vex8s

Vex8s （此 logo 并非 AI 生成） Vex8s 通过将容器漏洞与 Kubernetes 设置相关联，生成 VEX 文档，以确定哪些 CVE 在您的集群中实际可被利用。 请注意，这是一个实验性项目。情况可能会迅速变化。 工作原理 该项目旨在通过结合漏洞分类和 securityContext 分析，评估 Kubernetes 工作负载中已知 CVE 的可利用性。 它基于以下概念： 每个 CVE 被归类为一个或多个漏洞类别（CWE） CVE 描述由嵌入式 ML 模型处理，以预测其 利用类别。 将 CWE 和预测的 利用类别 结合起来，以确定该 CVE 是否可被缓解。 每个 利用类别...

opa

Open Policy Agent Open Policy Agent OPA is an open source, general-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack. OPA is proud to be a graduated project in the Cloud Native Computing Foundation CNCF landscape. For details read the CNCF...

starboard

Starboard 正在加入 Trivy。 我们已宣布计划停止 Starboard 并将其合并到 Trivy 中。 Starboard CLI 已重新引入为 trivy kubernetes 命令，而专注于 trivy 能力的 starboard-operator 可作为 Trivy-Operator 使用。 我们将不再接受新功能/拉取请求/问题。 我们鼓励您为 Trivy-Operator 和 Trivy CLI 做出贡献，并影响 Trivy Kubernetes 的未来。 有关更多信息，请参阅 讨论 查看最新：Trivy 下一步问答 Kubernetes 原生安全工具包。 简介...

kubernetes-goat

Kubernetes Goat ✨ Kubernetes Goat 旨在成为一个故意存在漏洞的集群环境，用于学习和实践 Kubernetes 安全性 🚀 🙌 请参阅 https://madhuakula.com/kubernetes-goat 获取指南 📖 🧰 设置 Kubernetes Goat 确保你拥有集群的管理员权限并安装了 kubectl。请参阅 安装文档 确保你安装了 helm 包管理器。请参阅 安装文档 要在你的集群中设置 Kubernetes Goat 资源，运行以下命令： git clone...

tarian

Tarian 通过预先注册受信任的进程和受信任的文件签名，保护运行在 Kubernetes 上的应用程序免受恶意攻击。Tarian 会检测未知进程和对已注册文件的更改，然后发送告警并采取自动化操作。保护您的 K8s 环境免受勒索软件侵害！ 我们希望将此项目作为开源项目维护，以对抗针对我们最喜爱的 Kubernetes 生态系统的攻击。通过持续贡献，我们可以作为社区共同应对威胁。 Tarian 是如何工作的？ Tarian 集群代理运行在 Kubernetes 集群中，检测未知进程和对文件的未知更改，将其报告给 Tarian 服务器，并可选择采取操作：删除违规的 Pod。它使用 eBPF...

stackrox

Tabla de Contenidos Plataforma de Seguridad Kubernetes de StackRox Tabla de Contenidos Comunidad Despliegue de StackRox Instalación Rápida usando Helm Instalación Manual usando Helm Instalación usando el Operador Instalación mediante Scripts Distribuciones de Kubernetes EKS, AKS, GKE OpenShift...

kstg

OWASP KSTG OWASP Kubernetes 安全测试指南 我们的愿景 创建一份全面的 Kubernetes 集群安全评估手册 我们正在创建一份全面的 Kubernetes 集群安全评估测试指南，涵盖自上而下的集群安全评估方法。该指南包含 methodologies（方法论）、tools（工具）、techniques（技术）和 procedures（流程，TTP），以执行可让测试人员交付一致且完整结果的评估。 OWASP 项目 https://owasp.org/www-project-kubernetes-security-testing-guide/ 构建书籍...

stackrox v4.11.4-rc.1

Table of Contents StackRox Kubernetes Security Platform Table of Contents Community Deploying StackRox Quick Installation using Helm Manual Installation using Helm Installation using the Operator Installation via Scripts Kubernetes Distributions EKS, AKS, GKE OpenShift Docker Desktop, Colima, or...

kubescape v4.0.13

Kubescape Comprehensive Kubernetes Security from Development to Runtime Kubescape is an open-source Kubernetes security platform that pr...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: tw, oras, cert-manager-cmctl, argocd-image-updater, opentofu, rancher-helm, trivy-operator, k8ssandra-client, helm, trivy, helm-push, rancher, steampipe, eksctl, ratify, gitness, rancher-fleet, zarf, k9s, maru, kyverno, linkerd2, gatekeeper, manifest-tool, vcluster,...

CVE-2026-9165

Summary : A flaw in Red Hat Advanced Cluster Security for Kubernetes (RHACS) Central allows unbounded GraphQL query depth on the authenticated GraphQL API, enabling a token-authenticated user to issue deeply nested queries that exhaust resources and cause a denial of service to the management pla...

EUVD-2026-36287

mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to version 3.7.0, the kubectlgeneric tool in mcp-server-kubernetes passes user-supplied flags directly to kubectl without any allowlist, enabling a privilege escalation attack within Kubernetes...

CVE-2026-50570

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, Fission added PodSpec safety validation for tenant-facing Environment and Function CRDs ValidatePodSpecSafety /...

CVE-2026-46618 Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executables

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, before the round-1 security sweep, pkg/builder/builder.go passed Environment.spec.builder.command directly into exec.Command...

SUSE-SU-2026:2339-1 Security update for kubernetes1.27

This update for kubernetes1.27 fixes the following issues - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265740. - CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial of service...

PT-2026-46125

Name of the Vulnerable Software and Affected Versions Jupyter Enterprise Gateway versions 2.0.0rc2 through 3.2.x Description Environment variables used during the rendering of the Kubernetes manifest are vulnerable to Server Side Template Injection SSTI, a flaw where an attacker injects malicious...

Kubernetes Security Scanning: A DevSecOps Guide

A clean container image is not proof of a secure Kubernetes workload. New CVEs, unsafe configurations, and excessive permissions can turn an approved deployment into an active exposure. Contact Hive Pro to review your Kubernetes container security priorities. Kubernetes security scanning is the...

GHSA-FQW6-GF59-QR4W containerd user ID handling bypass allows runAsNonRoot evasion

Impact A bug was found in containerd where containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username. If a crafted image provides an /etc/passwd file mapping this large numeric string to root, the container ultimately runs as...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' via improper handling of numeric User directives in container configuration. An attacker can gain elevated privileges by supplying a crafted image with an /etc/passwd file that...

SPARK: Secure Predictive Autoscaling for Robust Kubernetes

Achieving high availability and robust security in Kubernetes requires more than reactive scaling and standard perimeter firewalls. Traditional autoscalers, such as HPA, often fail to react quickly to traffic spikes and cannot distinguish between legitimate flash crowds and DDoS attacks. We prese...