🧰 Orca

The items that name it 15

• Critical GitLab RCE Lets Unauthenticated Attackers Execute Code on Servers (CVE-2026-97229)
  advisory2026-10-14It is written here as Orca (Orca Security platform): identifies assets running vulnerable GitLab versions and prioritizes remediation using internet accessibility, runtime reachability and asset criticality.

  Orca Security platform

• WordPress “Comment2Shell” XSS-to-RCE Chain Lets Unauthenticated Attackers Compromise Servers via Malicious Comments
  advisory2026-09-22

  Identifies assets running vulnerable WordPress versions, provides exposure context (internet accessibility, runtime reachability, asset criticality), and prioritizes remediation based on real risk rather than CVSS alone; highlights affected assets in the newItem view.

• Breaking: GitLab Critical Path Traversal Flaw Exploited in the Wild — Patch Immediately
  advisory2026-09-14It is written here as Orca (Orca Security platform).

  Identifies assets running vulnerable GitLab versions, assesses exposure (internet accessibility, runtime reachability, asset criticality), and prioritizes remediation based on real risk rather than CVSS alone; highlights affected assets in its 'newItem' view.

• Incident Automation: Benefits, Tools & Best Practices
  article2026-09-09It is written here as Orca (Cloud-Native Application Protection Platform).

  Supplies asset, identity, network path, and data context to cloud findings via its Unified Data Model; collects data agentlessly via SideScanning; prioritizes findings by risk across severity, asset exposure, blast radius, and data sensitivity

• Critical Elementor Pro File Upload Flaw Enables Unauthenticated Remote Code Execution on WordPress Sites
  advisory2026-08-20It is written here as Orca (SideScanning).

  Agentless platform that identifies assets running vulnerable versions of Elementor Pro, detects WordPress installations and plugin versions across cloud workloads, assesses exposure (internet accessibility, runtime reachability, asset criticality), and prioritizes remediation based on real risk.

• Orca Security: SOC Automation
  article2026-08-14It is written here as Orca (Orca Security platform).

  Supplies enrichment context (asset, identity, network path, data store) for SOC automation decisions via its Unified Data Model; not a SIEM or SOAR

• Orca Security: AI Agents Security
  article2026-08-14It is written here as Orca (AI security posture management).

  Maps workloads, identities, keys, and sensitive data behind an AI agent without installing software (agentless); builds AI inventory and bill of materials for every AI model in the cloud; alerts on overprivileged permissions and internet exposure; detects keys/tokens to AI services left in code repo

• Orca Security: AI-BOM
  article2026-07-31It is written here as Orca (SideScanning).

  Agentless cloud scanning technology (patented) that produces a complete AI inventory and Bill of Materials for every AI model deployed in the cloud, including shadow AI, covering Azure OpenAI, Amazon Bedrock, Amazon SageMaker, Google Vertex AI, and 50+ AI software packages; surfaces sensitive data r

• Orca Security: Incident Response Tools
  article2026-07-31It is written here as Orca (SideScanning, Sensor, Unified Data Model, Detect and Respond).

  Agentless cloud security platform supplying asset, identity, and data context to incident response tools: SideScanning reads workload runtime block storage out of band, the Orca Sensor adds runtime signals, and the Unified Data Model connects findings to identities, sensitive data access, and intern

• Orca: CVE-2026-5027 Langflow Path Traversal RCE
  advisory2026-06-12It is written here as Orca (Orca Security platform).

  Agentless scanning to identify assets running vulnerable Langflow versions, assess exposure (internet accessibility, runtime reachability, asset criticality), and prioritize remediation via software composition analysis and alert view highlighting.

• Orca: CVE-2026-45034 PhpSpreadsheet RCE Patch Bypass
  advisory2026-06-12It is written here as Orca (Orca Security platform).

  Enables customers to quickly identify assets running vulnerable versions of PhpSpreadsheet, understand exposure in context (internet accessibility, runtime reachability, asset criticality), and prioritize remediation based on real risk rather than CVSS alone; highlights affected assets directly in t

• Orca: Splunk Enterprise Critical CVEs
  advisory2026-06-12

  Agentless cloud security platform that identifies assets running vulnerable versions of Splunk Enterprise, assesses exposure (internet accessibility, runtime reachability, asset criticality), and prioritizes remediation; detects Splunk Enterprise installations and versions across AWS, Azure, and GCP

• Orca Security: Gitea Container Registry Exposes Private Images to Unauthenticated Attackers
  writeup2026-05-27

  identifies assets running vulnerable Gitea versions, assesses exposure (internet accessibility, runtime reachability, asset criticality), and prioritizes remediation based on real risk rather than CVSS alone; highlights affected assets in inventory view

• Orca Security: CVE-2026-9082
  advisory2026-05-22It is written here as Orca (Orca Security platform).

  Identifies assets running vulnerable Drupal versions, assesses exposure (internet accessibility, runtime reachability, asset criticality), and prioritizes remediation via its newItem view

• Orca Security: Critical Apache HTTP Server HTTP/2 Vulnerability Could Enable Remote Code Execution
  advisory2026-05-08

  Identifies assets running vulnerable Apache HTTP Server versions, assesses exposure (internet accessibility, runtime reachability, asset criticality), and prioritizes remediation based on real risk rather than CVSS alone; highlights affected assets in the alert view