CTWall

CTWall - ChainThreatWall Rilascio GitHub --- Con l'aumento di team che si spostano verso ambienti di sviluppo virtualizzati per ridurre il rischio della supply chain del software, una sfida rimane: dipendenze dannose possono ancora passare inosservate e raggiungere la produzione. CTWall...

DepAlert

Agente DepAlert CTWall Questo strumento fa parte della piattaforma CTWall. Vedi: CTWall Descrizione DepAlert è un gate di sicurezza open source per la tua pipeline CI/CD. Analizza gli SBOM rispetto ai dati di intelligence sui malware e ti dice rapidamente se la tua build include pacchetti dannosi...

grepmarx

Grepmarx - Piattaforma di Sicurezza delle Applicazioni Grepmarx è un'applicazione web che fornisce una piattaforma unica per comprendere, analizzare e identificare rapidamente le vulnerabilità in basi di codice potenzialmente grandi e sconosciute. Caratteristiche Capacità SAST Static Analysis...

text4shell-policy

Demo di Text4Shell Questa demo mostra come usare Sigstore per convalidare i tuoi SBOM firmati rispetto alle policy text4shell in Kubernetes o da riga di comando Opzione 1: Verifica se la tua immagine OCI remota è interessata usando cue con cosign 2.0 root@kitploit: cosign verify-attestation...

openclarity

OpenClarity is an open source tool for agentless detection and management of Virtual Machine Software Bill Of Materials SBOM and security threats such as vulnerabilities, exploits, malware, rootkits, misconfigurations and leaked secrets. Join OpenClarity's Slack channel to hear about the latest...

bom-view

BOM View Eine einfache, statische Webanwendung zum Anzeigen von Softwareabhängigkeiten aus Software-Stücklisten SBOM-Dateien. Als statische Seite kann sie problemlos auf jedem statischen Webhosting-Dienst wie GitLab Pages, GitHub Pages oder Netlify gehostet werden. Funktionen SBOM-Viewer : Zeigt...

GHSA-76P8-FHRM-VPC7 vulnerabilities

Vulnerabilities for packages: blob-csi, jaeger-operator, mountpoint-s3-csi-driver, rekor, flux-notification-controller, kubewatch, seaweedfs, dgraph, azurefile-csi, pulumi-language-java, vault-env, cert-manager-webhook-pdns, pvc-autoresizer, flyte, harbor-registry, kubernetes-dashboard-web,...

GHSA-25MV-J2QR-V5JQ vulnerabilities

Vulnerabilities for packages: blob-csi, pulumi-language-yaml, jaeger-operator, configmap-reload, mountpoint-s3-csi-driver, rekor, aws-otel-collector, bazelisk, flux-notification-controller, ghaudit, kubewatch, seaweedfs, dgraph, azurefile-csi, spiffe-helper, smokescreen, pulumi-language-java,...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: blob-csi, pulumi-language-yaml, yunikorn-web, jaeger-operator, configmap-reload, mountpoint-s3-csi-driver, rekor, aws-otel-collector, bazelisk, flux-notification-controller, ghaudit, kubewatch, seaweedfs, dgraph, azurefile-csi, spiffe-helper, smokescreen,...

GO-2025-3660 vulnerabilities

Vulnerabilities for packages: trivy-fips, witness, kyverno, conftest, cosign, kyverno-notation-aws, kyverno-notation-aws-fips, conftest-fips, policy-controller, tfsec, dapr-fips, cosign-fips, spire-server-fips, kots, policy-controller-fips, dapr, spire-server, kyverno-fips, trivy...

GO-2024-2920 vulnerabilities

Vulnerabilities for packages: melange, dagger, zot, guac...

GO-2026-5547 vulnerabilities

Vulnerabilities for packages: teleport, tkn, gitlab-runner, bom, trivy, cosign, buildkitd, vexctl, gitsign, zarf, goreleaser, rekor, flux-source-controller, ko, docker-compose, guac, aactl, tflint, trivy-operator, policy-controller, falcoctl, spire-server, neuvector-sigstore-interface, kyverno,...

CVE-2026-18353

PIA's POST /v1/upload/sbom endpoint accepts a Bearer JWT and checks its unverified iss claim against an issuer allowlist using Python's urlparse before performing OIDC discovery with requests. Because urlparse and requests/urllib3 parse an authority string containing a backslash e.g...

EUVD-2026-51066

PIA's POST /v1/upload/sbom endpoint accepts a Bearer JWT and checks its unverified iss claim against an issuer allowlist using Python's urlparse before performing OIDC discovery with requests. Because urlparse and requests/urllib3 parse an authority string containing a backslash e.g...

CVE-2026-18353 Unauthenticated SSRF in PIA via OIDC issuer allowlist bypass

PIA's POST /v1/upload/sbom endpoint accepts a Bearer JWT and checks its unverified iss claim against an issuer allowlist using Python's urlparse before performing OIDC discovery with requests. Because urlparse and requests/urllib3 parse an authority string containing a backslash e.g...

CVE-2026-14336

PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check issuer.startswith' https://ci.eclipse.org ' in isissuerknown, pia/models.py:139 instead of validating the issuer as a properly host-bounded URL. An attacker can craft an issuer such as https://[email protected]...

EUVD-2026-41259

PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check issuer.startswith' https://ci.eclipse.org ' in isissuerknown, pia/models.py:139 instead of validating the issuer as a properly host-bounded URL. An attacker can craft an issuer such as https://[email protected]...

CVE-2026-14336

PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check issuer.startswith' https://ci.eclipse.org ' in isissuerknown, pia/models.py:139 instead of validating the issuer as a properly host-bounded URL. An attacker can craft an issuer such as https://[email protected]...

PT-2026-54948

Name of the Vulnerable Software and Affected Versions PIA affected versions not specified Description The OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check instead of validating the issuer as a properly host-bounded URL. This allows an attacker to bypass the check using a...

PT-2026-48812

Name of the Vulnerable Software and Affected Versions DevGuard versions prior to 1.4.2 Description On API instances with public assets, any authenticated user can perform unauthorized write operations, regardless of their organization, project, or asset membership. This allows attackers to create...