algo

Algo VPN Algo VPN is a set of Ansible scripts that simplify the setup of a personal WireGuard and IPsec VPN. It uses the most secure defaults available and works with common cloud providers. See our release announcement for more information. Features Supports only IKEv2 with strong crypto AES-GCM...

cloudlist

Features • Installation • Usage • Configuration • Running cloudlist • Supported providers • Library • Join Discord Cloudlist is a multi-cloud tool for getting Assets from Cloud Providers. This is intended to be used by the blue team to augment Attack Surface Management efforts by maintaining a...

edge

حافة السحابة - Whois للسحابة ابحث عن عنوان IP لمعرفة مزود الخدمة السحابية وتفاصيل أخرى بناءً على بيانات JSON أو CSV أو نصية منشورة من المزود Cloud edge هي أداة استطلاع تركز على استكشاف مزودي الخدمات السحابية. يمكن استخدامها للإسناد السحابي والطب الشرعي، واختبار الاختراق، وصيد الثغرات، والفرق...

powerfulseal

PowerfulSeal PowerfulSeal вносит сбои в ваши кластеры Kubernetes, чтобы вы могли обнаруживать проблемы как можно раньше. Он позволяет описывать сценарии целых хаос-экспериментов. Примите неизбежные сбои. Примите Тюленя. Документация Пожалуйста, обратитесь к документации Powerfulseal, чтобы узнать...

burp-vps-proxy

Burp VPS Proxy: Простые облачные прокси для Burp Suite Начало работы » Возможности · Провайдеры · Отказ от ответственности 📖 О проекте Burp VPS Proxy — это расширение для Burp Suite, которое позволяет автоматически создавать и удалять вышестоящие SOCKS5-прокси в популярных облачных провайдерах...

GHSA-J2G6-362Q-6QC6 vulnerabilities

Vulnerabilities for packages: velero-plugin-for-gcp, velero-plugin-for-microsoft-azure-fips, velero-plugin-for-aws-fips, velero-plugin-for-aws, velero-plugin-for-gcp-fips, velero-plugin-for-microsoft-azure...

cloud_ip_ranges

Диапазоны IP облачных провайдеров Описание Большинство облачных провайдеров публикуют актуальные списки своих диапазонов IP-адресов. Этот инструмент определяет, принадлежит ли IP-адрес диапазонам провайдера, загружая и обрабатывая последние списки. Поддержка: AWS источник Azure источник Google...

CVE-2026-53227 vulnerabilities

Vulnerabilities for packages: linux-qemu-melange, linux-aws, linux-qemu, linux-vmware, linux-gcp, linux-azure...

Multiple Node.js Modules compromised in npm supply chain attack (Shai-Hulud 'Miasma') (06/01/2026)

The remote host has a version of one or more Node.js modules installed known to be compromised in the Shai-Hulud 'Miasma' npm supply chain attack reported on 06/01/2026. This wave compromised 32 packages 96 versions published under the '@redhat-cloud-services' npm scope. It is tracked separately...

Improper Access Control

Rancher is vulnerable to Improper Access Control. The vulnerability is due to missing authorization checks when handling cloud-credential IDs, which allows an attacker to make unauthorized requests to cloud providers using attached credentials...

CVE-2026-34719

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the webhook model was missing a proper validation for loop back addresses, or link-local addresses — only the URL scheme HTTP/HTTPS as well as the hostname was checked. This could end up in retrieving...

Hackers Exploit CVE-2025-55182 to Breach 766 Next.js Hosts, Steal Credentials

A large-scale credential harvesting operation has been observed exploiting the React2Shell vulnerability as an initial infection vector to steal database credentials, SSH private keys, Amazon Web Services AWS secrets, shell command history, Stripe API keys, and GitHub tokens at scale. Cisco Talos...

Keys on Doormats: Exposed API Credentials on the Web

Application programming interfaces APIs have become a central part of the modern IT environment, allowing developers to enrich the functionality of applications and interact with third parties such as cloud and payment providers. This interaction often occurs through authentication mechanisms tha...

Agent Grant: From Identity Signals to Measurable Risk Reduction

Executive Summary Identity is now the 1 attack surface. Agent Grant in Qualys ETM Identity uses agentic AI to measure and reduce identity risk across AD, Entra, Okta & other cloud IdPs/IDaaS. It operationalizes identity risk by turning messy Active Directory & identity-risk signals into validated...

Code Injection

Gardener Extensions is vulnerable to Code Injection. The vulnerability is due to improper handling of user-controlled input in Terraformer-based infrastructure provisioning across AWS, Azure, OpenStack, and GCP providers, which allows an attacker with administrative privileges in a Gardener proje...

CVE-2025-59823 Gardener providers vulnerable to code injection when Terraformer is used for infrastructure provisioning

Project Gardener implements the automated management and operation of Kubernetes clusters as a service. Code injection may be possible in Gardener Extensions for AWS providers prior to version 1.64.0, Azure providers prior to version 1.55.0, OpenStack providers prior to version 1.49.0, and GCP...

secrets-store-sync-controller discloses service account tokens in logs

Hello Kubernetes Community, A security issue was discovered in secrets-store-sync-controller where an actor with access to the controller logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vau...

CVE-2025-30204 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, minio-operator, flux-image-reflector-controller, opentelemetry-operator, tekton-chains, trufflehog, neuvector-fips, nemo, spire-server-fips, step-kms-plugin, timestamp-authority-fips, xeol, flux-image-reflector-controller-fips, hydra-fips, wal-g...

Infrastructure Laundering: Blending in with the Cloud

Image: Shutterstock, ArtHead. In an effort to blend in and make their malicious traffic tougher to block, hosting firms catering to cybercriminals in China and Russia increasingly are funneling their operations through major U.S. cloud providers. Research published this week on one such outfit --...

CloudBrute - Awesome Cloud Enumerator

A tool to find a company target infrastructure, files, and apps on the top cloud providers Amazon, Google, Microsoft, DigitalOcean, Alibaba, Vultr, Linode. The outcome is useful for bug bounty hunters, red teamers, and penetration testers alike. The complete writeup is available. here Motivation ...