ironcurtain

IronCurtain Un runtime sicuro per agenti AI autonomi, in cui la politica di sicurezza deriva da una costituzione leggibile dall'uomo. Quando qualcuno scrive "sicuro", dovresti essere immediatamente scettico.Cosa intendiamo per sicuro? !WARNING Prototipo di ricerca. IronCurtain è un progetto di...

CVE-2026-66566

Unauthenticated Local File Inclusion in Ambient = 1.7 versions...

CVE-2026-66566 WordPress Ambient theme <= 1.7 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Ambient = 1.7 versions...

CVE-2026-66566

The WordPress Ambient theme (versions

EUVD-2026-96520

Unauthenticated Local File Inclusion in Ambient = 1.7 versions...

WordPress Ambient theme <= 1.7 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Ambient versions = 1.7...

CVE-2020-17382

CVE-2020-17382 Exploit per Windows 10 x64 2004 Build 19041.264 Un ringraziamento a @matteomalvica per avermi fatto così tante domande su questa vulnerabilità che mi ha costretto a scrivere un exploit per lui per l'ultima release di Windows 10 19041.264 senza KVA Shadow cioè CPU non vulnerabili a...

MAL-2026-17164 Malicious code in building-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4618f06d0398ff90ef90003464e79f23609a160f4d1606f60cf797fb73fa6dcb The package's sole content is index.js, which on load schedules a timer that fetches a hardcoded list of privileged same-origin paths /admin,...

ironcurtain memory-mcp-server/v0.2.1

IronCurtain A secure runtime for autonomous AI agents, where security policy is derived from a human-readable constitution. When someone writes "secure," you should immediately be skeptical.What do we mean by secure? !WARNING Research Prototype. IronCurtain is an early-stage research project...

CVE-2026-76054

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched...

CVE-2026-8933

A flaw was found in snap-confine, a core component of Canonical snapd. This vulnerability allows a local, unprivileged attacker to bypass security restrictions and execute arbitrary code. The flaw occurs due to an issue in how privilege boundaries are initialized when snap-confine operates with...

GHSA-F23P-VX2J-J53R Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

Summary memo from hono/jsx retains the result of a server-side render and reuses it for later renders with comparator-equal props. Request-scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user's request. Details Component...

Exposure of Data Element to Wrong Session

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session in the memo function. An attacker can access sensitive information belonging to other users by sending requests that trigger the reuse of...

Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

Summary memo from hono/jsx retains the result of a server-side render and reuses it for later renders with comparator-equal props. Request-scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user's request. Details Component...

curl: CVE-2026-19931: Negotiate ambient user conn reuse

Summary On Windows with SSPI/Negotiate, curl 8.21.0 can reuse a connection authenticated with ambient credentials for a later request using different explicit credentials. In urlmatchauthnego, the credential comparison is skipped when conn-creds == NULL. This allows a connection authenticated as...

PromptShield Home: Ambient Multimodal Prompt Injection Defense for Smart-Home Agents

Smart-home assistants increasingly use multimodal large language models MLLMs that perceive video and audio directly. This raises a safety question specific to the home: can the agent tell a genuine user command from ambient or externally-sourced content, television speech, on-screen text, or an...

CVE-2026-46685

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, when RUSTFSCORSALLOWEDORIGINS is unset, the RustFS S3 listener's ConditionalCorsLayer reflects any request Origin value back as Access-Control-Allow-Origin and also sets Access-Control-Allow-Credentials: true and...

Security Risks in Tool-Enabled AI Agents: A Systematic Analysis of Privileged Execution Environments

Tool-enabled AI agents are increasingly deployed in cloud-hosted environments and offered as services, where they perform side-effecting operations through privileged tools within execution environments. While such agents enable powerful automation, the security implications of hosting autonomous...

Ambient P10 Central Management Software 安全漏洞

Ambient P10 Central Management Software is a management software developed by the American company Ambient, designed for centralized management and monitoring of the operating status of devices and systems. Version 1.4.13 of Ambient P10 Central Management Software contains a security vulnerabilit...

Ambient ObserverIP Scan Tool 安全漏洞

The Ambient ObserverIP Scan Tool is a security detection tool developed by the American company Ambient, used for network asset scanning and port scanning. Version 1.4.0.1 of the Ambient ObserverIP Scan Tool contains a security vulnerability. This vulnerability could allow local attackers to caus...