kube-linter

Análisis estático para Kubernetes ¿Qué es KubeLinter? KubeLinter analiza archivos YAML de Kubernetes, charts de Helm y manifiestos de Kustomize, y los verifica contra una variedad de mejores prácticas, con un enfoque en la preparación para producción y la seguridad. KubeLinter ejecuta...

gixy

GIXY 概述 Gixy 是一款用于分析 Nginx 配置的工具。 Gixy 的主要目标是防止安全配置错误并实现缺陷检测的自动化。 目前支持的 Python 版本为 2.7、3.5、3.6 和 3.7。 免责声明：Gixy 仅在 GNU/Linux 上经过充分测试，其他操作系统可能存在一些问题。 它能做什么 目前 Gixy 可以检测： ssrf 服务端请求伪造 httpsplitting HTTP 分割 origins referrer/origin 验证问题 addheaderredefinition "addheader" 指令覆盖响应头 hostspoofing 请求的 Host...

xvna

XVNA Extreme Vulnerable Node Application XVNA is an extreme vulnerable node application coded in NodejsExpressjs/MongoDB that helps security enthusiasts to learn application security. it's not counseled to host this application online as it is intended to be Vulnerable. We tend to suggest hosting...

red-detector

Red-Detector 描述 使用 Vuls https://vuls.io/en/ 扫描您的 EC2 实例以发现其漏洞。 使用 Lynis https://cisofy.com/solutions/lynis 审计您的 EC2 实例以发现安全配置错误。 使用 Chkrootkit http://www.chkrootkit.org/ 扫描您的 EC2 实例以寻找 rootkit 迹象。 要求 1. 已配置的 AWS 账户，并具备以下 EC2 操作权限。包含这些要求的策略可在 red-detector-policy.json 中找到。 操作详情：...

CVE-2023-38873-G1

🚨 G1 = A05:2021 – 安全配置错误 点击劫持 ⚠️ 基础评分：6.5 中危 评分标准：CVSS ⚠️ 📌 描述 此仓库演示了 G1 网站上存在的 点击劫持 安全漏洞。该漏洞允许攻击者将网站加载到 iframe 中，并覆盖恶意元素以欺骗用户。 ⚠️ 什么是点击劫持？ 点击劫持（也称为 UI 遮盖攻击）是一种欺骗用户，使其在不知情的情况下与合法页面进行交互的攻击方式。它可能被利用于： 窃取凭据 执行非预期操作 诱骗用户下载恶意软件 🔥 漏洞如何运作？ 此仓库的 HTML 代码将 G1 网站加载到 全屏 iframe 中，并显示一个 虚假弹出窗口 ，提示下载应用程序。 风险包括：...

nerva v1.69.6

Nerva Nerva: Fast Service Fingerprinting CLI Features • Installation • Quick Start • Usage • Protocols • Library • Use Cases • Troubleshooting High-performance service fingerprinting written in Go. Identify 170+ network protocols across TCP, UDP, and SCTP transports with rich metadata extraction...

azure-security-auditor

Azure Security Posture Auditor Una herramienta CLI ligera, de estilo producción, que audita las configuraciones de seguridad de Azure y expone errores de configuración comunes — reflejando lo que Microsoft Defender for Cloud comprueba internamente. Comprobaciones...

CVE-2026-86420

ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service...

CVE-2026-55513

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ignores both the server-wide enrollmenttokenttl security setting and per-network networkconfig.enrollmenttokenttl overrides. API host creatio...

EUVD-2022-56032

In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint...

GHSA-22G5-R2X5-97CX vulnerabilities

Vulnerabilities for packages: opensearch-dashboards...

GHSA-CR32-G25G-VXJJ vulnerabilities

Vulnerabilities for packages: opensearch-dashboards...

cve-2026-47875 - MEDIUM - JobParameterDeserializer bypasses the trusted-type allowlist

cve-2026-47875 - MEDIUM - JobParameterDeserializer bypasses the trusted-type allowlist...

CVE-2026-16019

creationtimestamp| type| source ---|---|--- 2026-08-19 16:08:05+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mth4hvptjp2m 2026-08-19 16:10:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mth4lhxgtt25...

EUVD-2026-62405

stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned potentially malicious plugin code...

EUVD-2026-62205

This Critical severity Stored XSS, PrivEsc Privilege Escalation, and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center and...

CVE-2026-66589 WordPress B2BKing plugin <= 5.2.30 - Broken Access Control vulnerability

Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing: from n/a through 5.2.30...

CVE-2026-21580

This Critical severity Stored XSS, PrivEsc Privilege Escalation, and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center and...

CVE-2026-21580

Confluence Data Center and Server versions 7.1.1 through 10.2.0 are affected by a Critical (CVSS 9.3) Stored XSS, privilege escalation, and security misconfiguration issue exploitable by unauthenticated attackers. Atlassian recommends upgrading to 9.2.21 or 10.2.13 or later; no in-the-wild exploi...

CVE-2026-21580

This Critical severity Stored XSS, PrivEsc Privilege Escalation, and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center and...