CVE-2026-122193

OS command injection in the example SSM document provisioning script in Trusted Remote Execution REX before 2026-07-28 might allow an authenticated remote user who is permitted to invoke the Rex-RO or Rex-RW SSM document to execute arbitrary commands as root on the managed instance, bypassing Ced...

CVE-2026-122193

An OS command injection vulnerability exists in the example SSM document provisioning script within Trusted Remote Execution (REX) prior to 2026-07-28. An authenticated remote user authorized to invoke the Rex-RO or Rex-RW SSM documents may execute arbitrary commands as root on the managed instan...

EUVD-2026-118379

OS command injection in the example SSM document provisioning script in Trusted Remote Execution REX before 2026-07-28 might allow an authenticated remote user who is permitted to invoke the Rex-RO or Rex-RW SSM document to execute arbitrary commands as root on the managed instance, bypassing Ced...

scopeblind-gateway

protect-mcp Local policy enforcement and signed decision receipts for AI agent tool calls. Developer page · Quickstart · Agent setup · Policy packs · Sample record · Integrations · Documentation · Contribute Put the gateway between an MCP client and its tool server, or use its hooks in a coding...

cmcp

cMCP: Confidential MCP Runtime Community updates and contributor highlights: AgenTrust on LinkedIn. Enforce MCP tool policy inside a TEE, where the agent it governs cannot reach it Quick Start · Architecture · Configuration · CLI · Changelog Developer Preview - launched at the Confidential...

@auto-nomos/cedar (>=0.0.0, <=0.0.2), @auto-nomos/core (>=0.0.1, <=0.0.4) +10 more potentially affected by unknown CVE via @cedar-policy/cedar-wasm (>=4.3.3, <=4.11.0)

@cedar-policy/cedar-wasm NPM version =4.3.3, =0.0.0, =0.0.1, =0.0.7, =0.0.1, =0.0.1, =0.1.0, =0.1.0, =1.0.1, =0.1.0, =0.14.0-alpha.0, =0.14.0-alpha.0, =0.19.0 - cedar-mcp-server 1.0.0 Source cves: unknown CVE Source advisory: OSV:GHSA-C33X-VCV4-VG3G...

@auto-nomos/cedar (>=0.0.0, <=0.0.2), @auto-nomos/core (>=0.0.1, <=0.0.4) +10 more potentially affected by unknown CVE via @cedar-policy/cedar-wasm (>=4.3.3, <=4.11.0)

@cedar-policy/cedar-wasm NPM version =4.3.3, =0.0.0, =0.0.1, =0.0.7, =0.0.1, =0.0.1, =0.1.0, =0.1.0, =1.0.1, =0.1.0, =0.14.0-alpha.0, =0.14.0-alpha.0, =0.19.0 - cedar-mcp-server 1.0.0 Source cves: unknown CVE Source advisory: GHSA-C33X-VCV4-VG3G...

scopeblind-gateway v0.13.1

protect-mcp Fail-closed Cedar policy gate plus signed receipts for AI agent tool calls. protect-mcp is a gate that sits in front of an AI agent's tool calls. It evaluates each call against a Cedar policy, blocks what breaks the rules before it runs, and signs an offline-verifiable Ed25519 receipt...

cmcp v0.4.0

cMCP: Confidential MCP Runtime Community updates and contributor highlights: AgenTrust on LinkedIn. Enforce MCP tool policy inside a TEE, where the agent it governs cannot reach it Quick Start · Architecture · Configuration · CLI · Changelog Developer Preview - launched at the Confidential...

CVE-2026-49473

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

CVE-2026-49473: Interpretation Conflict

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

CVE-2026-49473 @cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

CVE-2026-49473 @cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

CVE-2026-49473 @cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

CVE-2026-49473

The CVE concerns @cedar-policy/authorization-for-expressjs, an Express middleware that applies Cedar authorization by mapping HTTP requests to Cedar actions. A concrete flaw in versions up to 0.2.x is that the middleware uses req.originalUrl (which includes the query string) to identify Cedar act...

EUVD-2026-57699

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

CVE-2026-49473

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

CVE-2026-49473

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

CVE-2026-55773 CedarJava has a policy injection vulnerability

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Cedar-expression injection via unescaped toCedarExpr. The...

CVE-2026-55772 CedarJava has a type confusion vulnerability

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI...