polaris

Polaris هو محرك سياسات مفتوح المصدر لـ Kubernetes Polaris هو محرك سياسات مفتوح المصدر لـ Kubernetes يتحقق من تكوين الموارد ويصححه. يتضمن أكثر من 30 سياسة تكوين مدمجة، بالإضافة إلى القدرة على بناء سياسات مخصصة باستخدام JSON Schema. عند تشغيله من سطر الأوامر أو كخطاف ويب متغير، يمكن لـ Polaris تصحي...

trivy-enforcer

trivy-enforcer SPERIMENTALE Operatore Kubernetes per l'Image Assurance Funziona come Admission Controller impedendo la distribuzione di immagini non sicure Custom Controller osservando il CRD ImageVulnerability e scansionando automaticamente l'immagine nella risorsa personalizzata Configurazione...

CVE-2025-1974

cve-2025-1974-win11-attack-defense-lab Repository didattico pensato principalmente per Windows 11 per lo studio di CVE-2025-1974 in un laboratorio ATTACK + DEFENSE sicuro e non weaponizzato. Il progetto è progettato per corsi universitari, demo di gruppo e screenshot pronti per i report. Enfatizz...

CVE-2025-1974

CVE-2025-1974 3ª generazione della WhiteHat School - Kim So-eun @salt318 https://github.com/salt318/vulhub Riepilogo Causato da un difetto del controller di ammissione Ingress-NGINX, un meccanismo di sicurezza fondamentale di Kubernetes Il controller di ammissione Ingress-NGINX è esposto alla ret...

IngressNightmare-RCE-POC

⚠️ RCE critico in Ingress-NGINX tramite Injection di Configurazione CVE-2025-1974 e altro Questo repository contiene un proof-of-concept PoC per CVE-2025-1974 , una vulnerabilità critica CVSS 9.8 nel controller Ingress-NGINX per Kubernetes. Questa falla consente l'esecuzione di codice remoto non...

CVE-2025-1974

🚨 Test di Iniezione di Log tramite Admission Controller di Ingress-NGINX 🧠 Panoramica Questo script testa le vulnerabilità di iniezione di annotazioni nei cluster Kubernetes utilizzando il NGINX Ingress Controller. È destinato solo a scopi di rilevamento in relazione a CVE-2025-1974, che consente...

IngressNightmare-PoC

Exploit for Ingress NGINX - IngressNightmare Questo progetto fornisce un exploit che mira a vulnerabilità critiche di Remote Code Execution RCE non autenticata nel controller Ingress NGINX per Kubernetes, note collettivamente come IngressNightmare. Ricerca di Wiz Nella ricerca originale, il team ...

CVE-2025-1974

Kubernetes Ingress-NGINX esecuzione remota di codice non autenticata CVE-2025-1974 Ingress-NGINX: controller Ingress per Kubernetes che utilizza NGINX come proxy inverso e bilanciatore di carico La vulnerabilità "IngressNightmare" CVE-2025-1974 deriva da un difetto critico nell'Ingress-NGINX...

CVE-2026-5556-Kubernetes-Admission-Controller-Bypass-via-Case-Sensitivity

CVE-2026-5556 – Bypass del controller di ammissione Kubernetes tramite la distinzione tra maiuscole e minuscole Codice del programma webhook di ammissione Python + exploit root@kitploit: !/usr/bin/env python3 admissionwebhook.py - Vulnerable webhook that rejects pods with specific name from flask...

CVE-2025-1974

DEMO https://youtu.be/3hYlHeaf2mQ Was ist CVE-2025-1974? CVE-2025-1974 IngressNightmare ist eine kritische CVSS 9.8 ohne Authentifizierung ausnutzbare Remote-Code-Ausführungs-Schwachstelle im Kubernetes ingress-nginx Admission Controller. Angriffsablauf: 1. Upload : Senden einer schädlichen Share...

GO-2026-5268 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws...

CVE-2026-10609

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

CVE-2026-41323

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4, Kyverno's apiCall feature in ClusterPolicy automatically attaches the admission controller's ServiceAccount token to outgoing HTTP requests. The service URL has n...

Authorization Bypass

Kyverno is vulnerable to Authorization Bypass. The vulnerability is due to a critical authorization boundary bypass in namespaced Kyverno Policy apiCall, where the resolved urlPath is executed using the Kyverno admission controller ServiceAccount, with no enforcement that the request is limited t...

BIT-KYVERNO-2026-41485 Kyverno Controller Denial of Service via forEach Mutation Panic

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.17.2 and 1.16.4, an unchecked type assertion in the forEach mutation handler allows any user with permission to create a Policy or ClusterPolicy to crash the cluster-wide background controller int...

GHSA-FPJQ-C37H-CQCV Kyverno Controller Denial of Service via forEach Mutation Panic

Summary An unchecked type assertion in the forEach mutation handler allows any user with permission to create a Policy or ClusterPolicy to crash the cluster-wide background controller into a persistent CrashLoopBackOff. The same bug also causes the admission controller to drop connections and blo...

CVE-2026-41485

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.17.2 and 1.16.4, an unchecked type assertion in the forEach mutation handler allows any user with permission to create a Policy or ClusterPolicy to crash the cluster-wide background controller int...

EUVD-2026-25392

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.17.2 and 1.16.4, an unchecked type assertion in the forEach mutation handler allows any user with permission to create a Policy or ClusterPolicy to crash the cluster-wide background controller int...

CVE-2026-41485

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.17.2 and 1.16.4, an unchecked type assertion in the forEach mutation handler allows any user with permission to create a Policy or ClusterPolicy to crash the cluster-wide background controller int...

CVE-2026-41485 Kyverno Controller Denial of Service via forEach Mutation Panic

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.17.2 and 1.16.4, an unchecked type assertion in the forEach mutation handler allows any user with permission to create a Policy or ClusterPolicy to crash the cluster-wide background controller int...