metahub

MetaHub is an automated contextual security findings enrichment and impact evaluation tool for vulnerability management. You can use it with AWS Security Hub or any ASFF-compatible security scanner. Stop relying on useless severities and switch to impact scoring definitions based on YOUR context...

aws-security-assessment-solution

Self-Service Security Assessment Solutions v2.0 Cybersecurity remains a very important topic and point of concern for many CIOs, CISOs, and their customers. To meet these important concerns, AWS has developed a primary set of services customers should use to aid in protecting their accounts. Amaz...

aws-security-assessment-solution

自助安全评估解决方案 v2.0 网络安全仍然是许多 CIO、CISO 及其客户非常关注的重要议题和关切点。为了应对这些重要关切，AWS 开发了一套客户应使用的主要服务，以帮助保护其账户。Amazon GuardDuty、AWS Security Hub、AWS Config 和 AWS Well-Architected 审查可帮助客户在其 AWS 账户上维持强大的安全态势。随着越来越多的组织部署到云端，尤其是在快速部署的情况下，如果他们尚未实施推荐的 AWS 服务，可能需要对云环境进行快速安全评估。...

prowler

Prowler is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security...

prowler

Prowler Prowler es un escáner de vulnerabilidades de red implementado en un clúster de Raspberry Pi, desarrollado por primera vez durante el hackathon de la comunidad de seguridad informática de Singapur - HackSmith v1.0. Capacidades Escanear una red una subred particular o una lista de direccion...

EUVD-2026-42968

Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover...

GHSA-H8M9-JGF8-VWVP Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover

SAML Tenant Binding Enables Cross-Tenant Account Takeover Summary Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token. A malicious tenant with its own SAML configuration and a self-controlled IdP could...

Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover

SAML Tenant Binding Enables Cross-Tenant Account Takeover Summary Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token. A malicious tenant with its own SAML configuration and a self-controlled IdP could...

Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

SummaryProwler's HTML output formatter inserts finding.resourcetags into the generated report without HTML escaping. A cloud principal who can create or edit a resource tag in an account that is later scanned can store HTML or JavaScript in that tag. When another user opens the generated Prowler...

PYSEC-2026-3907 Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

Summary Prowler's HTML output formatter inserts finding.resourcetags into the generated report without HTML escaping. A cloud principal who can create or edit a resource tag in an account that is later scanned can store HTML or JavaScript in that tag. When another user opens the generated Prowler...

PYSEC-2026-3908 Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

Summary Prowler's HTML output formatter inserts finding.resourcetags into the generated report without HTML escaping. A cloud principal who can create or edit a resource tag in an account that is later scanned can store HTML or JavaScript in that tag. When another user opens the generated Prowler...

Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

SummaryProwler's HTML output formatter inserts finding.resourcetags into the generated report without HTML escaping. A cloud principal who can create or edit a resource tag in an account that is later scanned can store HTML or JavaScript in that tag. When another user opens the generated Prowler...

aws-security-assessment-solution v3.0.0

Self-Service Security Assessment Solutions v2.0 Cybersecurity remains a very important topic and point of concern for many CIOs, CISOs, and their customers. To meet these important concerns, AWS has developed a primary set of services customers should use to aid in protecting their accounts. Amaz...

CVE-2026-73262

creationtimestamp| type| source ---|---|--- 2026-09-08 20:35:22+00:00| published-proof-of-concept| https://github.com/prowler-cloud/prowler/security/advisories/GHSA-c2jg-2778-ggm4...

GHSA-C2JG-2778-GGM4 Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

Summary Prowler's HTML output formatter inserts finding.resourcetags into the generated report without HTML escaping. A cloud principal who can create or edit a resource tag in an account that is later scanned can store HTML or JavaScript in that tag. When another user opens the generated Prowler...

Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

Summary Prowler's HTML output formatter inserts finding.resourcetags into the generated report without HTML escaping. A cloud principal who can create or edit a resource tag in an account that is later scanned can store HTML or JavaScript in that tag. When another user opens the generated Prowler...

EUVD-2026-57222

Prowler: Stored XSS in HTML reports through unescaped cloud resource tags...

prowler v5.41.0

Prowler is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security...

Server-side Request Forgery (SSRF)

Overview prowler is a Prowler is an Open Source security tool to perform AWS, GCP and Azure security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness. It contains hundreds of controls covering CIS, NIST 800, NIST CSF, CISA, RBI,...

Command Injection

Overview prowler is a Prowler is an Open Source security tool to perform AWS, GCP and Azure security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness. It contains hundreds of controls covering CIS, NIST 800, NIST CSF, CISA, RBI,...