Vulnerabilities In FusionPBX. RCE Reproduction Steps 1. View the vulnerable operator screen in a web browser, located in this example at...

chaos-operator

Litmus chaos-operator for injecting chaos experiments on Kubernetes Codacy Badge Litmus chaos operator is used by Kubernetes application developers and SREs to inject chaos into the applications and Kubernetes infrastructure in a managed fashion. Its objective is to make the process of validation...

ai-kubernetes-helm-chart-security

AI on Kubernetes: Helm chart security defaults evidence This repository holds the data and evidence behind the Sorami technical report "AI on Kubernetes: 10 of 14 Helm charts ship with no API auth" version 1.2. Read the report here: https://sorami.com.au/research/ai-kubernetes-helm-chart-security...