trivy-operator

Kubernetes 原生安全工具包。（文档） 简介 Trivy Operator 利用 Trivy 持续扫描您的 Kubernetes 集群以发现安全问题。扫描结果以 Kubernetes 自定义资源定义的形式汇总为安全报告，可通过 Kubernetes API 访问。该 Operator 通过监视 Kubernetes 的状态变化并自动触发安全扫描来工作。例如，当创建新的 Pod 时，会启动漏洞扫描。 这样，用户就可以以 Kubernetes 原生的方式查找和查看与不同资源相关的风险。 集群内安全扫描 Trivy Operator 自动生成并更新安全报告。这些报告是针对...

GeckoDroid

GeckoDroid Cliente móvil para Adaptix C2 Framework. Acceso completo de operador desde tu dispositivo Android. Qué hace GeckoDroid te da control sobre tu servidor Adaptix C2 desde cualquier lugar. En lugar de estar frente al cliente de escritorio, puedes gestionar las operaciones sobre la marcha...

BackupOperatorToolkit

BackupOperatorToolkit 使用方法 BackupOperatorToolkit BOT 有四种不同的模式，允许您从 Backup Operator 升级到 Domain Admin。 在运行该工具之前，请使用 "runas.exe /netonly /user:domain.dk\backupoperator powershell.exe"。 服务模式 SERVICE 模式会在远程主机上创建一个服务，该服务将在主机重启时执行。 该服务通过修改远程注册表创建。这是通过将 "REGOPTIONBACKUPRESTORE" 值传递给 RegOpenKeyExA 和...

starboard

Starboard 正在加入 Trivy。 我们已宣布计划停止 Starboard 并将其合并到 Trivy 中。 Starboard CLI 已重新引入为 trivy kubernetes 命令，而专注于 trivy 能力的 starboard-operator 可作为 Trivy-Operator 使用。 我们将不再接受新功能/拉取请求/问题。 我们鼓励您为 Trivy-Operator 和 Trivy CLI 做出贡献，并影响 Trivy Kubernetes 的未来。 有关更多信息，请参阅 讨论 查看最新：Trivy 下一步问答 Kubernetes 原生安全工具包。 简介...

sliver-gui

Sliver GUI Una consola de operador de escritorio para el framework Sliver C2 en el espíritu de Cobalt Strike y Havoc. Diseñada y desarrollada por Raj Kumar Mullapudi Sliver GUI es un frontend ligero de Wails v2 Go + HTML/CSS/JS plano sobre el servicio gRPC rpcpb.SliverRPC existente de Sliver. No...

renovate-operator

Renovate: The Kubernetes-Native Way Run Renovate on your own infrastructure with CRD-based scheduling, parallel execution, auto-discovery, and a built-in UI. If you self-host Renovate and already run Kubernetes, this operator gives you the control and observability that plain self-hosted setups...

nebula

Nebula AI驱动的渗透测试 零层工作台 致谢 首先，我要感谢全能的上帝，祂是一切知识的源头。没有祂，这一切都是不可能的。 Nebula 将安全评估的工作组件整合到一个桌面界面上：终端、代码、浏览器、助手、文件、笔记、任务、发现和报告。 AI 可以调查、组织和编写。操作员定义范围、授予权限并决定运行的内容。 围绕操作员设计 集中一处工作。 从研究过渡到容器化终端，将有价值的输出作为证据保留，并将其带入发现和报告，而不会丢失上下文。 保持权限明确。 范围强制、审批暂停、硬预算和隔离的 OCI 执行位于 AI 辅助与受测系统之间。 留下持久的轨迹。...

chaos-operator

Litmus chaos-operator para inyectar experimentos de caos en Kubernetes Codacy Badge...

CVE-2025-51401

Título del Exploit: LiveHelperChat =4.61 - Cross-Site Scripting XSS Almacenado a través del Campo de Nombre de Chat del Operador que se Activa en la Transferencia de la Propiedad del Chat Fecha: 09/06/2025 Autor del Exploit: Manojkumar J TheWhiteEvil LinkedIn:...

CVE-2026-63464

CVE-2026-63464 affects nebula-mesh , a self-hosted control plane for Slack Nebula mesh VPN, in versions 0.6.0 through before 0.7.2 . The vulnerability is an SSRF that arises because non-admin operators (role user) can set allow_private: true on their own webhook subscription via POST/PATCH /api/v...

CVE-2026-53603

nebula-mesh , a self-hosted control plane for Slack Nebula mesh VPN, stored operator session tokens in plaintext in the operator_sessions table (the token column served as the PRIMARY KEY). Each token is a 32-byte random hex value delivered via cookie with a 24-hour validity. Unlike API keys and ...

CVE-2026-19274

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR na...

CVE-2026-19274

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 contains a vulnerability in the Instana Agent Operator where cluster-scoped RBAC objects are keyed solely by the bare Custom Resource name with no namespace disambiguation. An authenticated Kubernetes tenant can exploit this by ...

CVE-2025-51397

Exploit Title: LiveHelperChat =4.61 - Stored Cross Site Scripting XSS via Operator Surname Date: 09/06/2025 Exploit Author: Manojkumar J TheWhiteEvil Linkedin: https://www.linkedin.com/in/manojkumar-j-7ba35b202/ Vendor Homepage: https://github.com/LiveHelperChat/livehelperchat/ Software Link:...

CVE-2026-85625

sift (sift.js) 17.1.3 is vulnerable to remote code execution due to its use of for...in to enumerate query keys, which walks the object prototype chain and dispatches any matched operator key including $where . The $where operator compiles a string value into a function via new Function unless CS...

EUVD-2026-71232

sift sift.js 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSPENABLED is set not set by default. As a result, if a...

wikipedia-c2

Wikipedia-C2 Wikipedia C2 Blog Post This is a demo project to demonstrate Command and Control utilizing Wikipedia. After Josh Abraham's demo of C2 utilizing Slack and ICMP, I thought I'd explore what other options in the internet's top sites could be used for C2. After reviewing Wikipedia's API, ...

atomic-operator

license atomic-operator 此 Python 包用于在多种操作系统环境中执行 Atomic Red Team 测试（Atomics）。 新增内容？ 为什么？ atomic-operator 使安全专业人员能够针对 atomic-red-team 中定义的既定技术测试其检测和防御能力。通过使用 atomic-operator 这样的测试框架，您可以识别自己的防御能力以及防御覆盖范围的缺口。 此外，atomic-operator 还可用于许多其他场景，例如： 生成警报以测试产品 测试 EDR 和其他安全工具 从对手角度识别执行防御规避的方法 等等。 特性 支持在...

Windmill < 1.603.3 - SQL Injection

Windmill versions 1.276.0 through 1.603.2 contain an authenticated SQL injection vulnerability in the folder owner management endpoint. The addowner API endpoint passes user-supplied input directly into a SQL query without sanitization, enabling JSONB path injection. An authenticated user with...

Windmill < 1.603.3 - Operator Authorization Bypass

Windmill versions 1.276.0 through 1.603.2 contain an authorization bypass vulnerability in the folder management API endpoints. The endpoints for creating, deleting, and managing folder ownership do not enforce role-based access control for operator-level users. In Windmill, operators are...