vex8s

Vex8s this logo is not AI generated Vex8s generates VEX documents by correlating container vulnerabilities with Kubernetes settings to determine which CVEs are actually exploitable in your cluster. Please note, this is an experimental project. Things might change quickly. How It Works The project...

starboard

Starboard is joining Trivy. We've announced our plans to discontinue Starboard and merge it into Trivy. Starboard CLI has been reintroduced as trivy kubernetes command and starboard-operator with a focus on trivy capabilities is available as Trivy-Operator. We will not be accepting new...

opa

Open Policy Agent Open Policy Agent OPA is an open source, general-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack. OPA is proud to be a graduated project in the Cloud Native Computing Foundation CNCF landscape. For details read the CNCF...

kstg

OWASP KSTG OWASP Kubernetes Security Testing Guide Our Vision Create a comprehensive manual for Kubernetes Cluster Security Assessment We are creating a comprehensive testing guide for Kubernetes cluster security assessment that covers a top down approach to assess the security of a cluster. The...

stackrox

Table of Contents StackRox Kubernetes Security Platform Table of Contents Community Deploying StackRox Quick Installation using Helm Manual Installation using Helm Installation using the Operator Installation via Scripts Kubernetes Distributions EKS, AKS, GKE OpenShift Docker Desktop, Colima, or...

tarian

Tarian Protégez vos applications exécutées sur Kubernetes contre les attaques malveillantes en pré-enregistrant vos processus de confiance et les signatures de fichiers de confiance. Tarian détectera les processus inconnus et les modifications des fichiers enregistrés, puis enverra des alertes et...

kubernetes-goat

Kubernetes Goat ✨ Kubernetes Goat est un environnement de cluster intentionnellement vulnérable conçu pour apprendre et pratiquer la sécurité Kubernetes 🚀 🙌 Consultez https://madhuakula.com/kubernetes-goat pour le guide 📖 🧰 Configuration de Kubernetes Goat Assurez-vous d'avoir un accès...

stackrox v4.11.4-rc.1

Table of Contents StackRox Kubernetes Security Platform Table of Contents Community Deploying StackRox Quick Installation using Helm Manual Installation using Helm Installation using the Operator Installation via Scripts Kubernetes Distributions EKS, AKS, GKE OpenShift Docker Desktop, Colima, or...

kubescape v4.0.13

Kubescape Comprehensive Kubernetes Security from Development to Runtime Kubescape is an open-source Kubernetes security platform that pr...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: eksctl, maru, kyverno, conftest, teleport, chartmuseum, gogatekeeper, consul-k8s, xeol, kargo, k9s, kubescape, tigera-operator, tw, helm-set-status, k8ssandra-client, trivy-operator, argocd-image-updater, opentofu, ratify, helm-mapkubeapis, kube-arangodb,...

CVE-2026-9165

Summary : A flaw in Red Hat Advanced Cluster Security for Kubernetes (RHACS) Central allows unbounded GraphQL query depth on the authenticated GraphQL API, enabling a token-authenticated user to issue deeply nested queries that exhaust resources and cause a denial of service to the management pla...

EUVD-2026-36287

mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to version 3.7.0, the kubectlgeneric tool in mcp-server-kubernetes passes user-supplied flags directly to kubectl without any allowlist, enabling a privilege escalation attack within Kubernetes...

CVE-2026-50570

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, Fission added PodSpec safety validation for tenant-facing Environment and Function CRDs ValidatePodSpecSafety /...

CVE-2026-46618 Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executables

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, before the round-1 security sweep, pkg/builder/builder.go passed Environment.spec.builder.command directly into exec.Command...

SUSE-SU-2026:2339-1 Security update for kubernetes1.27

This update for kubernetes1.27 fixes the following issues - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265740. - CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial of service...

PT-2026-46125

Name of the Vulnerable Software and Affected Versions Jupyter Enterprise Gateway versions 2.0.0rc2 through 3.2.x Description Environment variables used during the rendering of the Kubernetes manifest are vulnerable to Server Side Template Injection SSTI, a flaw where an attacker injects malicious...

Kubernetes Security Scanning: A DevSecOps Guide

A clean container image is not proof of a secure Kubernetes workload. New CVEs, unsafe configurations, and excessive permissions can turn an approved deployment into an active exposure. Contact Hive Pro to review your Kubernetes container security priorities. Kubernetes security scanning is the...

GHSA-FQW6-GF59-QR4W containerd user ID handling bypass allows runAsNonRoot evasion

Impact A bug was found in containerd where containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username. If a crafted image provides an /etc/passwd file mapping this large numeric string to root, the container ultimately runs as...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' via improper handling of numeric User directives in container configuration. An attacker can gain elevated privileges by supplying a crafted image with an /etc/passwd file that...

SPARK: Secure Predictive Autoscaling for Robust Kubernetes

Achieving high availability and robust security in Kubernetes requires more than reactive scaling and standard perimeter firewalls. Traditional autoscalers, such as HPA, often fail to react quickly to traffic spikes and cannot distinguish between legitimate flash crowds and DDoS attacks. We prese...