popeye

Popeye: Kubernetes 实时集群检查工具 Popeye 是一款实用工具，用于扫描实时 Kubernetes 集群，并报告已部署资源和配置中存在的潜在问题。 随着 Kubernetes 生态系统的增长，人类要跟踪编排集群的大量清单和策略变得越来越困难。 Popeye 基于集群中实际部署的内容进行扫描，而非磁盘上的文件。通过对集群进行代码审查，它能够检测配置错误、过时的资源，并帮助您确保遵循最佳实践，从而预防未来的问题。 它旨在减轻操作 Kubernetes 集群时面临的认知超载。 此外，如果您的集群使用了...

Mandiant-Azure-AD-Investigator

Mandiant Azure AD Investigator Focusing on UNC2452 TTPs Overview This repository contains a PowerShell module for detecting artifacts that may be indicators of UNC2452 and other threat actor activity. Some indicators are "high-fidelity" indicators of compromise, while other artifacts are so calle...

PT-2026-77164

Name of the Vulnerable Software and Affected Versions CodeWhale versions 0.8.41 through 0.8.63 Description An argument injection issue exists in the git show tool. The rev parameter is passed unvalidated into the git show argument vector without an --end-of-options sentinel, allowing a value...

CVE-2026-48774

ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 3.0.0 through 3.0.8, ProxySQL's GenAI/MCP runsqlreadonly tool violates its documented read-only contract for MySQL targets. The tool validates only the full input string with a substring blacklist and first-keyword...

Neuron MySQLSelectTool “read-only” bypass via `SELECT ... INTO OUTFILE` (file write → potential RCE)

Impact MySQLSelectTool is intended to be a read-only SQL tool e.g., for LLM agent querying. However, validation based on the first keyword e.g., SELECT and a forbidden-keyword list does not block file-writing constructs such as INTO OUTFILE / INTO DUMPFILE. As a result, an attacker who can...