trivy-operator

Kubernetes-native security toolkit. Documentation Introduction The Trivy Operator leverages Trivy to continuously scan your Kubernetes cluster for security issues. The scans are summarised in security reports as Kubernetes Custom Resource Definitions, which become accessible through the Kubernete...

DevSecOpsGuideline

OWASP DevSecOps 指南 OWASP DevSecOps 指南介绍了如何实现安全流水线、运用最佳实践，并引入可在此方面使用的工具。此外，该项目还致力于帮助我们在开发流程中推广“左移安全”文化。 本项目适用于任何拥有开发流水线（换言之，即 DevOps 流水线）的各种规模的公司。 我们力求在此项目中勾勒出安全 DevOps 流水线的整体视图，然后根据我们定制化的需求加以改进。 理想目标是“尽早发现安全问题（无论是设计缺陷还是应用漏洞）。” 初始步骤 DevSecOps 的核心就是将安全融入 DevOps。但要跟上 CI/CD 的节奏，安全必须尽早注入软件编写与测试环节。 OWA...

mesh-kridik

mesh-kridik Enhance your Kubernetes service mesh security !! mesh-kridik is an open-source security checker that performs various security checks on a Kubernetes cluster with istio service mesh and outputs a security report The security checks tests are the full implementation of istio security...

Johnson Controls Inc. TL280

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to access sensitive information on the device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for...

OpenAI’s Hacking Debacle Comes Down to Human Error

If the generative AI giant had followed well-known security best practices, it’s likely that its AI agent would never have escaped to the open internet and hacked multiple companies...

ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component

SummaryAn integer overflow in the API component's protobuf decoder allows denial-of-service attacks when API encryption is not used. DetailsThe bounds check ptr + fieldlength end in components/api/proto.cpp can overflow when a malicious client sends a large fieldlength value. This affects all...

AzeoTech DAQFactory (Update A)

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to upload malicious .ctl files that may lead to arbitrary code execution. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities...

Examples for Developers - Moderately critical - Access bypass - SA-CONTRIB-2026-044

The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drupal core functionality. The "Read from a file" feature implemented by the fileexample submodule can be used to expose any file that PHP can access. Therefore, the fileexample...

PT-2026-48592

Name of the Vulnerable Software and Affected Versions Examples for Developers versions 0.0.0 through 4.0.6 Description A missing authorization issue allows forceful browsing. Specifically, the "Read from a file" feature within the file example submodule can be used to expose any file that PHP can...

PT-2026-46320

Unauthenticated Local File Inclusion in Geya = 1.15 versions...

PT-2026-46362

Unauthenticated Local File Inclusion in Granola = 1.13 versions...

PT-2026-46361

Unauthenticated Local File Inclusion in Gamic = 1.15 versions...

PT-2026-46345

Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin = 2.7.2 versions...

PT-2026-46350

Unauthenticated Local File Inclusion in Kelly Young = 1.1.0 versions...

PT-2026-46359

Unauthenticated Local File Inclusion in Medeus = 1.14 versions...

PT-2026-41125

Name of the Vulnerable Software and Affected Versions eMagicOne Store Manager versions prior to 1.3.3 Description Improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a type of attack where the application does not return data...

SUSE CVE-2026-33505

Ory Keto is am open source authorization server for managing permissions at scale. Prior to version 26.2.0, the GetRelationships API in Ory Keto is vulnerable to SQL injection due to flaws in its pagination implementation. Pagination tokens are encrypted using the secret configured in...

GHSA-443W-3RQ3-5M5H AWS SDK for Java 2.0: Improper Handling of Special Characters in CloudFront Signing Utilities

Summary This notification is related to the CloudFront signing utilities in the AWS SDK for Java v2, which are used to generate Amazon CloudFront signed URLs and signed cookies. A defense-in-depth enhancement has been implemented to improve handling of special characters, such as double quotes an...

GHSA-27QH-8CXX-2CR5 AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters

Summary This notification is related to the CloudFront signing utilities in the AWS SDK for PHP, which are used to generate Amazon CloudFront signed URLs and signed cookies. A defense-in-depth enhancement has been implemented to improve handling of special characters, such as double quotes and...

CVE-2026-33216 NATS has MQTT plaintext password disclosure

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement JWT and exposed via monitoring...