sish

sish Open source SSH tunneling for HTTPS, WSS, TCP, aliases, and SNI. If you like the simplicity of serveo/ngrok-style sharing but want to use plain SSH and run your own infrastructure, sish is built for that. No custom client required for end users Public and private tunnel workflows Docker and...

cloudsploit

CloudSploit by Aqua - Cloud Security Scans Quick Start Generic root@kitploit: $ git clone https://github.com/aquasecurity/cloudsploit.git $ cd cloudsploit $ npm install $ ./index.js -h Docker root@kitploit: $ git clone https://github.com/aquasecurity/cloudsploit.git $ cd cloudsploit $ docker buil...

GATOR

GCP ATTACK TOOLKIT ДЛЯ ИССЛЕДОВАНИЙ В ОБЛАСТИ БЕЗОПАСНОСТИ GATOR - GCP Attack Toolkit for Offensive Research Набор инструментов для атак на GCP в исследовательских целях, инструмент, предназначенный для помощи в исследовании и эксплуатации облачных сред Google Cloud. Он предлагает широкий спектр...

CVE-2026-2472-Vertex-AI-SDK-Google-Cloud

🚨 CVE-2026-2472-Vertex-AI-SDK-Google-Cloud - Простой инструмент для подтверждения концепции 🛠 Об этом приложении Этот инструмент демонстрирует техническое подтверждение концепции PoC для проблемы безопасности CVE-2026-2472. Проблема затрагивает Vertex AI Python SDK от Google Cloud Platform. Она...

hayat

Hayat Скрипт аудита и усиления защиты Google Cloud Platform & Что означает «Hayat»? Что ж, честно говоря, мне было трудно найти уникальное имя. «Hayat» — турецкое слово, которое означает «Жизнь» на английском, а также имя моей племянницы. Готовы познакомиться с ней? 😍 😍 😍 Hayat — это скрипт аудит...

kubebot

Kubebot A security testing Slackbot built with a Kubernetes backend on the Google Cloud Platform NOTE: I am not actively maintaining this project anymore. I am working on v2 of Kubebot along with a couple other folks which will likely be presented at one of the upcoming security conferences...

kubebot

Kubebot Slackbot для тестирования безопасности, построенный на бэкенде Kubernetes в Google Cloud Platform ПРИМЕЧАНИЕ: Я больше не поддерживаю этот проект активно. Я работаю над версией 2 Kubebot вместе с несколькими другими людьми, которая, вероятно, будет представлена на одной из предстоящих...

offensive-docker

Offensive Docker — это образ с наиболее популярными инструментами для быстрого и простого создания среды пентеста. ➡️ Примечание: Ознакомьтесь со следующим репозиторием, чтобы узнать, как запустить offensive docker на VPS в Google Cloud Platform или Digital Ocean включает бесплатный кредит...

CVE-2026-84445

creationtimestamp| type| source ---|---|--- 2026-09-20 05:20:08+00:00| seen| https://bsky.app/profile/gcpweekly.bsky.social/post/3mvwh6p7ulh2c 2026-09-20 05:20:10+00:00| seen| https://bsky.app/profile/gcpweekly.bsky.social/post/3mvwh6pfjye2s 2026-09-20 05:20:14+00:00| seen|...

CVE-2026-19486 SSRF in Gemini Enterprise Agent Platform App Builder

A Server-Side Request Forgery SSRF vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions prior to 2026-06-01 on Google Cloud Platform allows an unauthenticated attacker to leak the Compute Engine default service account access token. This vulnerability was patched on...

CVE-2026-5704

creationtimestamp| type| source ---|---|--- 2026-08-26 22:40:09+00:00| seen| https://bsky.app/profile/gcpweekly.bsky.social/post/3mtzfnd3gcu2n 2026-08-26 22:40:12+00:00| seen| https://bsky.app/profile/gcpweekly.bsky.social/post/3mtzfndatp327 2026-08-26 22:40:13+00:00| seen|...

CVE-2026-19485

A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictab...

EUVD-2026-66653

A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictab...

CVE-2026-12717 Remote Code Execution in BigQuery Data Transfer Service via JDBC Connection String Injection

An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 on Google Cloud Platform allows an authenticated attacker to achieve remote code execution in the connector container and escalate privileges in...

EUVD-2026-60060

A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps Chronicle SOAR versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to execute blind SQL queries using a crafted request parameter. This vulnerability was patched in version...

CVE-2026-15587

Improper Privilege Management in Google SecOps Chronicle SOAR versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to escalate privileges to system-level administrative access using a crafted internal authentication header. This vulnerability was patched with version...

EUVD-2026-53390

Improper Privilege Management in Google SecOps Chronicle SOAR versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to escalate privileges to system-level administrative access using a crafted internal authentication header. This vulnerability was patched with version...

Malicious code in @cacheable/node-cache (npm)

npm/@cacheable/node-cache version 3.1.2 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases...

CVE-2026-67349 OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

PT-2026-66499

Name of the Vulnerable Software and Affected Versions OpenCost versions prior to 1.121.0 Description Authentication is not properly enforced for the 'GET /helmValues' endpoint, which exposes the base64-decoded HELM VALUES environment variable containing cloud provider credentials. Furthermore, th...