atomic-red-team

Atomic Red Team Atomic Red Team™ is a library of tests mapped to the MITRE ATT&CK® framework. Security teams can use Atomic Red Team to quickly, portably, and reproducibly test their environments. Get started You can execute atomic tests directly from the command line, no installation required. S...

Platypus

Platypus A host management hub for fleets of Linux machines. Install the Platypus agent on every host you own; the agent dials back to your Platypus server over TLS + protobuf; from the server you get an interactive shell, file management, and network tunnelling on every managed host — through on...

CVE-2026-13768

CVE-2026-13768: Privileged IoT Hub Credential — Fleet Enumeration, Device RCE, and Home-Network Pivot Advisory Field| Value ---|--- CVE| CVE-2026-13768 ICSA| ICSA-26-183-03 Gardyn IoT Hub CVSS 3.1| 10.0 Critical Vector 3.1| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L Vector 4.0|...

CVE-2026-126402

Versions of Fleet before 4.89.0 are vulnerable to a broken access control flaw within the user administration API . The root cause is an incorrect authorization check that allows the API to accept user creation or modification requests if the caller administers at least one assigned team. Exploit...

EUVD-2026-125164

Fleet before 4.86.2 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory through quadratic XML canonicalization of unsigned SAML responses. Attackers can send a single crafted SAML response with deeply nested elements declaring new namespace...

CVE-2026-126402 Fleet before 4.89.0 Broken Access Control via User Administration API

Fleet before 4.89.0 contains an incorrect authorization flaw in its user administration API that accepts user creation or modification when the caller administers any one of the assigned teams. Authenticated team administrators can grant users administrator roles on other teams, then deploy...

CVE-2026-126401

Versions of Fleet prior to 4.86.2 are vulnerable to an unauthenticated Denial of Service (DoS) attack. The root cause is quadratic XML canonicalization of unsigned SAML responses. An attacker can crash the Fleet server by sending a single crafted SAML response containing deeply nested elements wi...

EUVD-2026-125163

Fleet before 4.89.0 contains an incorrect authorization flaw in its user administration API that accepts user creation or modification when the caller administers any one of the assigned teams. Authenticated team administrators can grant users administrator roles on other teams, then deploy...

CVE-2026-126401 Fleet before 4.86.2 Unauthenticated DoS via SSO Callback XML Canonicalization

Fleet before 4.86.2 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory through quadratic XML canonicalization of unsigned SAML responses. Attackers can send a single crafted SAML response with deeply nested elements declaring new namespace...

fleet-cve-scanner

fleet-cve-scanner An open-source, single-script CVE scanner for RMM-managed fleets. Pure PowerShell 7, no agents, no appliances, no license fees. It answers one question for every piece of software on every endpoint you manage: is the installed version known to be vulnerable, and how urgent is it...

shadow-fleet-tracker-light

Shadow Fleet Tracker Light Baltic Sea shadow fleet monitoring via live AIS data. Watches 1200+ vessels from the Ukrainian GUR War&Sanctions catalogue against the AISStream WebSocket feed, plots positions on a self-updating map, flags proximity to undersea cables, and detects Russia↔West...

EU_compliance_MCP

EU Regulations MCP Server ⚰️ RETIRED — folded into ansvar-mcp-fleet 2026-07-07 This standalone repo is archived. The eu-regulations corpus now lives at Ansvar-Systems/ansvar-mcp-fleet under mcps/eu-regulations/ fold: fleet PR 594; cutover: deploy PR 653, live 2026-07-07. Production serves the...

CVE-2026-115714

Improper Certificate Validation CWE-295 in the operating system certificate bundle shipped in the Docker images of APM Server; Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat; Elastic Agent, including Fleet Server and Cloudbeat; Logstash, for TLS connections that use the operating syste...

CVE-2026-115294

Improper Limitation of a Pathname to a Restricted Directory CWE-22 in the Kibana Fleet feature can lead to unauthorized resource deletion via Path Traversal CAPEC-126. A low-privileged user with Fleet agent policies write access could cause a subsequent administrative action to act on unintended...

CVE-2026-115714 Improper Certificate Validation in Elastic Docker Images Leading to Interception of TLS Connections

Improper Certificate Validation CWE-295 in the operating system certificate bundle shipped in the Docker images of APM Server; Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat; Elastic Agent, including Fleet Server and Cloudbeat; Logstash, for TLS connections that use the operating syste...

EUVD-2026-116082

Improper Certificate Validation CWE-295 in the operating system certificate bundle shipped in the Docker images of APM Server; Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat; Elastic Agent, including Fleet Server and Cloudbeat; Logstash, for TLS connections that use the operating syste...

CVE-2026-115714

Several Elastic products shipped in Docker images are vulnerable to Improper Certificate Validation (CWE-295) due to a compromised third-party dependency. The operating system certificate bundle includes root CAs that signed eight eMudhra intermediate CAs with compromised private keys. This allow...

EUVD-2026-116075

Improper Limitation of a Pathname to a Restricted Directory CWE-22 in the Kibana Fleet feature can lead to unauthorized resource deletion via Path Traversal CAPEC-126. A low-privileged user with Fleet agent policies write access could cause a subsequent administrative action to act on unintended...

CVE-2026-115294 Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Resource Deletion

Improper Limitation of a Pathname to a Restricted Directory CWE-22 in the Kibana Fleet feature can lead to unauthorized resource deletion via Path Traversal CAPEC-126. A low-privileged user with Fleet agent policies write access could cause a subsequent administrative action to act on unintended...

CVE-2026-115294 Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Resource Deletion

Improper Limitation of a Pathname to a Restricted Directory CWE-22 in the Kibana Fleet feature can lead to unauthorized resource deletion via Path Traversal CAPEC-126. A low-privileged user with Fleet agent policies write access could cause a subsequent administrative action to act on unintended...