Tag
WordPress Coding Standards Contains an Arbitrary Code Execution Vulnerability
1 TTPWordPress Coding Standards (WordPressCS) versions before 3.4.1 are vulnerable to arbitrary code execution due to a flaw in the `WordPress.WP.EnqueuedResourceParameters` sniff, allowing an attacker to execute arbitrary commands on the scanning host by crafting a malicious `$ver` argument, posing a risk for users running PHPCS with specific rulesets in CI pipelines or developer environments.
Appium Java Client Allows Network Pivot via Unvalidated directConnect Redirect (CVE-2026-43910)
3 TTPs 1 IOCA vulnerability, CVE-2026-43910, in Appium's java-client allows a malicious Appium server to redirect all subsequent session traffic to an arbitrary internal endpoint by injecting unvalidated `directConnectHost` and `directConnectPort` parameters when `directConnect(true)` is enabled, potentially leading to session traffic interception, network pivoting, and cloud credential theft.
Woodpecker Privilege Escalation via Unrestricted Kubernetes serviceAccountName
2 TTPsA high-severity privilege escalation vulnerability (CVE-2026-61549) in Woodpecker CI, specifically affecting instances using the Kubernetes backend, allows any user with Push permissions on a connected repository to run pipeline pods under an arbitrary ServiceAccount, potentially leading to secret exfiltration and full cluster takeover.
Path Traversal Vulnerability in @asymmetric-effort/nogginlessdom Allows Arbitrary File Write
4 TTPsA path traversal vulnerability (GHSA-322x-v876-g883) in the `matchFileSnapshot` function of the `@asymmetric-effort/nogginlessdom` library allows an attacker to write arbitrary content to any filesystem path with write access when snapshot update mode is active, potentially leading to supply chain compromise in CI/CD environments.
TeamPCP Supply Chain Attack via CI/CD Compromise
2 rules 1 TTPTeamPCP compromised CI/CD pipelines and GitHub accounts of multiple companies by deploying an infostealer to extract credentials from CI environments, .env files, and cloud tokens, impacting projects like Trivy, KICS, and LiteLLM.
TeamPCP Compromise of KICS GitHub Action Supply Chain
2 rules 4 TTPsTeamPCP conducted a supply chain attack compromising the KICS GitHub Action, impacting users who integrated the compromised version into their CI/CD pipelines.
Trivy Security Scanner GitHub Actions Tag Hijacking for CI/CD Secret Theft
2 rules 4 TTPsAttackers hijacked 75 tags associated with the Trivy Security Scanner GitHub Actions to steal CI/CD secrets from users of the compromised tags.
CircleCI Security Step Disabled Detection
2 rules 1 TTPDetection of disabling security steps in CircleCI, potentially indicating an attempt to bypass security controls during the CI/CD process.
CircleCI Security Step Disabled
2 rules 1 TTPAn attacker disables security steps within CircleCI to potentially bypass security controls and introduce malicious code into the build pipeline.
CircleCI Security Job Disablement Detection
2 rules 1 TTPDetection of activity related to disabling security jobs within CircleCI, potentially indicating an attempt to bypass security controls in a CI/CD pipeline.