trivy-action

Trivy Action GitHub Action for Trivy Table of Contents Usage Scan CI Pipeline Scan CI Pipeline w/ Trivy Config Cache Trivy Setup Scanning a Tarball Using Trivy with templates Using Trivy with GitHub Code Scanning...

trivy

📖 Documentation Trivy（发音）是一个全面且多功能的扫描器。Trivy拥有用于发现安全问题的 扫描器 ，以及可以找到这些问题的 目标 。 目标（Trivy可以扫描的对象）： 容器镜像 文件系统 Git仓库（远程） 虚拟机镜像 Kubernetes 扫描器（Trivy可在其中发现的问题）： 操作系统包及正在使用的软件依赖（SBOM） 已知漏洞（CVE） IaC问题与错误配置 敏感信息和密钥 软件许可证 Trivy支持绝大多数主流编程语言、操作系统和平台。完整列表请参阅扫描覆盖范围页面。 了解更多信息，请访问Trivy主页查看功能亮点，或前往文档网站获取详细内容。 快速开始...

dockle

Dockle - 用于安全的容器镜像检查工具，帮助构建最佳实践的Docker镜像，易于上手 Dockle 帮助你： 1. 构建最佳实践的Docker镜像 2. 构建安全的Docker镜像 检查点包括CIS基准bash $ brew untap goodwithtech/dockle who use 0.1.16 or older version $ brew install goodwithtech/r/dockle $ dockle YOURIMAGENAME root@kitploit: 参见 安装 和 常见示例 检查点对比 目录 - 特性 - 对比 - 安装 - Homebrew...

cve-2018-17207

CVE-2018-17207 这是Cved的一部分： 一个管理易受攻击的Docker容器的工具。 Cved：https://github.com/git-rep-src/cved 图片来源：https://github.com/cved-sources/cve-2018-17207 图片作者：https://github.com/cved-sources/cve-2018-17207...

cve-2016-7434

CVE-2016-7434 这是Cved的一部分： 一个管理易受攻击的Docker容器的工具。 Cved: https://github.com/git-rep-src/cved 镜像来源：https://github.com/cved-sources/cve-2016-7434 镜像作者：https://github.com/opsxcq/exploit-CVE-2016-7434...

whoc

whoc A container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform! WhoC at Defcon 29 Cloud Village Azurescape - whoc-powered research, the first cross-account container takeover i...

whoc

whoc 一个容器镜像，用于提取底层容器运行时并将其发送到远程服务器。 探探您最喜欢的CSP容器平台的底层容器运行时！ WhoC在Defcon 29 Cloud Village上的演讲 Azurescape - 基于whoc的研究，首次实现公有云中的跨账户容器接管（奖金70,000美元） 它是如何工作的？ 正如runc CVE-2019-5736所示，传统的Linux容器运行时通过/proc/self/exe向其所运行的容器暴露自身。whoc利用这一链接读取正在执行它的容器运行时。 动态模式 这是whoc的默认模式，适用于动态链接的容器运行时。 1...

anchore-engine

Anchore Engine 重要提示 自2023年起，Anchore Engine 已不再维护。未来将不再发布新版本。建议用户使用 Syft 和 Grype。 对于希望获得受支持的商用容器扫描与合规解决方案的用户，请预约演示，了解 Anchore Enterprise 广泛的企业级能力，包括 SBOM 管理、漏洞管理和合规管理。 关于 Anchore Engine 是一个开源项目，提供容器镜像的检查、分析和认证的集中式服务。Anchore Engine 以 Docker 容器镜像形式提供，可独立运行或运行在 Kubernetes、Docker Swarm、Rancher、Amazon...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.70 bug fix and security update

Red Hat OpenShift Container Platform release 4.16.70 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...

EUVD-2026-75321

A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking krun.usepasst, crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun = 1.29...

GitLeaks

GitLeaks 容器镜像 针对本地工作流和流水线中秘密扫描的定制化 gitleaks 构建。 特性 从标记的上游源码构建 gitleaks，并固定 Go 工具链以生成可复现的二进制文件。 GitLab CI 组件位于 niclas-zone/ci/gitleaks。 使用 拉取镜像 root@kitploit: podman pull registry.gitlab.com/niclas-zone/ctr/gitleaks:latest 运行扫描 root@kitploit: podman run --rm \ -v $pwd:/repo \ -w /repo ...

nginx-cve-fix

Nginx CVE 修复 - 用于 nginx:1.25-bookworm 的源构建即插即用替换 一个源构建的 nginx 1.25.5 容器镜像，它修复了官方 nginx:1.25-bookworm 镜像中存在的两个 CVE，同时保留了上游运行时行为。 CVE| 组件| 严重程度| 技术| 验证模型 ---|---|---|---|--- CVE-2024-6119| OpenSSL / libssl3| 高| 依赖版本升级| 扫描器可验证：libssl3 3.0.20 在 dpkg 数据库中可见 CVE-2026-42945| nginx ngxhttprewritemodule|...

dasel-melange-apko

dasel v3.3.1 — Melange + apko 构建，已针对 CVE-2026-33320 打补丁 本仓库将 dasel CLI（v3.3.1）打包为 使用 Melange 构建的 APK，使用 apko 构建一个最小容器镜像，并应用针对 CVE-2026-33320 的修复，同时保持在 v3.3.1 代码库上（补丁方式，而非版本升级）。 结果是一个约 4 MB 的镜像，仅包含静态的 dasel 二进制文件——没有 shell、没有包 管理器、没有 libc——并且以非 root 用户运行。 仓库结构 root@kitploit: melange/ dasel.yaml...

Important: Red Hat Security Advisory: General availability of the satellite/iop-host-inventory-frontend-rhel9 container image

A new satellite/iop-host-inventory-frontend-rhel9 container image is now generally available in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running...

Important: Red Hat Security Advisory: Technical preview of the satellite/iop-vmaas-rhel9 container image

A new satellite/iop-vmaas-rhel9 container image is now available as a technical preview in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running...

Important: Red Hat Security Advisory: General availability of the satellite/iop-remediations-rhel9 container image

A new satellite/iop-remediations-rhel9 container image is now generally available in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, an...

Important: Red Hat Security Advisory: General availability of the satellite/iop-remediations-rhel9 container image

A new satellite/iop-remediations-rhel9 container image is now generally available in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, an...

Important: Red Hat Security Advisory: General availability of the satellite/iop-host-inventory-frontend-rhel9 container image

A new satellite/iop-host-inventory-frontend-rhel9 container image is now generally available in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running...

Important: Red Hat Security Advisory: Technical preview of the satellite/iop-vmaas-rhel9 container image

A new satellite/iop-vmaas-rhel9 container image is now available as a technical preview in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running...

Important: Red Hat Security Advisory: satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview

A new satellite/iop-vulnerability-engine-rhel9 container image is now available as a Technology Preview in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages...