nimbostratus

Nimbostratus Herramientas para el fingerprinting y la explotación de infraestructuras cloud de Amazon. Estas herramientas son una PoC que desarrollé para mi charla "Pivoting in Amazon clouds", desarrollada utilizando la excelente biblioteca boto para acceder a la API de Amazon. Para más informaci...

MAL-2026-11543 Malicious code in simple-date-formatter-new-5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 204253c08cc90b592f9c086ada633879141aee2bdf27e7286007c709f3b866ab Package advertised as a date-formatting utility performs supply-chain attack behavior. package.json declares a postinstall shell one-liner that, on n...

Agentic Cloud Decoys: A Deception-Driven Framework for Autonomous Intrusion Investigation

Cloud telemetry arrives at a scale that, paradoxically, makes intrusion understanding harder rather than easier. Attackers operate through legitimate identity, federated session tokens, and cloud native APIs indistinguishable from routine administration, and analysts spend an incident...

Shark vacuum flaw exposes cameras, home maps and Wi-Fi passwords

Shark’s cloud-connected robot vacuums are currently exposed by an unpatched AWS Amazon Web Services IoT Internet of Things policy flaw that could turn one compromised device into a remote-control skeleton key for many others in the same region, with access to cameras, maps, and Wi‑Fi passwords. A...

CVE-2026-53216 vulnerabilities

Vulnerabilities for packages: linux-aws, linux-vmware, linux-gcp, linux-azure, linux-qemu, linux-qemu-melange...

GHSA-GVRM-XH5G-W8V6 vulnerabilities

Vulnerabilities for packages: linux-aws, linux-vmware, linux-gcp, linux-azure, linux-qemu, linux-qemu-melange...

GHSA-WFX4-V2WF-4GMP vulnerabilities

Vulnerabilities for packages: linux-aws, linux-vmware, linux-gcp, linux-azure, linux-qemu, linux-qemu-melange...

CVE-2026-53203 vulnerabilities

Vulnerabilities for packages: linux-aws, linux-vmware, linux-gcp, linux-azure, linux-qemu, linux-qemu-melange...

GHSA-MRV3-46FP-R6HH vulnerabilities

Vulnerabilities for packages: linux-aws, linux-vmware, linux-gcp, linux-azure, linux-qemu, linux-qemu-melange...

fluent-plugin-s3 Vulnerable to Denial of Service (DoS) via Decompression Bomb in `in_s3`

"The fluent-plugin-s3 plugin specifically the ins3 input plugin supports reading and decompressing heavily compressed files such as gzip, lzma2, and lzop from Amazon S3. It was discovered that the plugin read the entire decompressed payload into memory at once without enforcing a strict size limi...

GHSA-4GX5-8RX4-VXMJ vulnerabilities

Vulnerabilities for packages: linux-aws, linux-vmware, linux-gcp, linux-azure, linux-qemu...

CVE-2026-31600 vulnerabilities

Vulnerabilities for packages: linux-aws, linux-vmware, linux-gcp, linux-azure, linux-qemu...

UBUNTU-CVE-2026-33551

An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application credential to call the EC2 credential creation API, an authenticated user with only a reader role...

GHSA-WGXF-R68R-7W9H vulnerabilities

Vulnerabilities for packages: linux-aws, linux-vmware, linux-gcp, linux-azure, linux-qemu...

CVE-2025-38205 vulnerabilities

Vulnerabilities for packages: linux-aws, linux-vmware, linux-gcp, linux-azure, linux-qemu...

CVE-2026-23210 vulnerabilities

Vulnerabilities for packages: linux-aws, linux-vmware, linux-gcp, linux-azure, linux-qemu...

CVE-2026-23226 vulnerabilities

Vulnerabilities for packages: linux-aws, linux-vmware, linux-gcp, linux-azure, linux-qemu...

GHSA-G4VW-3HQ5-Q7GR vulnerabilities

Vulnerabilities for packages: linux-aws, linux-vmware, linux-gcp, linux-azure, linux-qemu...

EUVD-2026-18019

Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints...

CVE-2026-34750

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3, the client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize...