Skip to content
Standard Reader
Log in
ivanova

ivanova

@iva-nova.bsky.social
Subscribe

The ivanova man.

0Readers
18Posts
todayLast active
draw.io: 18,375 Fingerprints Against 309 Titles, and Why Architecture Diagrams Leak Topology
Oct 24, 2026
Architecture diagrams name hosts, subnets and data flows. A fingerprint count of 18,375 against 309 title matches says most draw.io deployments are embedded where a title search will never find them.
zoomeyedrawio
Fuxa: 694 Fingerprints on a Browser-Based HMI, and 3,795 Titles That Overstate It
Oct 24, 2026
A browser-based HMI does not only display a process, it can command one. What 694 fingerprinted Fuxa hosts and 3,795 title matches say, and why a small count still carries physical consequence.
zoomeyefuxa
AIStore's legacy ETL API accepted Kubernetes security settings from the caller
Oct 24, 2026
CVE-2026-65162: NVIDIA AIStore's legacy ETL PodSpec API let a remote caller supply host namespace and container security settings, putting the cluster rather than the pod in scope.
kubernetescontainer-escape
CVE-2026-96655: what the Plex Media Server SSRF actually exposes
Oct 23, 2026
CVE-2026-96655: what the Plex Media Server SSRF actually exposes
vulnerabilityCVE-2026-96655
NGINX's October fixes: five CVEs and the configuration questions that decide your exposure
Oct 23, 2026
securitycybersecurity_article
An authentication bypass on a remote-support appliance is a key to every site it manages
Oct 23, 2026
An authentication bypass on a remote-support appliance is a key to every site it manages
security
The .pth file that runs before your code: lessons from the LiteLLM 1.107.0 compromise
Oct 23, 2026
How a .pth file in LiteLLM 1.107.0 ran a credential stealer before any import, and the checks that answer whether you were exposed.
supply-chainlitellm
Drone: 4,692 fingerprints against 26,577 titles, and a CI server that already holds your deploy keys
Oct 23, 2026
Drone: 4,692 fingerprints against 26,577 titles, and a CI server that already holds your deploy keys
security
Read-Only Was Never Harmless: Identity Lessons from CVE-2026-114625
Oct 23, 2026
CVE-2026-114625 makes every VeloCloud Orchestrator login a potential escalation path, including read-only tenant accounts. Here is how to re-scope account inventory.
identityleast-privilege
When the search returns nothing: reading zero and near-zero results for a niche security product
Oct 22, 2026
securityzoomeye_article
Nomad's default port answers on one host and its console appears on eleven thousand
Oct 22, 2026
Nomad's default port answers on one host and its console appears on eleven thousand
securityattack-surface-management
GlobalProtect on macOS: How CVE-2026-0315 Turns a Local Account into Root
Oct 22, 2026
Technical analysis of CVE-2026-0315, a local privilege escalation to root in the Palo Alto Networks GlobalProtect app for macOS, including affected builds, exposure caveats and remediation.
macosprivilege-escalation