checkov

Checkov is a static code analysis tool for infrastructure as code IaC and also a software composition analysis SCA tool for images and open source packages. It scans cloud infrastructure provisioned using Terraform, Terraform plan, Cloudformation, AWS SAM, Kubernetes, Helm charts, Kustomize,...

aws_pwn

AWS pwn Summary This is a collection of horribly written scripts for performing various tasks related to penetration testing AWS. Please don't be sad if it doesn't work for you. It might be that AWS has changed since a given tool was written or it might be that the code sux. Either way, please fe...

aws-security-assessment-solution

Self-Service Security Assessment Solutions v2.0 Cybersecurity remains a very important topic and point of concern for many CIOs, CISOs, and their customers. To meet these important concerns, AWS has developed a primary set of services customers should use to aid in protecting their accounts. Amaz...

cfripper

CFRipper CFRipper is a Library and CLI security analyzer for AWS CloudFormation templates. You can use CFRipper to prevent deploying insecure AWS resources into your Cloud environment. You can write your own compliance checks by adding new custom plugins. Docs and more details available in...

serverless-application-model

AWS SAM transform The AWS Serverless Application Model AWS SAM transform is a AWS CloudFormation macro that transforms SAM templates into CloudFormation templates. To use the SAM transform, add AWS::Serverless-2016-10-31 to the Transform section of your CloudFormation template. Benefits of using...

cfn_nag

Background The cfn-nag tool looks for patterns in CloudFormation templates that may indicate insecure infrastructure. Roughly speaking, it will look for: IAM rules that are too permissive wildcards Security group rules that are too permissive wildcards Access logs that aren't enabled Encryption...

apche-struts-vuln-demo-cve-2018-11776

Demostración de Vulnerabilidad Apache Struts CVE-2018-11776 Descripción Crea un entorno de prueba aislado para experimentar con la vulnerabilidad CVE-2018-11776 de Apache Struts. Comenzando Para iniciar el entorno de prueba, ejecute el siguiente comando: aws cloudformation create-stack ...

cloudformation-waf-acl

cloudformation-waf-acl An AWS CloudFormation template used to provision and manage AWS WAFv2 resources, including a Web ACL, managed rule groups, a custom regex pattern set, and an IP set. Components The template provisions: 1. An AWS::WAFv2::WebACL. 2. AWS managed protection rule groups:...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: lazydocker, argo-rollouts, k3s, go, jitsucom-bulker, newrelic-infra-operator, temporal, sftpgo-plugin-auth, octo-sts, continuity, rancher-fleet, timoni, tofu-controller, mattermost, crossplane-provider-azure-storage, azcopy, aws-efs-csi-driver, addon-resizer,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: trivy, docker, k3s, dagger, falcoctl, mattermost, crossplane-provider-azure-storage, src, argo-events, cosign, buildah, terraform-provider-azurerm, pulumi-kubernetes-operator, tkn, mods, spire-server, grype, cilium-cli, falco-no-driver, kubernetes-dashboard,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: k3s, http-echo, newrelic-infra-operator, clickhouse-operator, sftpgo-plugin-auth, azure-service-operator, cfssl, kubernetes-csi-driver-nfs, octo-sts, timoni, tofu-controller, verticadb-operator, mattermost, azcopy, ratify, ferretdb, x509-certificate-exporter, src,...

GHSA-464C-974J-9XM6 AWS CDK CodeBuild S3 Log Encryption Boolean Inversion

Summary The AWS Cloud Development Kit AWS CDK is an open-source software development framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. We identified an issue in which explicitly setting encrypted: true on the S3LoggingOptions property of an AWS...

CVE-2026-44795

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading...

CVE-2026-44795 Spinnaker: Non-safe yaml deserialization allowing RCE when using specific types

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading...

CVE-2026-44795

CVE-2026-44795 affects Spinnaker (Cloud deployments/baking paths) where unsafe YAML processing bypasses safe deserialization via a non-safe constructor, enabling arbitrary Java class loading and remote code execution. Affected versions precede fixed releases and include 2026.1.0, 2026.0.3, 2025.4...

CVE-2026-44795

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading...

CVE-2026-44795 Spinnaker: Non-safe yaml deserialization allowing RCE when using specific types

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading...

EUVD-2026-43086

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading...

CVE-2026-44795 Spinnaker: Non-safe yaml deserialization allowing RCE when using specific types

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading...

CVE-2026-44795: Use of Externally-Controlled Input to Select Classes or Code

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading...