IAGA-Sentinel

IAGA Sentinel The EU AI Act conformity evidence layer for AI agents. Cryptographically signed, replay-verifiable evidence of every action an agent routes through it, structured to support AI Act Article 12 record-keeping and Annex IV documentation. Documentation · Setup in one prompt · Quickstart...

grafeo

ACT Platform is now called grafeo! Grafeo is a versatile platform to create custom data models, collect and share knowledge. It is a flexible, well-rounded solution that can be used for any purpose. Developed as part of the ACT research project, it remains at the core of ACT and powers the ACT...

OWASP-Model-Card-Security-Standard

Status: Draft — Incubating OWASP Project This standard is under active development. Contributions and feedback are very welcome. What is this? When you download a pre-trained model from HuggingFace or any other repository, you're essentially trusting a black box. You don't know what data it was...

ai-pentest-agent

ai-pentest-agent A small, standalone autonomous pentest agent, plus a purpose-built vulnerable target to run it against. Built to show, end to end, how an AI pentesting agent actually works — not a black box, just a plan→act→judge loop, a handful of generic skills, a gate that vetoes destructive...

hardware-compliance-handbook

Hardware Compliance Knowledge Base A fact-checked, open reference on the EU laws that govern hardware and IoT cybersecurity — CRA, RED, NIS2, and the Cybersecurity Act/EUCC, in one place instead of four. Prepared by Platanor Technologies platanor.com — an embedded security firm for IoT device...

CVE-2026-61628

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-61628 CVE-2026-61628 nginx-ignition 2.41.0 - lucasdillmann I am @abraxasnull. Loopback lab. The client is CVE-2026-61628-Abraxas-Labs.py. Onboarding is anonymous. First-boot POST /api/users/onboarding/finish...

Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving

The alert is critical. The fix is known. And the ticket sits in a queue for days. Security teams understand the risk, but the people who keep applications available need proof that the change won’t break anything. Their concerns are practical. An IPS protection could block legitimate traffic. A...

Asustor ADM 3.5.9 (AS602T) — Post-Authentication Command Injection in `music.cgi — Detect

Fingerprint / reachability check for Asustor ADM 3.5.9 AS602T — Post-Authentication Command Injection in music.cgi act=live → Command Execution in the CGI Process !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Asustor ADM 3.5.9 AS602T — Post-Authentication Command Injection in music.c...

ag-ui-strands (0.1.0a3), amazon-nova-act-mcp (>=1.0.60.0, <=1.20260527102944.0) +7 more potentially affected by CVE-2026-115419 via strands-agents (>=1.14.0, <=1.35.0)

strands-agents PYPI version =1.14.0, =1.0.60.0, =1.0.9, =1.4.0, =2.3.18.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0 Source cves: CVE-2026-115419 Source advisory: OSV:GHSA-4V6F-7VJH-6X4M...

ag-ui-strands (0.1.0a3), amazon-nova-act-mcp (>=1.0.60.0, <=1.20260527102944.0) +7 more potentially affected by CVE-2026-115419 via strands-agents (>=1.14.0, <=1.35.0)

strands-agents PYPI version =1.14.0, =1.0.60.0, =1.0.9, =1.4.0, =2.3.18.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0 Source cves: CVE-2026-115419 Source advisory: SNYK:PYTHON-STRANDSAGENTS-21460719...

GO-2026-6686 vulnerabilities

Vulnerabilities for packages: gosu-fips, vcluster, crossplane-function-kcl-fips, vcluster-fips, amazon-ecs-agent, neuvector-scanner, chaos-mesh-fips, kubevirt-cdi-uploadserver-fips, chaos-mesh, google-osconfig-agent, k3s, ctop, k8s-image-swapper-fips, ctop-fips, xeol-fips, undock, cloudbeat-fips,...

GO-2026-6686 vulnerabilities

Vulnerabilities for packages: dagger, neuvector-scanner, undock, docker, act, k3s, newrelic-infrastructure-agent, scorecard, vcluster, gosu, xeol, runc, zarf, ctop, datadog-agent, containerd, k3d...

PT-2026-117168

A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.16. The affected element is the function admin repwd/admin repwd act of the file controllers/system.php of the component Password Change. The manipulation of the argument password/repassword results in cross-site request...

PT-2026-116841

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where the flow offload alloc function returns NULL during a conntrack flush or when a GFP ATOMIC allocation fails. While these events are expected under load, the system...

PT-2026-116660

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the act ct component of the network scheduler where shared unconfirmed connection tracking ct entries can be modified. When a socket buffer skb with an unconfirmed ct...

PT-2026-116661

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the net/sched: act ct component. This occurs when a raw pointer to the extensions area is added to the expectations list during the execution of nf c...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/usb: kalmia: Do not pass actlen in the usbbulkmsg error path. syzbot reported that actlen in kalmiasendinitpacket is uninitialized when it is passed to the first usbbulkmsg error path. Jiri Pirko noted that it’s pointless to...

Astra Linux – vulnerability in linux-5.10, linux

In the Linux kernel, the following vulnerability has been resolved: veth: Ensure eth header is in skb's linear part When feeding a decapsulated packet to a veth device with actmirred, skbheadlen may be 0. However, vethxmit calls devforwardskb, which expects at least ETHHLEN bytes of linear data a...

CYBERFORT: A Compliance-Chain Platform Operationalising the Cyber Resilience Act for SMEs

The EU Cyber Resilience Act CRA turns product cybersecurity into a lifecycle compliance obligation for manufacturers, importers, distributors, and integrators of products with digital elements on the EU market, a load that falls largely on small and medium-sized enterprises SMEs that rarely have...

Preparing an AI-Augmented SIEM for the EU Cyber Resilience Act: A Practitioner Case Study

The EU Cyber Resilience Act CRA, Regulation EU 2024/2847, makes product cybersecurity a lifecycle obligation for products with digital elements on the EU market: risk assessment, vulnerability handling, conformity documentation, and Article 14 incident- and vulnerability-reporting readiness must ...