1329 matches found
CLEANSTART-2026-EY57242 OpenTelemetry-Go is the Go implementation of OpenTelemetry
Security vulnerability affects the gcp-compute-persistent-disk-csi-driver package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...
com.hazelcast:hazelcast-aws (2.4), com.hazelcast:hazelcast-build-utils (3.12-beta-1) +3 more potentially affected by CVE-2026-107726 via com.hazelcast:hazelcast (3.12-beta-1)
com.hazelcast:hazelcast MAVEN version 3.12-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast:hazelcast-aws 2.4 - com.hazelcast:hazelcast-build-utils 3.12-beta-1 -...
USN-8905-1: Linux kernel (GCP) vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - MIPS architecture; - x86 architecture; - Intel NPU Driver; - Auxiliary...
Thunderstorm
Thunderstorm Non hai 4.000 finding. Hai sei percorsi verso i tuoi gioielli della corona. Un CSPM ti consegna una lista piatta, deduplicata e ordinata per severità di misconfigurazioni e ti lascia indovinare quali contano. Thunderstorm ragiona sulla raggiungibilità : raccoglie il tuo cloud in sola...
CVE-2026-96890
A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret...
CVE-2026-96890
A Server-Side Request Forgery (SSRF) vulnerability exists in GitHub Enterprise Server (versions 3.20, 3.21, and 3.22). The flaw stems from the secret scanning validator for GCP service account credentials , which trusted the token endpoint embedded in a committed credential and issued requests wi...
EUVD-2026-93667
A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret...
CVE-2026-96890 Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts
A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret...
PT-2026-107128
Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions 3.20 through 3.20.8 GitHub Enterprise Server versions 3.21 through 3.21.6 GitHub Enterprise Server versions 3.22 through 3.22.1 Description A Server-Side Request Forgery SSRF issue exists where the secret...
CVE-2026-96890: Server-Side Request Forgery (SSRF)
A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret...
Cloud-Penetration-Testing-Guide
☁️ Cloud Penetration Testing Guide - Completo Guia operaciona...
PT-2026-96146
Name of the Vulnerable Software and Affected Versions Feast versions prior to 0.65.0 Description The .github/workflows/pr integration tests.yml workflow uses pull request target with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits. This allows ...
CVE-2026-84303
creationtimestamp| type| source ---|---|--- 2026-09-20 05:20:08+00:00| seen| https://bsky.app/profile/gcpweekly.bsky.social/post/3mvwh6p7ulh2c 2026-09-20 05:20:10+00:00| seen| https://bsky.app/profile/gcpweekly.bsky.social/post/3mvwh6pfjye2s 2026-09-20 05:20:14+00:00| seen|...
com.squareup.misk:misk (>=2023.09.14.131150-3fb4032, <=2024.01.24.000543-2260326), com.squareup.misk:misk-admin (>=2023.09.14.131150-3fb4032, <=2024.01.24.000543-2260326) +34 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.8.1)
com.squareup.wire:wire-runtime MAVEN version 4.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.misk:misk =2023.09.14.131150-3fb4032, =2023.09.14.131150-3fb4032,...
CVE-2026-44300
OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP...
CVE-2026-44300 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection
OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP...
CVE-2026-44300
OpenCost (a Kubernetes cost-monitoring tool) versions prior to 1.121.0 contain an Improper Access Control flaw in the POST /serviceKey endpoint (pkg/costmodel/router.go ). The endpoint invokes AddServiceKey without mandatory authentication, allowing an unauthenticated network client to submit an ...
CVE-2026-44300 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection
OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP...
CVE-2026-44300 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection
OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP...
CVE-2026-44300
OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP...