CVE-2026-101295

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...

Important: Red Hat Security Advisory: OpenShift File Integrity Operator bug fix and enhancement update

An updated OpenShift File Integrity Operator image that fixes various bugs and adds new enhancements is now available for the Red Hat OpenShift Enterprise 4 catalog. The OpenShift File Integrity Operator v1.5.0 is now available. See the documentation for bug fix information:...

EUVD-2026-89959

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...

CVE-2026-101295

The oc-mirror tool is vulnerable to a path traversal and arbitrary file write flaw during the operator catalog image extraction process. When users mirror operator catalogs using the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), the software fails to validate that extracted t...

CVE-2026-101295

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...

sliver-gui

Sliver GUI A desktop operator console for the Sliver C2 framework in the spirit of Cobalt Strike and Havoc. Designed and Developed by Raj Kumar Mullapudi Sliver GUI is a thin Wails v2 Go + plain HTML/CSS/JS frontend over Sliver's existing rpcpb.SliverRPC gRPC service. It reimplements no C2 logic...

chaos-operator

Litmus chaos-operator for injecting chaos experiments on Kubernetes Codacy Badge Litmus chaos operator is used by Kubernetes application developers and SREs to inject chaos into the applications and Kubernetes infrastructure in a managed fashion. Its objective is to make the process of validation...

nebula

Nebula AI Powered Pentesting The Zero Layer workbench Acknowledgement First, I would like to thank Almighty God, who is the source of all knowledge. Without Him, this would not be possible. Nebula brings the working parts of a security engagement into one desktop surface: terminal, code, browser,...

renovate-operator

Renovate: The Kubernetes-Native Way Run Renovate on your own infrastructure with CRD-based scheduling, parallel execution, auto-discovery, and a built-in UI. If you self-host Renovate and already run Kubernetes, this operator gives you the control and observability that plain self-hosted setups...

starboard

Starboard se une a Trivy. Hemos anunciado nuestros planes de discontinuar Starboard y fusionarlo con Trivy. La CLI de Starboard se ha reintroducido como el comando trivy kubernetes y starboard-operator con un enfoque en las capacidades de trivy está disponible como Trivy-Operator. No aceptaremos...

wikipedia-c2

Wikipedia-C2 Wikipedia C2 Blog Post This is a demo project to demonstrate Command and Control utilizing Wikipedia. After Josh Abraham's demo of C2 utilizing Slack and ICMP, I thought I'd explore what other options in the internet's top sites could be used for C2. After reviewing Wikipedia's API, ...

trivy-operator

Kit de herramientas de seguridad nativo de Kubernetes. Documentación Introducción El Trivy Operator aprovecha Trivy para escanear continuamente tu clúster de Kubernetes en busca de problemas de seguridad. Los escaneos se resumen en informes de seguridad como Definiciones de recursos personalizado...

Windmill < 1.603.3 - SQL Injection

Windmill versions 1.276.0 through 1.603.2 contain an authenticated SQL injection vulnerability in the folder owner management endpoint. The addowner API endpoint passes user-supplied input directly into a SQL query without sanitization, enabling JSONB path injection. An authenticated user with...

Windmill < 1.603.3 - Operator Authorization Bypass

Windmill versions 1.276.0 through 1.603.2 contain an authorization bypass vulnerability in the folder management API endpoints. The endpoints for creating, deleting, and managing folder ownership do not enforce role-based access control for operator-level users. In Windmill, operators are...

CLEANSTART-2026-CL14809 When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint

Security vulnerability affects the minio-operator package. When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint...

CVE-2025-51401

Título del Exploit: LiveHelperChat 4. Guarda los...

BackupOperatorToolkit

BackupOperatorToolkit Uso El BackupOperatorToolkit BOT tiene 4 modos diferentes que permiten escalar de Operador de Respaldo a Administrador de Dominio. Ejecute "runas.exe /netonly /user:domain.dk\backupoperator powershell.exe" antes de ejecutar la herramienta. Modo Servicio El modo SERVICIO crea...

Security Bulletin: IBM Maximo Application Suite - Location Service for Esri Component is vulnerable to CVE-2026-18513, CVE-2026-18537, CVE-2026-18529, CVE-2026-18533, CVE-2026-18517 and CVE-2026-88029

Summary IBM Maximo Application Suite - Location Service for Esri Component is vulnerable to CVE-2026-18513, CVE-2026-18537, CVE-2026-18529, CVE-2026-18533, CVE-2026-18517 and CVE-2026-88029 because of CR author can redirect arcgis-admin RoleBinding to own ServiceAccount, CR author can override...

Important: Red Hat Security Advisory: Ansible automation portal (Technology Preview)

Updated images are now available for Red Hat Ansible Automation Platform 2.2, which include new features, bug fixes, and enhancements for the Red Hat Ansible Automation Portal Operator. Red Hat Ansible Automation Platform 2.2 delivers the Automation Portal Operator for managing Ansible Automation...

GeckoDroid

GeckoDroid Cliente móvil para Adaptix C2 Framework. Acceso completo de operador desde tu dispositivo Android. Qué hace GeckoDroid te da control sobre tu servidor Adaptix C2 desde cualquier lugar. En lugar de estar frente al cliente de escritorio, puedes gestionar las operaciones sobre la marcha...