warcannon

WARCannon - Catastrophically powerful parallel WARC processing WARCannon was built to simplify and cheapify the process of 'grepping the internet'. With WARCannon, you can: Build and test regex patterns against real Common Crawl data Easily load Common Crawl datasets for parallel processing Scale...

cloudfrunt

CloudFrunt CloudFruntは、設定ミスのあるCloudFrontドメインを特定するためのツールです。 背景 CloudFrontは、Amazon Web Services AWSが提供するコンテンツデリバリネットワーク CDN です。CloudFrontユーザーは、特定のソース（例えばS3バケット）からコンテンツを配信する「ディストリビューション」を作成します。...

subjack

subjack DNS Takeover Scanner Subjack is a DNS takeover scanner written in Go designed to scan a list of domains concurrently and identify ones that are able to be hijacked. With Go's speed and efficiency, this tool really stands out when it comes to mass-testing. Always double check the results...

DomainFrontDiscover

DomainFrontDiscover 도메인 프론팅이 가능한 CloudFront 도메인을 찾기 위한 스크립트 및 결과 여기서 진행된 작업에 대한 설명은 https://www.peew.pw/blog/2018/2/22/how-i-identified-93k-domain-frontable-cloudfront-domains 에서 확인할 수 있습니다. ConfirmedFrontableDomains.txt CloudFront를 통한 도메인 프론팅에 사용 가능한 것으로 확인된 93,000개 이상의 도메인 목록 2018년 2월 22일 기준...

aws_public_ips

awspublicips Table of Contents What's it for Quick start CLI reference Configuration IAM permissions Changelog Contributing Getting in touch What's it for awspublicips is a tool to fetch all public IP addresses both IPv4/IPv6 associated with an AWS account. It can be used as a library and as a CL...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: fuse-overlayfs-snapshotter, slsa-verifier, spark-operator, nova, terraform-provider-acme, trino, envconsul, docker-credential-acr-env, golangci-lint, tofu-controller, bento, crossplane-provider-azure-storage, nri-consul, cis-operator, newrelic-nri-statsd,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: slsa-verifier, nfpm, skaffold, cloudflared, flux-source-controller, terraform-provider-acme, crossplane-provider-azure-storage, wolfictl, opentofu, rancher-agent, ko, crossplane-provider-aws-cloudwatchlogs, k9s, witness, kots, prometheus, tkn, external-dns,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: fuse-overlayfs-snapshotter, slsa-verifier, spark-operator, gitness, golangci-lint, helm-operator, bento, opencost, tofu-controller, newrelic-nri-statsd, wgcf, apache-exporter, cfssl, kapp-controller, kube-logging-operator, nri-f5,...

MAL-2026-10710 Malicious code in @equans-services/codex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d3c5a7e22ef9ecb88e2f6d85ef6132d80098e3e187cbc302de2c45140a5a5f1 This package typosquats @openai/codex under an unofficial scope and ships a postinstall hook package.json line 6: "postinstall": "node setup.js" that...

Malicious code in @equansservices/tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bb693b5ae7f1fccb6c2aaa1a5f9225b23fb7ece3928feca604f2c5139ee5198 The package's postinstall hook node setup.js fetches a platform-specific payload from http://d2vf4rs175cy2k.cloudfront.net/install/v1/plugin.zip over...

MAL-2026-10400 Malicious code in @equansservices/tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bb693b5ae7f1fccb6c2aaa1a5f9225b23fb7ece3928feca604f2c5139ee5198 The package's postinstall hook node setup.js fetches a platform-specific payload from http://d2vf4rs175cy2k.cloudfront.net/install/v1/plugin.zip over...

MAL-2026-10094 Malicious code in @equansservices/setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b071598889a04c74a8398157555ccfffda5bbc713429df4cafbcf48df7f811af package.json declares a postinstall hook node setup.js that fires automatically on npm install. setup.js selects a platform-specific target and fetch...

CVE-2026-13762

Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected. This issue was...

CVE-2026-13762 HTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront with AWS WAF

Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected. This issue was...

CVE-2026-13762 HTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront with AWS WAF

Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected. This issue was...

EUVD-2026-40220

Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected. This issue was...

CVE-2026-13762

Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected. This issue was...

PT-2026-53691

Name of the Vulnerable Software and Affected Versions Amazon CloudFront affected versions not specified Description An inconsistent interpretation of HTTP/2 requests in Amazon CloudFront when AWS WAF is enabled may allow remote actors to bypass managed rule body inspection. This occurs through...

CVE-2026-13762: Inconsistent Interpretation of HTTP Requests

Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected. This issue was...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: falco-no-driver, external-dns, pulumi-language-dotnet, crossplane-fips, crossplane-provider-aws-elbv2-fips, crossplane-provider-azure-powerbidedicated, crossplane-provider-aws-cloudwatch, crossplane-provider-aws-s3, crossplane-provider-aws-athena,...