AI-SPM

Orbyx AI SPM - AI安全态势管理 AI安全态势管理（AI-SPM）是一种维护人工智能（AI）和机器学习（ML）系统安全与完整性的全面方法。它涉及对AI模型、数据和基础设施的安全态势进行持续监控、评估和改进。AI-SPM包括识别和解决与AI采用相关的漏洞、错误配置和潜在风险，以及确保遵守相关的隐私和安全法规。 这个开源项目致力于实现企业级AI-SPM。通过这样做，组织可以主动保护其AI系统免受威胁，最大限度地减少数据暴露，并维护其AI应用程序（代理、MPC服务器、模型等）的可信度。 您的组织正在全力投入AI应用程序——您准备好保护它们了吗？ 在回答之前，请思考以下具体问题：...

cicd-goat

一个故意存在漏洞的CI/CD环境。 破解CI/CD管道，夺取旗帜。🚩 由Cider Security创建 被Palo Alto Networks收购。 目录 描述 下载与运行 Linux & Mac Windows Powershell 使用说明 说明 接受挑战 故障排除 解决方案 贡献 描述 CI/CD Goat 项目让工程师和安全从业者通过一系列11个挑战来学习和实践CI/CD安全，这些挑战是在一个真实的、完整的CI/CD环境中进行的。每个场景难度不同，且每个场景侧重于一个主要的攻击向量。 这些挑战涵盖了 Top 10 CI/CD...

CLEANSTART-2026-VH25364 Security fixes in tekton-pipelines-fips 1.14.0-r3

Package tekton-pipelines-fips version 1.14.0-r3 fixes 1 vulnerabilities: ghsa-hrxh-6v49-42gf...

CVE-2026-44220

ciguard is a static security auditor for CI/CD pipelines. From 0.8.0 to 0.8.1 , the discoverpipelinefiles function in src/ciguard/discovery.py walks a directory tree following symlinks, with cycle protection via tracking visited resolved paths. An attacker who can plant a symlink in a directory t...

Exploit for Out-of-bounds Write in Netapp Bootstrap_Os

Typeform DevSecOps Pipeline POC !Pythonhttps://img.shields...

CVE-2025-61916

Spinnaker is an open source, multi-cloud continuous delivery platform. Versions prior to 2025.1.6, 2025.2.3, and 2025.3.0 are vulnerable to server-side request forgery. The primary impact is allowing users to fetch data from a remote URL. This data can be then injected into spinnaker pipelines vi...

How To Build Ransomware-Resilient AI Data Pipelines: A Practical Guide for Modern Enterprises

Modern enterprises depend on AI data pipelines for analytics and automated decision-making. As these pipelines become more integrated…...

EUVD-2022-0764

Malicious code in bioql PyPI...

EUVD-2022-4698

Malicious code in bioql PyPI...

CVE-2023-30623

embano1/wip is a GitHub Action written in Bash. Prior to version 2, the embano1/wip action uses the github.event.pullrequest.title parameter in an insecure way. The title parameter is used in a run statement - resulting in a command injection vulnerability due to string interpolation. This...

Do We Really Need The OWASP NHI Top 10?

The Open Web Application Security Project has recently introduced a new Top 10 project - the Non-Human Identity NHI Top 10. For years, OWASP has provided security professionals and developers with essential guidance and actionable frameworks through its Top 10 projects, including the widely used...

GHSA-V8MX-HP2Q-GW85 Golang SDK for Vela Insecure Variable Substitution

Impact Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expose secrets without the use of the commands block...

GHSA-69P4-J5V5-X234 Server/API for Vela Insecure Variable Substitution

Impact Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expose secrets without the use of the commands block...

GHSA-7V38-W32M-WX4M Types for Vela Insecure Variable Substitution

Impact Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expose secrets without the use of the commands block...

Types for Vela Insecure Variable Substitution

Impact Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expose secrets without the use of the commands block...

CISA and NSA Release Joint Guidance on Defending Continuous Integration/Continuous Delivery (CI/CD) Environments

Today, CISA, together with the National Security Agency NSA, released a Cybersecurity Information Sheet CSI to provide recommendations and best practices for organizations to strengthen the security of their CI/CD pipelines against the threat of malicious cyber actors MCAs. Recognizing the variou...

jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin

A flaw was found in the script-security Jenkins Plugin. In affected versions of the script-security plugin, property assignments performed implicitly by the Groovy language runtime when invoking map constructors were not intercepted by the sandbox. This vulnerability allows attackers with...

CVE-2022-1416

Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows for rendering of attacker controlled HTML tags and CSS styling...

CVE-2022-25176

Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading the script file typically Jenkinsfile for Pipelines, allowing attackers able to configure Pipelines to read arbitrary files on t...

Wiz magic shifts left

Fixing vulnerabilities and misconfigurations in the pipeline before deployment makes perfect sense - it reduces the overall threat footprint and saves time. Wiz offers customers a straightforward way to operationalize a Shift Left strategy...