243 matches found
Owasp-top-10-k8s-2025
OWASP Kubernetes Top 10 2025, hands-on A capture-the-flag built on the OWASP Kubernetes Top 10 — 2025. You've been hired to red-team NimbusMart , a fictional e-commerce company whose cluster grew faster than its security. Ten challenges, one per OWASP risk plus a bonus — exploit each weakness,...
kubernetes-goat
Kubernetes Goat ✨ The Kubernetes Goat is designed to be an intentionally vulnerable cluster environment to learn and practice Kubernetes security 🚀 🙌 Refer to https://madhuakula.com/kubernetes-goat for the guide 📖 🧰 Setting up Kubernetes Goat Ensure you have admin access to the Kubernetes cluster...
CVE-2023-5044
CVE-2023-5044 Poc for CVE 2023 5044 Prerequisites Kind: v0.20.0 Kubectl: v1.29.3 Docker: v26.0.0 PoC Give Docker the correct privileges sudo usermod -aG docker $USER && newgrp docker Start the cluster with extraPortMaping and node-labels to prepare it for an ingress. cat EOF | kind create cluster...
CVE-2026-108729
Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download private attachments by setting the URL kind segment to page, icon, or namespace. Attackers who know a private record or module attachment i...
CVE-2026-108729
Versions of Corteza up to 2024.9.10 are vulnerable to an incorrect authorization flaw in the compose attachment endpoints . This vulnerability allows unauthenticated attackers to download private attachments by manipulating the URL kind segment to values such as page, icon, or namespace. If an at...
CVE-2026-108729
Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download private attachments by setting the URL kind segment to page, icon, or namespace. Attackers who know a private record or module attachment i...
PT-2026-110132
Name of the Vulnerable Software and Affected Versions Corteza versions prior to 2024.9.11 Description An incorrect authorization issue exists in the compose attachment endpoints. Unauthenticated attackers can download private attachments by modifying the URL kind segment to page, icon, or...
GO-2026-6607 vulnerabilities
Vulnerabilities for packages: ansible-operator-fips, cloudprober-fips, chronograf, dynamic-localpv-provisioner-fips, nsc-fips, external-secrets-operator-fips, php-fpmexporter, extension-auto-registration-kubernetes-fips, tekton-chains-fips, crossplane-provider-aws-timestreamwrite-fips, rqlite,...
GHSA-F5VF-8PVC-394G vulnerabilities
Vulnerabilities for packages: ansible-operator-fips, cloudprober-fips, chronograf, dynamic-localpv-provisioner-fips, nsc-fips, external-secrets-operator-fips, extension-auto-registration-kubernetes-fips, tekton-chains-fips, crossplane-provider-aws-timestreamwrite-fips, rqlite,...
CVE-2026-56866 vulnerabilities
Vulnerabilities for packages: ansible-operator-fips, cloudprober-fips, chronograf, dynamic-localpv-provisioner-fips, nsc-fips, external-secrets-operator-fips, extension-auto-registration-kubernetes-fips, tekton-chains-fips, crossplane-provider-aws-timestreamwrite-fips, rqlite,...
Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal
Summary Deleting a task relation only requires write access on the base task. Unlike relation creation, it does not verify that the caller can read the other task. A user with write access to one project can therefore delete relations whose other end lives in a project they have no access to. Sin...
GHSA-W2CH-4XGR-22WW Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal
Summary Deleting a task relation only requires write access on the base task. Unlike relation creation, it does not verify that the caller can read the other task. A user with write access to one project can therefore delete relations whose other end lives in a project they have no access to. Sin...
PT-2026-118004
Summary Deleting a task relation only requires write access on the base task. Unlike relation creation, it does not verify that the caller can read the other task. A user with write access to one project can therefore delete relations whose other end lives in a project they have no access to. Sin...
PT-2026-98151
Name of the Vulnerable Software and Affected Versions libical version 4.0.6 Description An incompatible function pointer exists in the icalparameter string to kind function. When parsing iCalendar data that includes a parameterized property, the function passes icalparameter compare kind map to...
PT-2026-109117
libical 4.0.6 contains an incompatible function pointer in icalparameter string to kind. When parsing iCalendar data containing a parameterized property, the function passes icalparameter compare kind map to bsearch through an incompatible comparator function pointer type. bsearch invokes the...
Malicious code in kind-orange-cattle (npm)
Source: amazon-inspector 21dfa396aee0f96c408ef0b25d13b4931192bcaef8908d5c06c1b8954d8e66b9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in kind-ivory-raven (npm)
Source: amazon-inspector 886a79068e6421a20272c79d59baa6c9bb70380233aff6c84d941578f497d565 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in kind-violet-snake (npm)
Source: amazon-inspector d45a9299357bf0f1a96592a661285dbdba348517df5d9dee4e723a316ca17a4b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in kind-plum-mongoose (npm)
Source: amazon-inspector 7b370361900bec6471ac8687765bfce6835d88060599ab751a9bdc5d22eb6756 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in kind-rose-silverfish (npm)
Source: amazon-inspector 1f6896e682c287831b55648206b32b21b6065a454e4d148a738d41def8d7f649 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...