node9-proxy

🛡️ node9 Access control for AI agents Your AI agents can reach Slack, GitHub, email, and your database. node9 decides what they may do with each one. Credential jail · secrets and PII · destructive git, SQL and shell held for review · MCP tool pinning · network egress allowlist · loop breaker · on...

nah

expensive mistakes stop here a guard that blocks catastrophic agent actions nahguard.ai • what it blocks • how it compares • how it decides • install • extend • threat model claude code · codex · cursor · pi · + 11 more nah is a guard that sits in your coding agent's hook path and reads tool call...

sage

Sage Safety for Agents — Agent Detection & Response for AI coding assistants Sage is a lightweight security layer that protects AI agents from executing dangerous actions. It intercepts tool calls — shell commands, URL fetches, file writes — and checks them against multiple threat detection layer...

ROPE

ROPE: Routed Origin Policy Enforcement Source code of our paper: ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection by Xinhang Ma, Chaowei Xiao, William Yeoh, Ning Zhang, Yevgeniy Vorobeychik Abstract Indirect prompt injection IPI plants instructions in the content a...

MakerChecker

🛡️ MakerChecker The open-source security layer for AI agents. Deny-by-default enforcement, human approvals, and a cryptographically signed audit trail — so your agent runs only what it's granted and provably can't approve its own work. Website · Live Demo · mc scan · Docs Your agents keep running...

scopeblind-gateway

protect-mcp Local policy enforcement and signed decision receipts for AI agent tool calls. Developer page · Quickstart · Agent setup · Policy packs · Sample record · Integrations · Documentation · Contribute Put the gateway between an MCP client and its tool server, or use its hooks in a coding...

CVE-2026-115477

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a Streamable HTTP deployment with "auth.jwtSecret" configured and a 2026-07-28-era client declaring "elicitation.form" support, a dispatch-gated tool call offered an...

CVE-2026-56832

PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any later non-bot message in the configured Discord channel whose text is classified as approval, such as yes. As a result, any...

CVE-2026-114386 Pydantic AI Harness before 0.59.0 CodeMode Tool Call Limit Bypass via run_code

Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.toolcallslimit on nested tool calls dispatched from runcode in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via runnestedcall without checkbeforetoolcall, exceeding operator limits...

CVE-2026-114386 Pydantic AI Harness before 0.59.0 CodeMode Tool Call Limit Bypass via run_code

Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.toolcallslimit on nested tool calls dispatched from runcode in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via runnestedcall without checkbeforetoolcall, exceeding operator limits...

CVE-2026-114386

The Pydantic AI Harness (versions before 0.59.0 ) contains a vulnerability in the CodeMode toolset where it fails to enforce UsageLimits.tool_calls_limit on nested tool calls. Specifically, when run_code is used, the sandboxed program can invoke tools via run_nested_call() without triggering the ...

CVE-2026-114386 Pydantic AI Harness before 0.59.0 CodeMode Tool Call Limit Bypass via run_code

Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.toolcallslimit on nested tool calls dispatched from runcode in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via runnestedcall without checkbeforetoolcall, exceeding operator limits...

CVE-2026-109300

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages...

CVE-2026-109300 Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages...

CVE-2026-109300

Open WebUI versions 0.6.31 through 0.11.4 are vulnerable to a stored cross-site scripting (XSS) flaw in the Markdown renderer . The root cause is that the renderer treats user-authored tool-call details blocks as tool output, mounting their embeds attribute in script-enabled iframes. An authentic...

EUVD-2026-97602

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages...

CVE-2026-109300 Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages...

CVE-2026-109300 Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages...

PT-2026-110717

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages...

CVE-2026-108768

A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argument Handler. The manipulation leads to allocation of resources. It is possible to initiate the attack remotely. The exploit is publicly...