kube-bench

kube-bench is a tool that checks whether Kubernetes is deployed securely by running the checks documented in the CIS Kubernetes Benchmark. Tests are configured with YAML files, making this tool easy to update as test specifications evolve. CIS Scanning as part of Trivy and the Trivy Operator Triv...

tfsec

📣 tfsec to Trivy Migration As part of our goal to provide a comprehensive open source security solution for all, we have been consolidating all of our scanning-related efforts in one place, and that is Trivy. Over the past year, tfsec has laid the foundations to Trivy's IaC & misconfigurations...

scan-cve-2018-8115

/\ / | | / \ | | | / /\ \ / | | | |/ | \ \ / / | | | | '| | | | | | / \ | | || | | | | / | || | | | | || || | // \, |,|,| |/ ||,|| |||, | | | / | || |/ Docker images verifier cli-tool CVE-2018-8115 To help the community stay safe, we at Aqua created an open source tool that tests images...

vuln-list-aqua

vuln-list-aqua Security advisories from Aqua Security...

teampcp-supply-chain-attack

TeamPCP Supply Chain Attack: Technical Analysis & Detection Guide CVE-2026-33634 CVSS 9.4 — The most impactful CI/CD supply chain attack of 2026 so far. Between March 19–25, 2026, threat actor TeamPCP also tracked as DeadCatx3, PCPcat, ShellForce, CanisterWorm executed a cascading supply chain...

trivy-plugin-aqua

trivy-plugin-aqua Trivy plugin for integration with Aqua Security SaaS platform Usage Trivy's options need to be passed after --. Trivy receives a target directory containing IaC files Set Aqua plugin as Trivy's current default plugin by exporting an environment variable export...

aqua-core (1.0.0a4), ironoc-pytest-conor-heffron (2.3.3) +2 more potentially affected by CVE-2026-112909 via filelock (3.24.3)

filelock PYPI version 3.24.3 is affected by a known vulnerability. The following packages have a transitive dependency on filelock and may be impacted: - aqua-core 1.0.0a4 - ironoc-pytest-conor-heffron 2.3.3 - opentargets-otter =26.0.1, =1.7.1, =1.8.0 Source cves: CVE-2026-112909 Source advisory:...

cloudsploit

CloudSploit de Aqua - Escaneos de Seguridad en la Nube Inicio Rápido Genérico $ git clone https://github.com/aquasecurity/cloudsploit.git $ cd cloudsploit $ npm install $ ./index.js -h Docker $ git clone https://github.com/aquasecurity/cloudsploit.git $ cd cloudsploit $ docker build . -t...

trivy-operator

Kit de herramientas de seguridad nativo de Kubernetes. Documentación Introducción Trivy Operator aprovecha Trivy para escanear continuamente tu clúster de Kubernetes en busca de problemas de seguridad. Los escaneos se resumen en informes de seguridad como Custom Resource Definitions de Kubernetes...

tfsec

📣 Migración de tfsec a Trivy Como parte de nuestro objetivo de ofrecer una solución integral de seguridad de código abierto para todos, hemos estado consolidando todos nuestros esfuerzos relacionados con el escaneo en un solo lugar, y ese lugar es Trivy. Durante el último año, tfsec ha sentado la...

Malicious code in level-aqua-turtle (npm)

Source: amazon-inspector 7d1080c08842338178824d12a0dd1267a9d38ac725da62ac95a1df8145161273 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in intensive-aqua-skink (npm)

Source: amazon-inspector e3aa9acaa84379b4e13cf0f109d1647599e1ee3152114f9734b47c2e4f8544e4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in innovative-aqua-scallop (npm)

Source: amazon-inspector 603c8b30f9d7c9fe3557c450993531e0b0f0d062a4508b6e0566ea28a0638f73 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in indirect-aqua-planarian (npm)

Source: amazon-inspector 1d98bfd6fa87fa82c8fd3ecd24f28c9c5d0b9d495129e869cfdfd7b5a4063ced This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in incredible-aqua-wolf (npm)

Source: amazon-inspector 6142d3614849c3a63242c3a617cdb0caed927cc02a8e77de1763ecf08f0fb843 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in increased-aqua-baboon (npm)

Source: amazon-inspector 89ee3f82cddf02aeaf13019be5459ef23d4889ed3dee519db37e2de558ee7375 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in inclined-aqua-vole (npm)

Source: amazon-inspector 0cad7fa729c46e21373efb287989fae102c4a3ad497fc43802855e7ed4f3d8cc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in illegal-aqua-hornet (npm)

Source: amazon-inspector 3534daa94a4b1203ad6d04b0294f8b740118916284738349be997309ea72a3cb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in holy-aqua-antelope (npm)

Source: amazon-inspector 24ae4df8a9f707910bba3600a9c4c168073fe696781efd8629e71a5a19e63c38 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in historical-aqua-warbler (npm)

Source: amazon-inspector 37c12aa59ed503981f956a6706c77f472f9fe28374e7bf39a7234a4ba5c745d3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...