gitoops

GitOops! 😱 all paths lead to clouds GitOops is a tool to help attackers and defenders identify lateral movement and privilege escalation paths in GitHub organizations by abusing CI/CD pipelines and GitHub access controls. It works by mapping relationships between a GitHub organization and its CI/...

ci-supplychain-guard

CI Supply Chain Guard A static analysis tool for detecting malicious dependencies in CI/CD pipelines before they're merged into your codebase. Author: Otsmane Ahmed Status: Research Prototype v1.0 Quick Start root@kitploit: 1. Clone and install git clone...

openclarity

OpenClarity is an open source tool for agentless detection and management of Virtual Machine Software Bill Of Materials SBOM and security threats such as vulnerabilities, exploits, malware, rootkits, misconfigurations and leaked secrets. Join OpenClarity's Slack channel to hear about the latest...

pwnproxy

pwnproxy 1つのセキュリティテストエンジン。あらゆるインターフェース。 ペンテスター、AIエージェント、CI/CDパイプライン、チームのための、 オープンでローカルファーストなセキュリティテストプラットフォーム。 セキュリティテストはもはやデスクトップ限定のワークフローではない 従来のセキュリティツールは、デスクトップインターフェースを使用する単一のテスターを想定して設計されていました。 pwnproxyは、ターミナル、TUI、REST...

DEFCON-CICD-pipelines-workshop

CI/CD : Il nuovo Eldorado ? Abstract Le pipeline CI/CD stanno diventando sempre più parte dell'infrastruttura standard all'interno dei team di sviluppo; con l'avvento di nuovi approcci come Infrastructure as Code, il livello di sensibilità di tali pipeline sta aumentando rapidamente. In caso di...

CVE-2026-15423 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without...

Supply Chain Compromises Impact Nx Console and GitHub Repositories

CISA is prioritizing the response to multiple emerging software supply chain intrusion campaigns targeting developer ecosystems Continuous Integration/Continuous Development CI/CD pipelines. These recent incidents, including the GitHub compromise via a malicious Nx Console Visual Studio Code VS...

Malicious code in @cap-js/postgres (npm)

Supply chain compromise of legitimate SAP packages published by threat actor "[email protected]" impersonating SAP toolchain maintainers. All four compromised packages share the same fingerprint: setup.mjs 4.4 KB and execution.js 11.1 MB bundled in the tarball, with a preinstall hook of "node...

CVE-2026-31961 Unbounded memory allocation in Quill via unvalidated size fields in Mach-O binary parsing

Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 contains an unbounded memory allocation vulnerability when parsing Mach-O binaries. Exploitation requires that Quill processes an attacker-supplied Mach-O binary, which is most likely in...

Exploit for Argument Injection in Gnu Inetutils

CVE-2026-24061 GNU inetutils Telnet Detector A safe, passive...

CVE-2026-23889 pnpm has Windows-specific tarball Path Traversal

pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's tarball extraction allows malicious packages to write files outside the package directory on Windows. The path normalization only checks for ./ but not .. On Windows, backslashes are directory separators...

Duplicate Advisory: Wrangler affected by OS Command Injection in `wrangler pages deploy`

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-36p8-mvp6-cv38. This link is maintained to preserve external references. Original Description SummaryA command injection vulnerability CWE-78 has been found to exist in the wrangler pages deploy command. The iss...

EUVD-2018-6511

Malware in sbrugna...

EUVD-2023-2156

Malicious code in bioql PyPI...

The New Frontline: Why DevOps Became a Cyber Target

Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. Click right here to hear it all on CAASM & CDMB Inefficiencies! Your developers didn't become...

CVE-2025-49598 conda-forge-ci-setup Allows Arbitrary Code Execution via Insecure Version Parsing

conda-forge-ci-setup is a package installed by conda-forge each time a build is run on CI. The conda-forge-ci-setup-feedstock setup script is vulnerable due to the unsafe use of the eval function when parsing version information from a custom-formatted meta.yaml file. An attacker controlling...

CVE-2024-52582

Cachi2 is a command-line interface tool that pre-fetches a project's dependencies to aid in making the project's build process network-isolated. Prior to version 0.14.0, secrets may be shown in logs when an unhandled exception is triggered because the tool is logging locals of each function. This...

Secure Your APIs and Reduce Your Attack Surface With Modern, AI-powered API Security in Qualys Web Application Scanning (WAS)

The rise of APIs presents both opportunities and challenges in today’s hyperconnected digital world. APIs are integral to digital transformation initiatives across industries. The latest data indicates that over 83% of web traffic now comprises API traffic, highlighting their critical role in...

Practical Guidance For Securing Your Software Supply Chain

The heightened regulatory and legal pressure on software-producing organizations to secure their supply chains and ensure the integrity of their software should come as no surprise. In the last several years, the software supply chain has become an increasingly attractive target for attackers who...

An End-to-End Approach to Next-Gen Security for Web Applications & APIs

According to Verizon’s 2022 Data Breach Investigations Report, web applications remain both the top hacking vector and data breach pattern, accounting for roughly 70% of security incidents. This is because web applications are everywhere and easily probed for weaknesses. A vulnerability in any...