rakkess

rakkess Review Access - kubectl plugin to show an access matrix for server resources Intro Have you ever wondered what access rights you have on a provided kubernetes cluster? For single resources you can use kubectl auth can-i list deployments, but maybe you are looking for a complete overview?...

foxcage

foxcage Run Firefox in a rootless Podman container for security isolation. Your browser runs with almost no Linux capabilities, in its own user and network namespace, isolated from the host — while still having full GPU acceleration, audio, and DRM support. Why foxcage? Firefox already has a...

airgap

airgap Security for the modern AI age. No security layer is perfect. airgap is still experimental. Contributions welcome! Protected secrets airgap launches a target program e.g. an AI coding agent inside its own mount namespace and transparently replaces secrets with redacted versions. A program...

kubebox

= Kubebox small^⎈❏^ Antonin Stefanutti https://github.com/astefanutti@astefanutti // Meta :description: Terminal and Web console for Kubernetes // Settings :idprefix: :idseparator: - :experimental: // Aliases ifdef::env-github :note-caption: ℹ️ :icon-check: ✔️ :icon-edit: ✏️ endif::...

WinObjEx64

WinObjEx64 Windows Object Explorer 64-bit WinObjEx64 is an advanced utility that lets you explore the Windows Object Manager namespace. For certain object types, you can double-click on it or use the "Properties..." toolbar button to get more information, such as description, attributes, resource...

permission-manager

Permission manager Welcome to the Permission Manager! 🎉 🎉 Permission Manager is an application developed by SIGHUP that enables a super-easy and user-friendly RBAC management for Kubernetes. If you are looking for a simple and intuitive way of managing your users within a Kubernetes cluster, this...

CVE-2026-97045

A flaw was found in golang.org/x/net/html. This vulnerability allows a remote attacker to conduct Cross-Site Scripting XSS attacks by supplying specially crafted HTML markup. The renderer fails to properly verify namespace transitions for elements foster-parented across foreign namespaces,...

CVE-2026-119573

A flaw was found in Traefik. An authorization bypass vulnerability exists in the Kubernetes Ingress NGINX provider when cached client authentication Transport Layer Security TLS configurations are reused. An authenticated user with permissions to create Ingress resources can bypass cross-namespac...

CVE-2026-122312

A flaw was found in Kyverno. An authenticated user with permissions to create namespaced policies can bypass namespace isolation restrictions by supplying a specially crafted API call URL path containing query strings. Because the path validation mechanism improperly handles query characters,...

CVE-2026-100703

A flaw was found in Kyverno. This vulnerability allows an authenticated user with permissions to create namespaced policies to access unauthorized cross-namespace data, resulting in information disclosure. Kyverno fails to restrict its global context policy evaluation library to the creator's...

CVE-2026-113729

A flaw was found in signedxml. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service DoS by sending a specially crafted XML document containing deeply nested elements with numerous namespace declarations. During canonicalization, the library excessively copies...

CVE-2026-112778

A flaw was found in Traefik. An authenticated attacker with permissions to create or update Kubernetes Ingress or Service resources can bypass multi-tenant isolation boundaries due to missing namespace validation in resource annotations. By referencing configuration objects in other namespaces, t...

CVE-2026-122316

Kyverno from 1.17.0 before 1.19.2 contains a missing authorization vulnerability in the mutate-existing background processor that allows namespaced tenants to modify resources outside their namespace. Attackers can create a NamespacedMutatingPolicy targeting Namespace objects or victim-namespace...

CVE-2026-122312

Kyverno from 1.19.1 before 1.19.2 contains a namespace isolation bypass in APICall Fetch in pkg/engine/apicall/apiCall.go because path.Clean treats '?' as a path character, letting the namespace regex match segments inside the query string. Users who can create namespaced policies can supply a...

CVE-2026-122302

Kyverno before 1.19.2 contains a privilege escalation vulnerability that allows namespace admins to create resources beyond their RBAC because generate-rule admission checks verify the controller's permissions, not the author's. Attackers can create a namespaced Policy with generate rules targeti...

CVE-2026-122304

Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace admins to escape namespace confinement because the cleanup controller builds its context loader with a nil policy. Attackers can create a namespaced CleanupPolicy with apiCall or globalReference...

CVE-2026-122320

Kyverno versions before 1.19.2 are vulnerable to a missing authorization vulnerability (CWE-862) allowing namespaced Policy authors to perform cross-namespace resource reads. By templating generate.clone or cloneList namespace values, an attacker can annotate a triggering ConfigMap. This causes t...

EUVD-2026-117227

Kyverno from 1.17.0 before 1.19.2 contains a missing authorization vulnerability in the mutate-existing background processor that allows namespaced tenants to modify resources outside their namespace. Attackers can create a NamespacedMutatingPolicy targeting Namespace objects or victim-namespace...

CVE-2026-122316

Kyverno versions 1.17.0 before 1.19.2 are affected by a missing authorization vulnerability in the mutate-existing background processor. This flaw allows namespaced tenants to modify resources outside their own namespace. By creating a NamespacedMutatingPolicy that targets Namespace objects or re...

EUVD-2026-117224

Kyverno from 1.17.0 before 1.19.2 contains a privilege escalation vulnerability that allows namespace-scoped tenants to modify resources in other namespaces through NamespacedMutatingPolicy targetMatchConstraints.expression CEL output lacking namespace checks. Attackers can emit a literal target...