overlord

Overlord – Red Teaming Automation Overlord provides a python-based console CLI which is used to build Red Teaming infrastructure in an automated way. The user has to provide inputs by using the tool’s modules e.g. C2, Email Server, HTTP web delivery server, Phishing server etc. and the full infra...

cloud-middleware-dataset

云中间件数据集 本项目包含各大云服务提供商（Azure、AWS 和 GCP）所使用的云中间件（即由云安全提供商安装的代理）。 云中间件数据集列出了由主要云服务提供商（Azure、AWS 和 GCP）安装的所有代理。本项目的目的是让云客户全面了解其环境中安装的中间件，这些中间件可能会增加攻击面。 云中间件问题 云服务提供商通常在客户不知情或未明确同意的情况下，在客户的虚拟机上安装专有软件。这种桥接客户虚拟机与云提供商托管服务的专有软件，常常被发现会引入云客户所不知道的新潜在攻击面。由于 云中间件...

gibson

Gibson 网络监控工具，可映射进程与网络连接之间的关系，识别云服务提供商，并生成防火墙规则。轻量级代理负责采集，服务器负责聚合，解析器负责分析。 截图 跨机器概览 ——操作系统版本对比、共享 IP 检测、所有主机中的疑似信标（beaconing）候选： 单主机详情——严重告警 （已停止支持（EOL）的操作系统，nc.exe 向未知 IP 发出信标）： 单主机详情——警告 （标记出疑似信标候选）： 单主机详情——正常 （无异常）： 功能特性 采集器（Agent） 🔒 安全 ：可选 AES-256-GCM 加密 🗜️ 高效 ：可选 gzip 压缩 🌐 云端上传 ：支持 HTTP/HTTPS...

AZL-100917 CVE-2026-83530 affecting package cloud-provider-kubevirt 0.5.1-7

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...

AZL-100935 CVE-2026-83530 affecting package kube-vip-cloud-provider 0.0.10-8

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...

AZL-99246 CVE-2026-84304 affecting package kube-vip-cloud-provider 0.0.10-8

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

AZL-99177 CVE-2026-84304 affecting package cloud-provider-kubevirt 0.5.1-7

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

AZL-98376 CVE-2026-37236 affecting package kube-vip-cloud-provider 0.0.10-8

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98349 CVE-2026-37236 affecting package cloud-provider-kubevirt 0.5.1-7

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: tekton-pipelines, hubble-ui, fluent-operator, cluster-api-azure-controller, metrics-server, kubernetes-csi-external-snapshotter, kyverno-notation-aws, cert-manager, spicedb, flux-notification-controller, rancher, kubescape, spqr, kots, cloud-provider-aws,...

CVE-2026-73500 affecting package cloud-provider-kubevirt for versions less than 0.5.1-7

CVE-2026-73500 affecting package cloud-provider-kubevirt for versions less than 0.5.1-7. A patched version of the package is available...

CVE-2026-73500 affecting package kube-vip-cloud-provider for versions less than 0.0.10-8

CVE-2026-73500 affecting package kube-vip-cloud-provider for versions less than 0.0.10-8. A patched version of the package is available...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-detective-fips, go-sqlcmd, longhorn-instance-manager, crossplane-provider-aws-amplify-fips, crossplane-provider-aws-appautoscaling-fips, envoy-gateway-fips, knative-serving, kubevirt-cdi-apiserver-fips, go-licenses,...

GO-2026-5973 vulnerabilities

Vulnerabilities for packages: rke2-cloud-provider, rke2-cloud-provider-fips...

GO-2026-5973 vulnerabilities

Vulnerabilities for packages: rke2-cloud-provider...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: omnibump, ksops, goreleaser, policy-controller, kubo, sigstore-scaffolding, hubble-ui, aws-flb-cloudwatch, paranoia, redka, rancher-fleet, speedtest-go, helm-push, redpanda, crossplane-provider-aws-cloudfront, metrics-server, aws-nuke, terraform-provider-acme,...

GO-2026-6061 vulnerabilities

Vulnerabilities for packages: policy-controller, flux-image-automation-controller, hubble-ui, external-dns, fluent-operator, cluster-api-azure-controller, cerbos, crossplane-provider-aws-cloudfront, metrics-server, tfsec, mattermost, k8sgpt, cert-manager, src, spicedb, aws-efs-csi-driver,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: neuvector-sigstore-interface, step, ksops, wolfictl, policy-controller, flux-image-automation-controller, dagger, external-dns, cluster-api-azure-controller, crossplane-provider-aws-cloudfront, rootlesskit, mattermost, k8sgpt, cert-manager, kine, src, falco-no-driver...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: neuvector-sigstore-interface, step, rancher-telemetry, ksops, sriov-network-device-plugin, goreleaser, kubernetes-dashboard-api, policy-controller, kubo, flux-image-automation-controller, headlamp, nri-f5, hubble-ui, aws-flb-cloudwatch, paranoia, external-dns, extism...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: neuvector-sigstore-interface, kubernetes-dashboard-api, headlamp, nri-f5, oauth2-proxy, cluster-api-azure-controller, cerbos, helm-push, k3d, swagger, regclient, kyverno-notation-aws, k8sgpt, kubernetes-csi-driver-nfs, nri-memcached, src, kubernetes-dashboard, dive,...