cloud-doctor

cloud-doctor 하나의 명령으로 전체 클라우드 계정을 평가합니다 — 잘못된 구성, 누락된 관측 가능성, 보안 태세를 점수화하고, 가장 먼저 수정해야 할 5가지를 순위로 보여줍니다. AWS, Cloudflare, Vercel, Supabase, Render, Fly.io 또는 Railway를 지정하면 점수, 무엇이 잘못되었는지, 각각에 대한 수정 사항을 반환합니다 — 에이전트에 바로 전달할 수 있을 정도로 자체 포함되어 있습니다. 빠른 시작 npx cloud-doctor...

aws-log4j-mitigations

aws-log4j-mitigations AWS에서 log4j 악용을 방지하기 위해 구현할 수 있는 완화 조치. Ansible과 함께 WAFv2 사용. 다음에서 영감을 받음: https://github.com/OllieJC/aws-log4j-mitigations...

Threat_Model_Examples

脅威モデル事例集 このリポジトリには、さまざまなテクノロジーとシステム向けの脅威モデルの事例が含まれています。これらのリソースは、さまざまなドメインにわたる脅威モデルの実例を提供し、セキュリティ専門家、開発者、研究者が、セキュリティリスクに対処するために脅威モデリングを効果的に適用する方法をよりよく理解するのに役立ちます。 このプロジェクトは、脅威モデルの最終結果がどのようになるかのイメージを提供するために設立されました。数多くのガイドラインや方法論が存在する中で、具体的な事例があれば、コミュニティが「良い状態」とはどのようなものかをよりよく理解できるだろうと考えたからです。 🛡️ Web...

security_monkey

참고: Security Monkey는 유지보수 모드이며 2020년에 지원이 종료됩니다. AWS 사용자는 AWS Config를 이용해 주시기 바랍니다. GCP 사용자는 Cloud Asset Inventory를 이용해 주시기 바랍니다. Security Monkey Security Monkey는 AWS 및 GCP 계정에서 정책 변경을 모니터링하고 안전하지 않은 구성이 발견되면 경고를 보냅니다. OpenStack 퍼블릭 및 프라이빗 클라우드도 지원합니다. Security Monkey는 GitHub 조직, 팀, 리포지토리까지 감시하고...

opencspm

OpenCSPM Open Cloud Security Posture Management, OpenCSPM은 클라우드 구성 및 메타데이터에 대한 심층적인 통찰력을 제공하여 시간이 지남에 따라 위험을 이해하고 줄이는 데 도움을 주는 오픈소스 플랫폼입니다. OpenCSPM은 누구를 위한 것인가요? 클라우드 환경에서 인프라를 운영하며 전체 계정에 걸친 보안 위험을 파악하고 이러한 문제의 해결을 추적하려는 보안 팀. 새로운 시스템을 개발하고 초기부터 자주 보안을 내재화하기 위해 따라야 할 보안 모범 사례 세트를 찾는 개발 및 인프라 팀...

PENTEST-LAB

PENTEST-LAB 웹, API, 클라우드, AI, 블루팀 보안을 실습형 공격 체인을 통해 학습할 수 있는 현대적인 취약 애플리케이션 및 사이버 레인지입니다. ╔═══════════════════════════════════════════════════════════════╗ ║ ██████╗ ███████╗███╗ ██╗████████╗███████╗███████╗████████╗ ║ ║ ██╔══██╗██╔════╝████╗ ██║╚══██╔══╝██╔════╝██╔════╝╚══██╔══╝ ║ ║ ██████╔╝████...

EUVD-2026-57222

Prowler: Stored XSS in HTML reports through unescaped cloud resource tags...

prowler v5.41.0

Prowler is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security...

CVE-2026-73264

Prowler (cloud security platform) contains an SSRF risk prior to version 5.33.1. An authenticated user with Lighthouse provider configuration access could supply an unvalidated base_url for the openai_compatible provider via POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/...

CVE-2026-73262 Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resourcetags, assembled by unrolldict and parsehtmlstring, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned...

CVE-2026-73262

Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resourcetags, assembled by unrolldict and parsehtmlstring, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned...

The vulnerability of the web portal for managing cloud services, accounts, subscriptions, and the security of the Microsoft 365 Admin Center is related to errors in verifying cryptographic signatures. This vulnerability allows attackers to escalate their privileges.

The vulnerability of the web portal for managing cloud services, accounts, subscriptions, and the security of the Microsoft 365 Admin Center is related to errors in verifying cryptographic signatures. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotel...

PT-2026-71084

Name of the Vulnerable Software and Affected Versions Prowler versions prior to 5.36.0 Description The Kubernetes provider connection test fails to properly validate kubeconfig content containing a legacy GCP auth-provider. Specifically, the kubeconfig contains exec auth function in...

SabPaisa Partners with AccuKnox for Zero Trust AI-Powered Cloud Security to Secure Its Payments Platform

CALIFORNIA, USA, 2nd August 2026, CyberNewswire...

NVIDIA Forms 37-Member Open Secure AI Alliance and Open-Sources NOOA Framework

NVIDIA and 36 other organizations have formed the Open Secure AI Alliance to develop and share open technologies, techniques, and tools for securing software and artificial intelligence AI agents. The 37-member group spans cloud, security, enterprise software, and AI companies, including Microsof...

Qualys Expands Serverless Security with Vulnerability Scanning for AWS Lambda

Key Takeaways Qualys now delivers automated AWS Lambda vulnerability scanning , extending serverless security beyond posture checks CSPM into workload-level risk visibility. CSPM alone only catches misconfigurations excessive permissions, exposure, logging, encryption — it can't detect vulnerable...

CVE-2026-9765

Technical details for CVE-2026-9765 are not publicly available in the provided documents. Monitor for updates for any affected products, impact, and remediation information.

CVE-2026-59151

Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token, and the ACS finish logic in api/src/backend/api/v1/views.py recalculated the tenant from...

The vulnerability in the virtual machine of the cloud security platform Palo Alto Networks Cortex XDR Broker VM, related to insecure privilege management, allows attackers to escalate their privileges.

The vulnerability of the virtual machine on Palo Alto Networks Cortex XDR Broker VM in cloud security platforms relates to insecure privilege management. Exploiting this vulnerability can allow attackers to enhance their privileges...

PT-2026-56921

Name of the Vulnerable Software and Affected Versions OpenPLC Runtime version 3 Description An authenticated arbitrary file write exists in the legacy web UI program-upload workflow. The application stores an attacker-supplied filename prog file into the Programs.File database field and uses this...