kube-bench

kube-bench는 CIS Kubernetes Benchmark에 문서화된 검사를 실행하여 Kubernetes가 안전하게 배포되었는지 확인하는 도구입니다. 테스트는 YAML 파일로 구성되어 있어 테스트 사양이 발전함에 따라 이 도구를 쉽게 업데이트할 수 있습니다. Trivy 및 Trivy Operator의 일부로 CIS 스캐닝 Trivy는 올인원 클라우드 네이티브 보안 스캐너로, 클러스터 내에서 Kubernetes Operator로 배포할 수 있습니다. Trivy CLI와 Trivy Operator 모두 여러 다른 기능 중에...

scan-cve-2018-8115

root@kitploit: /\ / | | / \ | | | / /\ \ / | | | |/ | \ \ / / | | | | '| | | | | | / \ | | || | | | | / | || | | | | || || | // \, |,|,| |/ ||,|| |||, | | | / | || |/ Docker images verifier cli-tool CVE-2018-8115 コミュニティの安全を守るため、Aqua ではこの脆弱性に対してイメージが安全かどうかをテストするオープンソースツールを作成しました。 このユーティリティは...

cloudsploit

Aqua의 CloudSploit - 클라우드 보안 스캔 빠른 시작 일반 root@kitploit: $ git clone https://github.com/aquasecurity/cloudsploit.git $ cd cloudsploit $ npm install $ ./index.js -h Docker root@kitploit: $ git clone https://github.com/aquasecurity/cloudsploit.git $ cd cloudsploit $ docker build . -t cloudsploit:0.0....

teampcp-supply-chain-attack

TeamPCP サプライチェーン攻撃: 技術分析と検出ガイド CVE-2026-33634 CVSS 9.4 — 2026年でこれまでに最も影響力の大きいCI/CDサプライチェーン攻撃。 2026年3月19日から25日にかけて、脅威アクター TeamPCP 別名: DeadCatx3、PCPcat、ShellForce、CanisterWorm は、GitHub Actions、Docker Hub、OpenVSX、npm、PyPI の5つのエコシステムにまたがる連鎖的なサプライチェーン侵害を実行しました。ローテーションが不完全だった単一のGitHub...

vuln-list-aqua

vuln-list-aqua Aqua Security のセキュリティアドバイザリ...

trivy-operator

Kubernetes 네이티브 보안 툴킷. 문서...

tfsec

📣 tfsec에서 Trivy로 마이그레이션 모든 사람을 위한 포괄적인 오픈 소스 보안 솔루션을 제공하려는 목표의 일환으로, 우리는 모든 스캐닝 관련 노력을 Trivy로 통합하고 있습니다. 지난 1년 동안 tfsec은 Trivy의 IaC 및 잘못된 구성 스캐닝 기능의 기반을 마련했으며, Terraform 스캐닝은 이미 오랫동안 Trivy에서 기본적으로 지원되었습니다. 앞으로 우리는 tfsec 커뮤니티가 Trivy로 전환하기를 권장합니다. Trivy로 이동하면 동일한 우수한 Terraform 스캐닝 엔진을 사용하면서 다음과 같은 ...

aqua-checksums

aqua-checksums Aqua Security のオープンソースプロジェクト向け外部サプライチェーン整合性監視 このリポジトリの目的 このリポジトリは、Aqua Security が公開する成果物 — コンテナイメージ、GitHub リリース、Git タグ、リリースアセット — の整合性を継続的に監視し、時間の経過に伴う暗号ダイジェストの記録と検証を行います。署名付き成果物については、Sigstore の cosign 署名を Rekor 透明性ログに対して検証します。 スケジュールされた GitHub Actions...

trivy-plugin-aqua

trivy-plugin-aqua Aqua Security SaaS プラットフォームと統合するための Trivy プラグイン 使用方法 Trivy のオプションは -- の後に渡す必要があります。Trivy は IaC ファイルを含むターゲットディレクトリを受け取ります。 環境変数をエクスポートして、Aqua プラグインを Trivy の現在のデフォルトプラグインとして設定します。 root@kitploit: export TRIVYRUNASPLUGIN=aqua IaC ターゲットをスキャンする root@kitploit: trivy IaC...

CVE-2026-55569

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...

CVE-2026-55569

creationtimestamp| type| source ---|---|--- 2026-08-28 18:35:36+00:00| published-proof-of-concept| https://github.com/aquaproj/aqua/security/advisories/GHSA-mf5c-hw34-4hpp...

Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory

Summary aquaproj/aqua extracts downloaded tool archives through pkg/unarchive/archives.go using github.com/mholt/archives. The archive handler creates symlink entries with os.Symlinkf.LinkTarget, dstPath without validating that the symlink target resolves inside the extraction destination. A...

GHSA-MF5C-HW34-4HPP Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory

Summary aquaproj/aqua extracts downloaded tool archives through pkg/unarchive/archives.go using github.com/mholt/archives. The archive handler creates symlink entries with os.Symlinkf.LinkTarget, dstPath without validating that the symlink target resolves inside the extraction destination. A...

CVE-2026-55569 aqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directory

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...

EUVD-2026-67827

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...

CVE-2026-55569

aqua (aquaproj/aqua), a declarative command-line version manager written in Go, contains a symlink traversal flaw in pkg/unarchive/archives.go (HandleFile). The handler calls os.Symlink with an unvalidated LinkTarget and does not jail the target to the extraction destination. A subsequent regular...

CVE-2026-55569 aqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directory

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...

PT-2026-83253

Name of the Vulnerable Software and Affected Versions aqua versions prior to 2.60.1 Description In the handler.HandleFile function within pkg/unarchive/archives.go, the software fails to verify that the target of a symlink created via os.Symlink remains within the intended extraction destination....

CVE-2026-57789

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in jwsthemes Aqua aqua allows PHP Local File Inclusion.This issue affects Aqua: from n/a through = 5.1.2...

CVE-2026-57789 WordPress Aqua theme <= 5.1.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in jwsthemes Aqua aqua allows PHP Local File Inclusion.This issue affects Aqua: from n/a through = 5.1.2...