272 matches found
mastyf.ai
mastyf.ai Secure the Action Boundary, Not Just the Prompt. A local reference monitor and security gateway for AI agents and MCP. Your LLM proposes actions. Mastyf decides whether those actions reach the real world. Website · Quick start · Policy · Dashboard · GitHub !NOTE Enterprise & Cloud...
MakerChecker
🛡️ MakerChecker The open-source security layer for AI agents. Deny-by-default enforcement, human approvals, and a cryptographically signed audit trail — so your agent runs only what it's granted and provably can't approve its own work. Website · Live Demo · mc scan · Docs Your agents keep running...
claude-code-guardrails
We have since built a dedicated product to help developers manage AI permissions better, which we intend to make open source. Check it out atstoplight.ai. Claude Code Guardrails settings.json works if: You're fine editing JSON and killing Claude Code sessions every time policy changes Your securi...
Jenkin Audit Trail <=3.2 - Cross-Site Scripting
Jenkins Audit Trail 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability. id: CVE-2020-2140 info: name: Jenkin Audit Trail =3.3 which includes a fix for this vulnerability. reference: -...
CVE-2026-86066
The HR and CRM software Horilla is vulnerable to a Cross-Site Request Forgery (CSRF) flaw in versions prior to 2.0.0 . The approve_validate_attendance_request function at /attendance/approve-validate-attendance-request/ performs state-changing actions (such as updating attendance_validated and ap...
CVE-2026-85290
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Cron::recur method writes an invalid cron key from the URL path directly to the application log without neutralizing CRLF characters. An unauthenticated requester can...
CVE-2026-85290 InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Cron::recur method writes an invalid cron key from the URL path directly to the application log without neutralizing CRLF characters. An unauthenticated requester can...
CVE-2026-85290 InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Cron::recur method writes an invalid cron key from the URL path directly to the application log without neutralizing CRLF characters. An unauthenticated requester can...
CVE-2026-85290 InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Cron::recur method writes an invalid cron key from the URL path directly to the application log without neutralizing CRLF characters. An unauthenticated requester can...
PT-2026-99138
Name of the Vulnerable Software and Affected Versions Horilla versions prior to 2.0.0 Description An issue exists where the endpoint '/attendance/approve-validate-attendance-request/' modifies attendance validated, is validate request approved, approved by, and pending-request states via an HTTP...
CVE-2026-85290: Improper Output Neutralization for Logs
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Cron::recur method writes an invalid cron key from the URL path directly to the application log without neutralizing CRLF characters. An unauthenticated requester can...
CVE-2026-92460
yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP...
EUVD-2026-80665
yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP...
CVE-2026-92460 yshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log Listing
yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP...
CVE-2026-92460
CVE-2026-92460 affects yshop-crm through 2.1.3 , a CRM application. The vulnerability is a missing authorization check on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide operation log without proper permission checks. Ex...
CVE-2026-92460 yshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log Listing
yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP...
CVE-2026-92460: Missing Authorization
yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP...
CVE-2026-29812
CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list...
CVE-2026-29812
CyberPanel versions prior to 2.4.4 lack logging for actions that could potentially manipulate the child domains list , reducing auditability of changes to that list. The vulnerability is scored CVSS 4.3 (Medium) with low integrity impact and no confidentiality or availability impact, requiring on...