ironcurtain

IronCurtain 一个用于自主AI代理的安全运行时，其安全策略源自人类可读的章程。 当有人写"安全"时，你应该立即持怀疑态度。我们所说的安全是什么意思？ !WARNING 研究原型。 IronCurtain 是一个早期研究项目，探索如何使AI代理足够安全以真正有用。API、配置格式和架构可能会发生变化。欢迎贡献和反馈。 演示 代理被要求克隆一个仓库并推送更改。gitclone 和 gitpush 都被策略引擎升级，但自动审批器自动批准了它们——用户来自命令模式的可信输入（Ctrl-A）提供了明确的意图，因此无需手动 /approve。 问题...

polaris

Polaris é um motor de políticas de código aberto para Kubernetes Polaris é um motor de políticas de código aberto para Kubernetes que valida e corrige a configuração de recursos. Inclui mais de 30 políticas de configuração integradas, além da capacidade de criar políticas personalizadas com JSON...

gate0

gate0 एक छोटा, ऑडिट करने योग्य, समाप्त होने वाला, नियतिवादी माइक्रो-पॉलिसी इंजन। Gate0 क्यों? मैंने Gate0 इसलिए बनाया क्योंकि मैं प्रोडक्शन में RegEx-आधारित पॉलिसियों को डीबग करते-करते थक गया था। मैं कुछ ऐसा चाहता था जो उबाऊ, सीमाबद्ध और क्रैश होना असंभव हो। यदि आप एक लचीला, सामान्य-उद्देश्य वाला...

mcp-doorman

mcp-doorman Шлюз безопасности для MCP-серверов — каждый вызов инструмента проверяется на входе. CI npm License: Apache-2.0 PR приветствуются mcp-doorman — это прокси, который встраивается между вашим AI-агентом Claude Desktop, Claude Code, Cursor, VS Code, любой MCP-клиент и используемыми...

clawshield-public

ClawShield Proxy di sicurezza per agenti AI. Si posiziona davanti a OpenClaw e analizza ogni messaggio alla ricerca di prompt injection, fughe di PII e segreti — prima che raggiungano il modello o lascino la rete. Include 5 agenti AI specializzati, una dashboard integrata e un motore di policy...

clawdstrike

Clawdstrike EDR per l'età dello sciame. Fail closed. Firma la verità. Stato: beta pre-1.0. Le API pubbliche sono stabili; le impostazioni predefinite potrebbero ancora essere irrigidite prima della 1.0. Clawdstrike è un motore di policy, un EDR e una catena di audit firmata tutto in un unico...

CVE-2026-54523

Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.applynamespace, resources with an arbitrary...

AgentGuard

AgentGuard Sandbox a fiducia zero per agenti AI autonomi. AgentGuard avvolge qualsiasi agente AI LangChain, CrewAI, AutoGen, script personalizzati con binari di sicurezza. Con un solo cambiamento di comando: root@kitploit: Before dangerous — agent has full system access python myagent.py After...

Nexora

Nexora Nexora è un sistema intelligente di governance degli endpoint e sicurezza informatica basato su AI, che monitora l'utilizzo del software sui dispositivi, applica una classificazione del rischio basata su policy e genera report strutturati comportamentali e di sicurezza. È progettato per...

opa

Open Policy Agent Open Policy Agent OPA è un motore di policy open source e di uso generale che consente un'applicazione delle policy unificata e sensibile al contesto nell'intero stack. OPA è orgoglioso di essere un progetto graduated nel panorama della Cloud Native Computing Foundation CNCF. Pe...

GO-2025-3615 vulnerabilities

Vulnerabilities for packages: kyverno-fips, commercial-kyverno, kyverno...

GO-2025-3562 vulnerabilities

Vulnerabilities for packages: commercial-kyverno, kyverno-notation-aws-fips, kyverno, kyverno-fips, kyverno-notation-aws...

GO-2026-5575 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, kyverno...

GO-2025-3652 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws...

PT-2026-71092

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS evaluates the ForAllValues: and ForAnyValue: set qualifiers with the negated string operators StringNotEquals, StringNotEqualsIgnoreCase, StringNotLike, ArnNotEquals, and ArnNotLike using each other's...

CVE-2026-12624

Vault’s ACL policy engine allowed LIST requests with a trailing slash on denied paths to bypass a narrow wildcard deny when a token had a broad allow. This could enable enumeration of names under a denied path. Affected products include Vault Community Edition, with fixes in 2.0.3, and Vault Ente...

sentinel

Sentinel — Agentic Code & System Quality Guardian Production-...

GHSA-MW9R-P8XP-WX96 Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`

Impact Having the Topic and User operators to watch different namespaces than the one where the Kafka cluster is deployed, is a fully documented feature. When the watchedNamespace field is used within the Topic or User operator as part of the Kafka.spec.entityOperator field, the Cluster Operator...

CVE-2026-41323

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4, Kyverno's apiCall feature in ClusterPolicy automatically attaches the admission controller's ServiceAccount token to outgoing HTTP requests. The service URL has n...

CVE-2026-47333

Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data...