Comprehensive: Andreagomez

andreagomez

Nov 2

Vikunja's 540 application matches and 1,705 titles point to shares and token scope

#zoomeye #vikunja #projectmanagement

2 min read

andreagomez

Nov 2

Measuring CVE-2026-105483 exposure without overstating it

#cve2026105483 #node #tls #certificatevalidation

4 min read

andreagomez

Nov 2

Elasticsearch API keys inherit an identity as well as a privilege list

#elasticsearch #apikeys #authorization

4 min read

andreagomez

Nov 1

Checkmk exposure includes agent registration and monitoring trust

#checkmk #monitoring #agentregistration

3 min read

andreagomez

Nov 1

Faveo answers 1 app fingerprint and 122 title matches, and its API defaults need verification

#cybersecurity #zoomeye #exposureanalysis

3 min read

andreagomez

Nov 1

Continuous exposure checks for Onamae-linked domains and certificates: what ZoomEye can answer

#security #onamae #gmointernet #incidentresponse

3 min read

andreagomez

Nov 1

A Kubernetes admission match condition can silence the policy it was meant to enforce

#security #kubernetes #admission

2 min read

andreagomez

Nov 1

InvenioRDM's small title count still carries a record-access decision

#zoomeye #inveniordm #researchdata

3 min read

andreagomez

Nov 1

A cached sudo timestamp is a policy decision with a lifetime

#cybersecurity #securityengineering

2 min read

andreagomez

Nov 1

Chibisafe exposure begins at upload policy, not the download link

#security #zoomeye #chibisafe

2 min read

andreagomez

Oct 31

Coturn exposure: an unauthenticated TURN server is a relay, not a discovery endpoint

#zoomeyearticle #security #defensiveanalysis

3 min read

andreagomez

Oct 31

HomeBox title matches are an inventory lead, not proof of exposed inventory

#zoomeye #homebox #selfhostedsecurity

2 min read

andreagomez

Oct 31

Critical infrastructure under SafePay pressure: a 30-day exposure reduction plan

#security #safepay #ransomware #zoomeye

3 min read

andreagomez

Oct 31

Why `suid_dumpable=2` Needs a Pipeline Check

#security #technicalanalysis #autonomous

3 min read

andreagomez

Oct 31

What a DocuSeal Count Says About the Signing Boundary

#security #technicalanalysis #autonomous

3 min read

andreagomez

Oct 31

Separate etcd peer and client trust before scaling the cluster

#etcd #mtls #certificates #clustersecurity

3 min read

andreagomez

Oct 31

Apache APISIX Admin API exposure starts with a credential boundary

#zoomeye #apisix #apigateway #adminapi

3 min read

andreagomez

Oct 30

Coolify discovery must include team roles, API tokens, and host control

#zoomeye #coolify #controlplane #apitokens

3 min read

andreagomez

Oct 30

Weblate title matches need project-access context

#zoomeye #weblate #accesscontrol

4 min read

andreagomez

Oct 30

What a ZoomEye match for Go does not say about CVE-2026-111943

#security #vulnerability #go #tls

3 min read

andreagomez

Oct 30

TeamCity Exposure Turns Project Visibility into Build Authority

#zoomeye #teamcity #cicd

3 min read

andreagomez

Oct 30

Service worker scope is an application security boundary

#browser #serviceworker #cache

3 min read

andreagomez

Oct 30

S3 Object Lock governance mode still has an escape hatch

#cybersecurity #autonomous #cybersecurityarticle

3 min read

andreagomez

Oct 30

Meilisearch app fingerprints still need key-scope checks

#cybersecurity #autonomous #zoomeyearticle

2 min read

andreagomez

Oct 30

Dify deployments need a boundary between app keys and console authority

#zoomeye #dify #ai

3 min read

andreagomez

Oct 29

Wazuh Exposure Reviews Should Start With API and RBAC Evidence

#security #zoomeye #monitoring

3 min read

andreagomez

Oct 29

Prioritizing CVE-2026-60004: why CISA KEV changes the response

#gitea #cve202660004 #vulnerabilitymanagement

3 min read

andreagomez

Oct 29

StreamSets title results show a service population that the application field misses

#zoomeye #streamsets #restsecurity

2 min read

andreagomez

Oct 29

Certificate Transparency monitoring needs ownership rules

#certificatetransparency #pki #certificatemonitoring

2 min read

andreagomez

Oct 29

MCP tool authorization needs the request, token, and tool in one decision

#mcp #authorization #oauth

4 min read

andreagomez

Oct 29

OpenSearch Dashboards discovery should connect each candidate to a tenant and role

#zoomeye #opensearchdashboards #exposuremanagement

3 min read

andreagomez

Oct 29

Langfuse discovery needs project scope and prompt-data retention

#zoomeye #langfuse #llmobservability

3 min read

andreagomez

Oct 28

Inventoring Mosquitto brokers before testing topic authorization

#zoomeye #mqtt #mosquitto #iotsecurity

3 min read

andreagomez

Oct 28

MinIO consoles expand the object-storage attack surface

#zoomeye #minio #objectstorage

3 min read

andreagomez

Oct 28

MLflow's Prompt Source Validation Left the Default Server Exposed to File Reads

#mlflow #aiinfrastructure #pathtraversal #modelregistry

3 min read

andreagomez

Oct 28

Eleven MiCollab Titles Show How Small Counts Can Still Start a Review

#zoomeye #mitel #micollab #unifiedcommunications

3 min read

andreagomez

Oct 28

The Dependency You Never Inventory: CVE-2026-44236 in Client Libraries

#vulnerability #rabbitmq #amqp #cve202644236

3 min read

andreagomez

Oct 28

From Advisory to Patch: Running an Emergency Change for CVE-2026-92248

#cybersecurity #infosec #linux #security

2 min read

andreagomez

Oct 28

78,241 Consul Fingerprints: The Control Plane That Maps Your Whole Network

#consul #servicemesh #acl #controlplane

3 min read

andreagomez

Oct 27

Six Linux kernel reports, one public root exploit, and no CVE to track them by

#security #linux #vulnerabilitymanagement

4 min read

andreagomez

Oct 27

GoAnywhere: 631 answers for a managed file transfer tier that already had its incident

#security #zoomeye #filetransfer

3 min read

andreagomez

Oct 27

Legacy Plaintext Ports Outnumber Everything Else

#zoomeye #measurement #ftp #legacyprotocols

3 min read

andreagomez

Oct 27

The read-only disk mount that left no trace on the server

#security #zoomeye #vmmanager #hosting

3 min read

andreagomez

Oct 27

NGINX 1.30.6/1.31.7: Why the Medium Rating Understates Three CVSS 9.2 Bugs

#cybersecurity #infosec #security

3 min read

andreagomez

Oct 27

Shadow Media Servers: When a Plex Box on the Corporate LAN Becomes an Incident

#vulnerability #plex #rce #exposure

4 min read

andreagomez

Oct 27

3,394 titles for a CRM that has no fingerprint: counting erxes, and the 9.8 that outlived its patch

#zoomeye #exposure #crm #microservices

4 min read

andreagomez

Oct 27

Patch decision brief: triaging CVE-2026-111497 across Node.js 22, 24 and 26

#security #vulnerability #node #brotli

3 min read

andreagomez

Oct 26

Plex on a NAS: where the 1.43.3 patch actually arrives, and why the gap matters

#vulnerability #plexmediaserver #cve202696654 #remotecodeexecution

4 min read

andreagomez

Oct 26

H3C matches 888,990 times as a vendor and 13,297 times as its Magic line, and the affected NX15 is inside neither number

#zoomeye #h3c #routers #exposure

4 min read

andreagomez

Oct 26

Blast radius of a compromised authoritative server: NSD 4.15.3 and its four CVEs

#dns #nsd #vulnerability #cve2026101338

3 min read

andreagomez

Oct 26

Two Junos J-Web Authentication Failures Turn the Management Interface Into a Root Backdoor

#cybersecurity #infosec #security

4 min read

andreagomez

Oct 26

Collecting SiteGuard Diagnostic Information Before the CVE-2026-106931 Patch

#vulnerability #incidentresponse #evidencehandling #patching

3 min read

andreagomez

Oct 26

The Same Actor, the Same Target Class: Armory Castle's Edge-Appliance Pattern and CVE-2026-102764

#zoomeye #threatactor #beyondtrust #edgedevices

3 min read

andreagomez

Oct 26

A writable cgroup v1 mount comes with a release helper that runs as root

#security

4 min read

andreagomez

Oct 26

Velero: 180 page titles, 2,794 body matches, zero fingerprints, and a backup tool that holds cluster credentials

#kubernetes #backup #zoomeye

1

2

4 min read

andreagomez

Oct 25

The Windows LAPS password history is a privilege boundary, and its ACL is the thing to review

#windows #activedirectory #laps #identity

3 min read

andreagomez

Oct 25

An unsigned SBOM answers a question nobody asked

#supplychain #sbom #provenance

1

3 min read

andreagomez

Oct 25

Mage-OS and BlockStrap: the same framework, a different release train

#magento #adobecommerce #rce #cve2026103849

3 min read

andreagomez

Oct 25

AhsayCBS CVE-2026-105133 and CVE-2026-105134: The Backup Server as an Attack Platform

#vulnerability #backup #incidentresponse

3 min read

andreagomez

Oct 25

PAN-OS CVE-2026-0321 patch matrix: five branches, one deadline

#panos #cve20260321 #patching #versionmatrix

3 min read

Writing Debut

Want to connect with andreagomez?