cicd-sensor

🚧 Pre-release: Active development. cicd-sensor is currently in pre-release and under active development. Feedback is very welcome. cicd-sensor Think EDR, but for CI/CD Pipelines. Open-source eBPF-powered runtime security sensor for GitHub Actions and GitLab CI/CD. → Full documentation Demo ---...

POC-CVE-2026-42826-2026-42826-Microsoft-Azure-DevOps-Information-Disclosure-Vulnerability

CVE-2026-42826 — Azure DevOps Information Disclosure PoC Overview Field| Value ---|--- CVE| CVE-2026-42826 CVSS| 10.0 Critical Microsoft / 7.5 High NVD CWE| CWE-200 Exposure of Sensitive Information to an Unauthorized Actor GHSA| GHSA-gmwx-3xm2-9fx8 Affected| Azure DevOps Services, Azure DevOps...

Oneliner-Bugbounty

Oneliner-Bugbounty A collection oneliner scripts for bug bounty List tools Subfinder Naabu httpx Nuclei Waybackurls DNSProbe gf sqlmap qsreplace hakrawler Puredns GauPlus uro Auto scanner root@kitploit: subfinder -d site.com -all | naabu | httpx | nuclei -t nuclei-templates Finding files For...

jenkinsci__workflow-cps-global-lib-plugin_CVE-2022-25174_544-vff04fa68714d

Pipeline Shared Libraries When you have multiple Pipeline jobs, you often want to share some parts of the Pipeline scripts between them to keep Pipeline scripts DRY. A very common use case is that you have many projects that are built in the similar way. This plugin adds that functionality by...

kibune

kibune A Sigma based detection pipeline. Note: this project is in an alpha state What is for To test a generic Sigma rule To create a Sigma based detection pipeline Features Manage Sigma rules Evaluate Sigma rules with a given input & record alerts Emit alerts send HTTP requests based on alerts...

gh-workflow-auditor

GitHub Workflow Auditor Workflow auditing tools to identify security issues in GitHub workflows Usage root@kitploit: usage: main.py -h --type repo,org,user --log-level debug,info,warning,error,critical input Identify vulnerabilities in GitHub Actions workflow positional arguments: input User/Org...

bitbucket-iac-scan

Bitbucket Security: Infrastructure as Code Security Scanner Scans your Infrastructure as Code configuration files to ensure good security practises. Creates a security Code Insights report if issue is found. This Bitbucket Cloud supported Pipe leverages the industry leading KICS scanning tool to...

SharpCollection

SharpCollection Nightly builds of common C offensive tools, fresh from their respective master branches built and released in a CDI fashion using Azure DevOps release pipelines. Is your favorite tool missing? Feel free to open an issue or DM me on X @Flangvik Please note that Cobalt Strike's...

json-sanitizer

json-sanitizer Given JSON-like content, The JSON Sanitizer converts it to valid JSON. Getting Started - Contact This can be attached at either end of a data-pipeline to help satisfy Postel's principle: be conservative in what you do, be liberal in what you accept from others Applied to JSON-like...

ScubaGear

ScubaGear is an assessment tool that verifies that a Microsoft 365 M365 tenant’s configuration conforms to the policies described in the Secure Cloud Business Applications SCuBA Secure Configuration Baseline documents. !NOTE This documentation can be read using GitHub Pages. Target Audience...

CVE-2026-85667 xiaobei through 5.5.2 Unauthenticated Webhook Message Injection

xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints, allowing unauthenticated attackers to inject arbitrary messages into the agent pipeline. Attackers can publish malicious messages via the /webhookworktool handler and exploit unvalidated media UR...

CVE-2026-11120-Command-Injection-via-Git-URL-in-CI-CD-Pipeline

CVE-2026-11120 – Command Injection via Git URL in CI/CD Pipeline Program Code Python root@kitploit: cicdbuild.py - Clones repository without sanitizing URL import subprocess, sys def cloneandbuildrepourl: Vulnerability: repourl can contain shell metacharacters cmd = f"git clone repourl /tmp/repo"...

raptor

Raptor is a web-based web-serivce + UI github centric source-vulnerability scanner i.e. it scans a repository with just the github repo url. You can setup webhooks to ensure automated scans every-time you commit or merge a pull request. The scan is done asynchonously and the results are available...

gato

!WARNING Este repositorio está obsoleto y archivado Gato ha sido sustituido por Trajan , la herramienta multiplataforma de detección de vulnerabilidades y automatización de ataques en CI/CD de Praetorian. Trajan consolida las capacidades de ataque CI/CD de GitHub Actions Gato y GitLab Glato en un...

warhorse

Warhorse Table of contents Overview Features Documentation Development Acknowledgments Overview Warhorse consists of a fully-featured Ansible playbook to deploy infrastructure in the cloud for conducting security assessments. The Playbook combines Terraform & Ansible to deploy and configure virtu...

CVE-2026-78593

An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond th...

EUVD-2026-70658

An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond th...

CVE-2026-47863

A flaw was found in Reactor Core. Applications using the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. This occurs when upstream components deliver items during an active flush, causing the processing pipeline to permanently hang an...

jenkinsci__workflow-cps-plugin_CVE-2022-25173_2646-v6ed3b5b01ff1

Pipeline: Groovy Plugin Introduction A key component of the Pipeline plugin suite, this provides the standard execution engine for Pipeline steps, based on a custom Groovy interpreter that runs inside the Jenkins controller process. In principle other execution engines could be supported, with...

hdwebmobile-photo-video-reviews

HDWebmobile Photo & Video Reviews A WooCommerce plugin that lets customers attach photos and short videos to their product reviews, shown right in the review list on the product page. WordPress.org: https://wordpress.org/plugins/hdwebmobile-photo-video-reviews/ pending first submission Requires:...