1415 matches found
iron-proxy
iron-proxy The problem CI jobs, AI coding agents, and sandboxed containers can make arbitrary outbound requests. A compromised dependency, a prompt injection, or a malicious build step can exfiltrate secrets, phone home, or open a reverse shell. Most teams have zero visibility into what's leaving...
deny-af-alg-bpf
deny-af-alg-bpf Description BPF LSM program that blocks AFALG Linux kernel crypto API socket creation and logs all attempts via a ring buffer to userspace. What it does Attaches to the lsm/socketcreate hook Denies any socketAFALG, ... call with -EPERM Emits structured events pid, comm to a BPF ri...
CVE-2026-113594
Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGESETTINGS permission. Attackers can set a join password, disable registration, zero upload...
EUVD-2026-105160
Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGESETTINGS permission. Attackers can set a join password, disable registration, zero upload...
CVE-2026-113594
Sharkord versions before 0.0.8 are vulnerable to a missing authorization flaw in the others.updateSettings tRPC mutation. This allows any authenticated member to modify server-wide settings without the required MANAGE_SETTINGS permission. Exploitation can lead to a denial of service by allowing a...
CVE-2026-113594 Sharkord before 0.0.8 Missing Authorization via updateSettings tRPC Route
Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGESETTINGS permission. Attackers can set a join password, disable registration, zero upload...
CVE-2026-113594 Sharkord before 0.0.8 Missing Authorization via updateSettings tRPC Route
Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGESETTINGS permission. Attackers can set a join password, disable registration, zero upload...
CVE-2026-33186
CVE-2026-33186 gRPC-Go RBAC Authorization Policy Bypass via Missing :path Slash Auth Bypass Description The authz package in google.golang.org/grpc implements SDK-level RBAC authorization using deny and allow rules matched against the :path pseudo-header. The HTTP/2 server transport stores the ra...
Gotenberg <= 8.30.1 - Server Side Request Forgery
Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the --webhook-deny-list and --api-download-from-deny-list flags use a case-sensitive regular expression ^https?:// to match URL schemes. Because Go's net/url.Parse normalizes...
Vite Dev Server - Information Exposure
Vite is a frontend tooling framework for JavaScript. Before versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network using...
agent
Bomfather Agent Bomfather Agent is an eBPF-based agent that runs in the kernel space to block actions based on a policy. We built this agent to solve the problems we had with existing solutions. 1. They were too complex to set up and use. 2. They were too slow and inefficient. 3. And even if they...
DNSnitch
DNSnitch Disclaimer I use that for myself, it's here if someone needs it though. Feel free to open an issue if you find bugs! The Interactive Terminal DNS Firewall DNSnitch is a local, privacy-first DNS server that puts you in complete control of your network traffic. Unlike passive blocklists,...
gate0
gate0 A small, auditable, terminating, deterministic micro-policy engine. Why Gate0? I built Gate0 because I was tired of debugging RegEx-based policies in production. I wanted something that was boring, bounded, and impossible to crash. If you want a flexible, general-purpose policy engine, you...
MakerChecker
🛡️ MakerChecker The open-source security layer for AI agents. Deny-by-default enforcement, human approvals, and a cryptographically signed audit trail — so your agent runs only what it's granted and provably can't approve its own work. Website · Live Demo · mc scan · Docs Your agents keep running...
CVE-2026-92978 User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect...
BlockGuard
🛡️ BlockGuard — Process-Based File Access Security Agent BlockGuard is a Windows Data Loss Prevention DLP agent that intercepts and controls file access at the process level. It ensures that only authorized processes — identified by executable path, cryptographic hash, Authenticode signature, and...
CVE-2026-67620-poc
CVE-2026-67620 — Flowise SSRF via incomplete cloud-metadata deny-list Oracle OCI + Alibaba Cloud Product: FlowiseAI/Flowise — visual LLM / AI-agent builder 54k ★ Affected versions: ≤ 3.1.4 — confirmed still vulnerable in 3.1.4 , the latest release re-verified 2026-08-06 Vulnerability: Server-Side...
CVE-2026-96233
Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network...