ironcurtain

IronCurtain Eine sichere Laufzeitumgebung für autonome KI-Agenten, bei der die Sicherheitsrichtlinie aus einer für Menschen lesbaren Verfassung abgeleitet wird. Wenn jemand „secure“ schreibt, sollten Sie sofort skeptisch sein.Was meinen wir mit „secure“? !WARNING Forschungsprototyp. IronCurtain i...

mcp-doorman

mcp-doorman Il gateway di sicurezza per i server MCP — ogni chiamata di strumento viene controllata all'ingresso. CI npm Licenza: Apache-2.0 PR benvenuti mcp-doorman è un proxy drop-in che si posiziona tra il tuo agente AI Claude Desktop, Claude Code, Cursor, VS Code, qualsiasi client MCP e i...

clawdstrike

Clawdstrike EDR para a era do enxame. Feche com falha. Assine a verdade. Status: beta pré-1.0. As APIs públicas estão estáveis; os padrões podem ser endurecidos antes da versão 1.0. Clawdstrike é um mecanismo de políticas, um EDR e uma cadeia de auditoria assinada em um único binário. Um toolcall...

polaris

Polaris ist eine Open-Source-Richtlinien-Engine für Kubernetes Polaris ist eine Open-Source-Richtlinien-Engine für Kubernetes, die die Konfiguration von Ressourcen validiert und korrigiert. Sie enthält über 30 integrierte Konfigurationsrichtlinien sowie die Möglichkeit, benutzerdefinierte...

AgentGuard

AgentGuard Sandbox a fiducia zero per agenti AI autonomi. AgentGuard avvolge qualsiasi agente AI LangChain, CrewAI, AutoGen, script personalizzati con binari di sicurezza. Con un solo cambiamento di comando: root@kitploit: Before dangerous — agent has full system access python myagent.py After...

Nexora

Nexora Nexora è un sistema intelligente di governance degli endpoint e sicurezza informatica basato su AI, che monitora l'utilizzo del software sui dispositivi, applica una classificazione del rischio basata su policy e genera report strutturati comportamentali e di sicurezza. È progettato per...

clawshield-public

ClawShield Proxy di sicurezza per agenti AI. Si posiziona davanti a OpenClaw e analizza ogni messaggio alla ricerca di prompt injection, fughe di PII e segreti — prima che raggiungano il modello o lascino la rete. Include 5 agenti AI specializzati, una dashboard integrata e un motore di policy...

gate0

gate0 Eine kleine, prüfbare, terminierende, deterministische Mikro-Policy-Engine. Warum Gate0? Ich habe Gate0 gebaut, weil ich es leid war, regex-basierte Richtlinien in der Produktion zu debuggen. Ich wollte etwas, das langweilig, begrenzt und unmöglich zum Absturz zu bringen ist. Wenn Sie eine...

opa

Open Policy Agent Open Policy Agent OPA ist eine quelloffene, universelle Policy-Engine, die eine einheitliche, kontextbezogene Policy-Durchsetzung über den gesamten Stack hinweg ermöglicht. OPA ist stolz darauf, ein graduiertes Projekt in der Cloud Native Computing Foundation CNCF zu sein. Weite...

GO-2025-3615 vulnerabilities

Vulnerabilities for packages: kyverno, kyverno-fips, commercial-kyverno...

GO-2025-3562 vulnerabilities

Vulnerabilities for packages: kyverno, kyverno-fips, kyverno-notation-aws, kyverno-notation-aws-fips, commercial-kyverno...

GO-2026-5575 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, kyverno...

GO-2025-3652 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws...

PT-2026-71092

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS evaluates the ForAllValues: and ForAnyValue: set qualifiers with the negated string operators StringNotEquals, StringNotEqualsIgnoreCase, StringNotLike, ArnNotEquals, and ArnNotLike using each other's...

CVE-2026-12624

Vault’s ACL policy engine allowed LIST requests with a trailing slash on denied paths to bypass a narrow wildcard deny when a token had a broad allow. This could enable enumeration of names under a denied path. Affected products include Vault Community Edition, with fixes in 2.0.3, and Vault Ente...

sentinel

Sentinel — Agentic Code & System Quality Guardian Production-...

GHSA-MW9R-P8XP-WX96 Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`

Impact Having the Topic and User operators to watch different namespaces than the one where the Kafka cluster is deployed, is a fully documented feature. When the watchedNamespace field is used within the Topic or User operator as part of the Kafka.spec.entityOperator field, the Cluster Operator...

CVE-2026-41323

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4, Kyverno's apiCall feature in ClusterPolicy automatically attaches the admission controller's ServiceAccount token to outgoing HTTP requests. The service URL has n...

CVE-2026-47333

Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data...

EUVD-2026-32988

Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data...