Elkeid

Elkeid - Bytedance Cloud Workload Protection Platform English | 简体中文 Elkeid is an open source solution that can meet the security requirements of various workloads such as hosts, containers and K8s, and serverless. It is derived from ByteDance's internal best practices. With the business...

scanopy

Scanopy Documentación de red, sin el dibujo. Scanopy reemplaza los diagramas de red manuales con un modelo mantenido continuamente de lo que realmente está en ejecución. Un único daemon escanea según una programación y produce cuatro vistas de cada escaneo: L2 física, L3 lógica, cargas de trabajo...

IMDShift

IMDShift AWS workloads that rely on the metadata endpoint are vulnerable to Server-Side Request Forgery SSRF attacks. IMDShift automates the migration process of all workloads to IMDSv2 with extensive capabilities, which implements enhanced security measures to protect against these attacks...

kube-scan

Kube-Scan Try our free Kubernetes risk assessment tool today. Run it on any cluster at any time. No data leaves your cluster. We do not collect any information. For more information on Octarine see https://www.octarinesec.com. Get the risk score of your workloads Kube-Scan gives a risk score, fro...

cowcloud

CowCloud una solución serverless para distribuir cargas de trabajo en AWS CowCloud se creó originalmente para ejecutar herramientas de reconocimiento y escaneos de vulnerabilidades de forma distribuida; por ejemplo, un caso de uso podría ser el de los cazadores de recompensas por vulnerabilidades...

russh: russh: Authentication attempt limit bypass via unenforced maximum authentication attempts

A flaw was found in russh. The server fails to enforce the configured limit on maximum authentication attempts during user authentication. An unauthenticated remote attacker can exploit this flaw by continuously submitting authentication requests over a single connection. This allows an attacker ...

CVE-2026-102825

Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTHREQUEST path reached from server::runstream in russh/src/server/encrypted.rs increments self.common.authattempts but never compares it with server::Config.maxauthattempts. An unauthenticated remote client can continue...

CVE-2026-102825 Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path

Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTHREQUEST path reached from server::runstream in russh/src/server/encrypted.rs increments self.common.authattempts but never compares it with server::Config.maxauthattempts. An unauthenticated remote client can continue...

CVE-2026-102825 Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path

Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTHREQUEST path reached from server::runstream in russh/src/server/encrypted.rs increments self.common.authattempts but never compares it with server::Config.maxauthattempts. An unauthenticated remote client can continue...

CVE-2026-100836

Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decoded ciphertext length before slicing. An authenticated workload with a valid mesh certificate can trigger a runtime panic by submitting a...

CVE-2025-71425

Contrast Edgeless Systems before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRASTLOGLEVEL set to info or debug. Because info is the default, all installations that do not customize the initializer log level are...

CVE-2025-71423

Edgelesssys Contrast is a confidential-computing runtime for Kubernetes. In versions 1.9.0 before 1.12.2, the initializer logs the full NewMeshCert response — which contains the workload secret — to standard output at INFO level. As a result, workload secrets are exposed to any Kubernetes user wi...

CVE-2026-100836 Edgeless Systems Contrast through 1.20.0 Denial of Service via ciphertextContainer

Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decoded ciphertext length before slicing. An authenticated workload with a valid mesh certificate can trigger a runtime panic by submitting a...

EUVD-2026-87831

Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decoded ciphertext length before slicing. An authenticated workload with a valid mesh certificate can trigger a runtime panic by submitting a...

CVE-2026-100836

Contrast through 1.20.0 is vulnerable to a Denial of Service (DoS) via a panic in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function. The root cause is a failure to validate decoded ciphertext length before slicing. An authenticated workload with a valid mesh certificate can...

CVE-2026-100836 Edgeless Systems Contrast through 1.20.0 Denial of Service via ciphertextContainer

Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decoded ciphertext length before slicing. An authenticated workload with a valid mesh certificate can trigger a runtime panic by submitting a...

CVE-2025-71425 Contrast before 1.8.1 Information Disclosure via Logging

Contrast Edgeless Systems before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRASTLOGLEVEL set to info or debug. Because info is the default, all installations that do not customize the initializer log level are...

CVE-2025-71425 Contrast before 1.8.1 Information Disclosure via Logging

Contrast Edgeless Systems before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRASTLOGLEVEL set to info or debug. Because info is the default, all installations that do not customize the initializer log level are...

CVE-2025-71426 Contrast before 1.4.1 Coordinator Impersonation via Unauthenticated Recovery

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.4.1, a recovering Coordinator does not verify the seed supplied by the recovering party. An attacker can therefore stand up a rogue Coordinator whose manifest passes validation but whose secret seed is...

EUVD-2025-211007

Contrast Edgeless Systems before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRASTLOGLEVEL set to info or debug. Because info is the default, all installations that do not customize the initializer log level are...