kratosminifilter

🛡️ Kratos Minifilter — Windows 内核级反勒索软件驱动程序 防御性安全研究项目 — 用 C++ 开发的 Windows 微过滤器驱动程序，用于在内核态 Ring 0 实时检测和消除勒索软件。 📋 目录 概述 架构 检测机制 基于指纹的黑名单 安装 配置 限制 法律警告 概述 Kratos Kratos.sys 是一个 Windows 微过滤器驱动程序，通过筛选器管理器 fltmgr.sys 运行在海拔 425342 （反病毒层级）。与基于静态签名的防病毒解决方案不同，Kratos 采用纯行为 方法： 无签名数据库 — 检测未知勒索软件 内核模式 —...

kratos

聊天 · 讨论 · 新闻邮件 · 文档 · 试用Ory Network · 工作机会 Ory Kratos 是一个面向云原生应用的 API 优先身份与用户管理系统。它将登录、注册、恢复、验证和配置文件管理流程集中起来，让你的服务可以直接使用它们，而无需重新实现。 目录 什么是 Ory Kratos？ 为什么选择 Ory Kratos 从 Auth0、Okta 及类似提供商迁移 部署选项 在 Ory Network 上使用 Ory Kratos 自托管 Ory Kratos 快速开始 谁在使用它？ 什么是 Ory Kratos？ Ory Kratos 是一个遵循 云架构最佳实践 的 API...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: docker-credential-acr-env, ops-agent, crossplane-provider-aws-appautoscaling-fips, aws-sigv4-proxy-fips, prometheus-redis-exporter, gitleaks-fips, crossplane-provider-aws-chime, crossplane-provider-aws-organizations, crossplane-provider-aws-kinesisvideo-fips,...

GO-2026-5410 vulnerabilities

Vulnerabilities for packages: argo-cd, atlantis, ory-kratos, bento-fips, kubernetes-event-exporter-fips, goreleaser, ory-kratos-fips, peerdb-flow, kubewatch, kyverno-policy-reporter, atlantis-fips, argo-rollouts-fips, kubernetes-event-exporter, argo-cd-fips, argo-rollouts,...

GO-2026-5471 Kratos has a Confused Deputy issue in github.com/go-kratos/kratos

Kratos has a Confused Deputy issue in github.com/go-kratos/kratos...

GHSA-GXHX-2686-5H9G vulnerabilities

Vulnerabilities for packages: argo-cd, atlantis, ory-kratos, bento-fips, kubernetes-event-exporter-fips, goreleaser, ory-kratos-fips, peerdb-flow, kubewatch, kyverno-policy-reporter, atlantis-fips, argo-rollouts-fips, kubernetes-event-exporter, argo-cd-fips, argo-rollouts,...

CVE-2026-42300

DevGuard provides vulnerability management for the full software supply chain. Prior to 1.2.2, the SessionMiddleware accepts a client-supplied X-Admin-Token HTTP request header and uses its raw string value as the authenticated userID when no Kratos session cookie is present. An unauthenticated...

CVE-2026-42300

CVE-2026-42300 affects DevGuard’s SessionMiddleware and related components prior to version 1.2.2. The vulnerability arises because a client-supplied header, X-Admin-Token , is accepted and its raw value is used as the authenticated userID when no Kratos session cookie is present. An attacker who...

CVE-2026-42300 DevGuard: Unauthenticated identity assertion via `X-Admin-Token` header

DevGuard provides vulnerability management for the full software supply chain. Prior to 1.2.2, the SessionMiddleware accepts a client-supplied X-Admin-Token HTTP request header and uses its raw string value as the authenticated userID when no Kratos session cookie is present. An unauthenticated...

devguard 安全漏洞

Devguard is a software supply chain vulnerability management platform developed by L3montree. Versions prior to 1.2.2 of Devguard contained security vulnerabilities. These vulnerabilities stemmed from SessionMiddleware accepting the X-Admin-Token HTTP request header provided by clients. When no...

CVE-2026-41889 vulnerabilities

Vulnerabilities for packages: step-issuer-fips, teleport, kube-bench, keda, rke2-runtime-fips, trillian-fips, peerdb-flow, gitaly-fips, sftpgo-plugin-eventsearch, migrate, openfga-fips, azure-service-operator-fips, openbao-fips, temporal, hydra-fips, grafana-alloy, gitlab-elasticsearch-indexer,...

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the SessionMiddleware process when the X-Admin-Token HTTP header is accepted from the client and its raw value is used as the authenticated user ID if no Kratos session cookie ...

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the SessionMiddleware process when the X-Admin-Token HTTP header is accepted from the client and its raw value is used as the authenticated user ID if no Kratos session cookie ...

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the SessionMiddleware process when the X-Admin-Token HTTP header is accepted from the client and its raw value is used as the authenticated user ID if no Kratos session cookie ...

Linux Distros Unpatched Vulnerability : CVE-2026-6993

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security flaw has been discovered in go-kratos kratos up to 2.9.2. This impacts the function NewServer of the file transport/http/server.go of the component...

CVE-2026-6993

A flaw was found in go-kratos kratos. A remote attacker could exploit a vulnerability in the HTTP server's NewServer function, specifically within the http.DefaultServeMux Fallback Handler. This manipulation creates an unintended intermediary, which can lead to the disclosure of sensitive...

GHSA-JJ45-XVQ5-RHH9 Kratos has a Confused Deputy issue

A security flaw has been discovered in go-kratos kratos up to 2.9.2. This impacts the function NewServer of the file transport/http/server.go of the component http.DefaultServeMux Fallback Handler. The manipulation results in unintended intermediary. The attack may be launched remotely. The explo...

Kratos has a Confused Deputy issue

A security flaw has been discovered in go-kratos kratos up to 2.9.2. This impacts the function NewServer of the file transport/http/server.go of the component http.DefaultServeMux Fallback Handler. The manipulation results in unintended intermediary. The attack may be launched remotely. The explo...

CVE-2026-6993

A security flaw has been discovered in go-kratos kratos up to 2.9.2. This impacts the function NewServer of the file transport/http/server.go of the component http.DefaultServeMux Fallback Handler. The manipulation results in unintended intermediary. The attack may be launched remotely. The explo...

CVE-2026-6993

A security flaw has been discovered in go-kratos kratos up to 2.9.2. This impacts the function NewServer of the file transport/http/server.go of the component http.DefaultServeMux Fallback Handler. The manipulation results in unintended intermediary. The attack may be launched remotely. The explo...