acp-framework-en

ACP — Agent Control Protocol Admission control for agent actions. Before any agent mutates system state, ACP answers four questions: Who is this agent? What are they authorized to do? Is this action policy-compliant? Can the outcome be traced to an accountable institution? Cryptographic identity ...

sdproxy

sdproxy A DNS proxy that gives you real control over your home network. Intro I spent years as a consultant in the "big boy" networking and security "arena". DNS security was/is my daily work, but also a favorite hobby to tinker with. Because I have kids now, and need to be a responsible parent, ...

CVE-2026-97146 Apache YuniKorn: Admission control bypass via system label forgery

Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod has the label 'app=yunikorn' the checks limiting the user annotation content are not run. The label is used to identify the YuniKorn application itself in the...

CVE-2026-97146

Apache YuniKorn version 1.9.0 and earlier is vulnerable to an admission control bypass caused by system label forgery . By setting a secondary label of app=yunikorn on a pod, an attacker can bypass checks that limit the content of user annotations. This allows any user to specify arbitrary user i...

CVE-2026-97146 Apache YuniKorn: Admission control bypass via system label forgery

Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod has the label 'app=yunikorn' the checks limiting the user annotation content are not run. The label is used to identify the YuniKorn application itself in the...

CVE-2026-92393 Apache YuniKorn: Admission control bypass via workload UPDATE operation

Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks. Workloads in YuniKorn are defined as the following Kubernetes objects: "deployments", "replicasets", "statefulsets", "daemonsets", "jobs", "cronjobs". The CREATE...

CVE-2026-92393 Apache YuniKorn: Admission control bypass via workload UPDATE operation

Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks. Workloads in YuniKorn are defined as the following Kubernetes objects: "deployments", "replicasets", "statefulsets", "daemonsets", "jobs", "cronjobs". The CREATE...

CVE-2026-92393

Apache YuniKorn versions 1.9.0 and earlier are vulnerable to an admission control bypass because the software fails to implement label and user annotation checks during the workload UPDATE action. This affects several Kubernetes objects, including deployments , replicasets , statefulsets , daemon...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mac80211: Only QoS data frames are tracked for admission control. For admission control, it clearly only applies to QoS data frames. Otherwise, we wouldn’t even be able to access the QoS field in the header. Syzbot reported an...

PT-2026-105107

Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy policies.kyverno.io/v1beta1 evaluator never reads the spec.images and spec.allowedValues fields of a PolicyException. Any PolicyException whose policyRefs and matchConditions match a resource...

kyverno v1.19.1-rc.1

Kyverno Cloud Native Policy Management 🎉 📑 Table of Contents About Kyverno Non-Goals Documentation Demos & Tutorials Popular Use Cases Explore the Policy Library Getting Help Contributing Software Bill of Materials Contributors License About Kyverno Kyverno is a Kubernetes-native policy engine...

EUVD-2026-51591

vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in...

defenseclaw v0.8.10

root@kitploit: / \ / / / || | / / / / / / /// \ / \ / |/ | | | |/ |\ \ /\ / / / // / / / // /| | | |\ \ /| | | | | | \ V V / // // / || |||/| |||,| // DefenseClaw Security governance for OpenClaw and agentic AI runtimes. Scan capabilities before use, inspect runtime traffic, and export...

defenseclaw v0.8.9

root@kitploit: / \ / / / || | / / / / / / /// \ / \ / |/ | | | |/ |\ \ /\ / / / // / / / // /| | | |\ \ /| | | | | | \ V V / // // / || |||/| |||,| // DefenseClaw Security governance for OpenClaw and agentic AI runtimes. Scan capabilities before use, inspect runtime traffic, and export...

defenseclaw v0.8.8

root@kitploit: / \ / / / || | / / / / / / /// \ / \ / |/ | | | |/ |\ \ /\ / / / // / / / // /| | | |\ \ /| | | | | | \ V V / // // / || |||/| |||,| // DefenseClaw Security governance for OpenClaw and agentic AI runtimes. Scan capabilities before use, inspect runtime traffic, and export...

PT-2026-60893

Name of the Vulnerable Software and Affected Versions Skipper affected versions not specified Description The Kubernetes admission webhook handler reads the entire request body without a size limit. An attacker with in-cluster network access and a valid Kubernetes client certificate can send a...

ingress-nginx rewrite-target nginx configuration injection

CVSS Rating: 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/rewrite-target Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of t...

PT-2026-6347

A security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a denial of service condition. By sending large requests to the validating admission controller, an attacker can cause memory consumption, which may result in the ingress-nginx...

Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2025-64329)

The version of CBL-Mariner Releases installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-64329 advisory. - containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 throug...

CVE-2025-64329

containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is...