Yuval Elarat
ArgoCD repoURL XSS: How a Missing Scheme Check Becomes Cluster Takeover
Executive Summary This stored cross-site scripting (XSS) vulnerability in ArgoCD [versions <= 3.4.4] allows an attacker who can create or modify an Application to persist a malicious repoURL, which is subsequently executed in an administrator's browser within the Argo CD origin. Because the payload executes in the context of the administrator's authenticated session, and because…
Building Autonomous Cloud & AI Security
How Upwind’s Agentic Pack uses NVIDIA Nemotron 3 Super and NVIDIA garak agent breaker probe to continuously validate cloud posture, attack surfaces, and AI applications. By: Avital Harel, Alon Saban, Yuval Elarat (Upwind). Eliya Cohen, Shiri Hochhauser, Orel Hazai (NVIDIA) Executive Summary AI-generated code, autonomous agents, MCP servers, and cloud-native architectures are transforming how software is…
CVE-2025-8110: Unpatched Gogs RCE Vulnerability Actively Exploited in the Wild
Executive Summary CVE-2025-8110 is an actively exploited, unpatched Remote Code Execution (RCE) vulnerability affecting all Gogs versions ≤ 0.13.3. The flaw allows authenticated users to bypass path-traversal protections through a symlink-based file-write bypass, enabling arbitrary file overwrite on the host server and ultimately full system compromise. With no official patch available and exploitation occurring in…