airgap

airgap Security for the modern AI age. No security layer is perfect. airgap is still experimental. Contributions welcome! Protected secrets airgap launches a target program e.g. an AI coding agent inside its own mount namespace and transparently replaces secrets with redacted versions. A program...

foxcage

foxcage Run Firefox in a rootless Podman container for security isolation. Your browser runs with almost no Linux capabilities, in its own user and network namespace, isolated from the host — while still having full GPU acceleration, audio, and DRM support. Why foxcage? Firefox already has a...

kubebox

= Kubebox small^⎈❏^ Antonin Stefanutti https://github.com/astefanutti@astefanutti // Meta :description: Terminal and Web console for Kubernetes // Settings :idprefix: :idseparator: - :experimental: // Aliases ifdef::env-github :note-caption: ℹ️ :icon-check: ✔️ :icon-edit: ✏️ endif::...

CVE-2026-81303

CVE-2026-81303 affects hawtio-operator , a Kubernetes operator. The operator holds the routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks....

CVE-2026-81320

A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are...

permission-manager

Permission manager Welcome to the Permission Manager! 🎉 🎉 Permission Manager is an application developed by SIGHUP that enables a super-easy and user-friendly RBAC management for Kubernetes. If you are looking for a simple and intuitive way of managing your users within a Kubernetes cluster, this...

CVE-2026-64531

CVE-2026-64531 — OVSwrap PoC de escalada de privilegios local usuario normal → root del módulo Open vSwitch del kernel de Linux. Aprovecha un desbordamiento de enteros en el campo nlalen de 16 bits para escalar de usuario normal hasta root. Resumen de la vulnerabilidad Cuando el flujo de acciones...

CVE-2024-21626

Usage: 1.git clone https://github.com/cdxiaodong/CVE-2024-21626 2.docker-compose up Verification: If you can obtain the host's /etc/passwd, the vulnerability exists. Environment: runc: =v1.0.0-rc93,=1.1.11 Attack details & principle: In affected versions of runc, during initialization, some...

kernel: net: qrtr: restrict socket creation to the initial network namespace

A flaw was found in the Linux kernel's QRTR Qualcomm IPC Router networking component. An unprivileged local attacker can create a QRTR socket in a separate network namespace. Due to improper handling of global state variables, this allows the attacker to send datagrams and control-plane messages ...

CodeCut

Plugin CodeCut para Ghidra Plugin de Ghidra para la GUI de DeepCut / CodeCut Teoría de funcionamiento CodeCut permite al usuario asignar funciones a archivos objeto en Ghidra y, a continuación, interactuar con el binario a nivel de archivo objeto. Las funciones se asignan a archivos objeto...

WinObjEx64

WinObjEx64 Windows Object Explorer 64-bit WinObjEx64 is an advanced utility that lets you explore the Windows Object Manager namespace. For certain object types, you can double-click on it or use the "Properties..." toolbar button to get more information, such as description, attributes, resource...

CVE-2026-53718

Envoy Gateway prior to 1.7.4 and 1.8.1 contains a cross-namespace authorization bypass in the custom-backend branch of internal/gatewayapi/route.go. The omitted validateBackendNamespace check allows an HTTPRoute to use an extension-managed custom backendRef to reference a backend resource in anot...

tugtainer-1.30.2-CVE-2026-55494-and-CVE-2026-62308-to-RCE

Tugtainer v1.30.2 RCE El RCE se obtiene abusando de 2 vulnerabilidades CVE-2026-55494 CVE-2026-62308 En resumen, se abusa de una vulnerabilidad SSRF para llamar a un servicio no autenticado en la red interna y crear un docker que comparte el mismo PID con tugtainer, haciendo así accesible el...

CVE-2026-46331

CVE-2026-46331 - "pedit COW" Vulnerability Assessment & Mitigation Guide This repository contains basic administrative tools to check exposure and apply temporary mitigations against the local privilege escalation vulnerability CVE-2026-46331 known as "pedit COW" in the Linux kernel. Repository...

SysTrace

SysTrace 2.0 ptrace-based Linux syscall monitor and sandbox for analyzing ELF binaries. SysTrace runs a target inside an isolated Linux namespace environment, traces its system calls and child processes, applies rule-based detection and weighted risk scoring, then uses a Random Forest classifier ...

CVE-2021-41805

CVE-2021-41805 - HashiCorp Consul Enterprise RCE !WARNING AVISO LEGAL: ¡Esta herramienta es ESTRICTAMENTE solo para FINES EDUCATIVOS! El uso de esta herramienta para atacar objetivos sin consentimiento mutuo previo es ILEGAL. Es responsabilidad del usuario cumplir con todas las leyes aplicables a...

rakkess

rakkess Review Access - kubectl plugin to show an access matrix for server resources Intro Have you ever wondered what access rights you have on a provided kubernetes cluster? For single resources you can use kubectl auth can-i list deployments, but maybe you are looking for a complete overview?...

container-cve-2021-22555

Reproducción de CVE-2021-22555 como contenedor Primero, esto incluye el código del exploit desde aquí como un contenedor preconstruido práctico: https://github.com/google/security-research/tree/master/pocs/linux/cve-2021-22555 Contenedor preconstruido: quay.io/cgwalters/cve-2021-22555 Mitigación:...

CVE-2023-0386

typora-copy-images-to: ./image CVE-2023-0386 Uso del exploit: Primero : Subir fuse.c y exp.sh al directorio /tmp. Puedes usar scp o python3 -m http.server para subir el archivo al objetivo. root@kitploit: scp /Desktop/CVE-2023-0386/exp.sh [email protected]:/tmp scp...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: NFSD: Hold a reference to the net structure for the lifetime of the open file descriptor. The /proc/fs/nfs/exports proc entry is created during module initialization and remains valid throughout the lifetime of the module. The...