76 matches found
clawpatrol
clawpatrol The security firewall for agents. Claw Patrol sits between your agents and prod, parses their traffic at the wire, and gates each action against rules you write in HCL. For example, you can block destructive SQL, or pause kubectl delete pod until a human approves it before the request...
santamon
Santamon Sidecar ligero de detección para macOS Santa que evalúa la telemetría de Endpoint Security localmente con reglas CEL y reenvía solo las señales de detección coincidentes a un servidor backend. Experimental. Creado para laboratorios domésticos y flotas pequeñas. Versión temprana: se esper...
AZL-100950 CVE-2026-83530 affecting package telegraf 1.31.0-31
A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...
AZL-100938 CVE-2026-83530 affecting package kubernetes 1.30.10-29
A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...
CVE-2026-83530
A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...
AZL-100914 CVE-2026-83530 affecting package cert-manager 1.12.15-12
A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...
AZL-100917 CVE-2026-83530 affecting package cloud-provider-kubevirt 0.5.1-7
A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...
AZL-100944 CVE-2026-83530 affecting package prometheus-adapter 0.12.0-9
A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...
AZL-100935 CVE-2026-83530 affecting package kube-vip-cloud-provider 0.0.10-8
A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...
AZL-100932 CVE-2026-83530 affecting package keda 2.14.1-18
A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...
EUVD-2026-75041
A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...
CVE-2026-83530
cel-go , the Go implementation of the Common Expression Language (CEL), is affected by an uncontrolled memory allocation vulnerability. A user can supply an expression whose string length exceeds the ParserExpressionSizeLimit() configured on the CEL environment, causing a memory allocation propor...
CVE-2026-83530 Uncontrolled Memory Allocation in cel-go
A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...
CVE-2026-83530 Uncontrolled Memory Allocation in cel-go
A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...
CVE-2026-54523
Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.applynamespace, resources with an arbitrary...
GHSA-79GF-7FRW-68M9 Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system
Summary In Kyverno v1.18.1, a tenant who can create a NamespacedMutatingPolicy in their own namespace can instruct the admission controller to generate resources in any namespace by passing an arbitrary namespace string to the CEL generator.applynamespace, resources function. Details...
Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system
Summary In Kyverno v1.18.1, a tenant who can create a NamespacedMutatingPolicy in their own namespace can instruct the admission controller to generate resources in any namespace by passing an arbitrary namespace string to the CEL generator.applynamespace, resources function. Details...
CVE-2026-54523
Kyverno (a policy engine for cloud native platforms) versions 1.18.0 through 1.18.1 are affected by a namespace-scope validation bypass in the NamespacedMutatingPolicy CEL compiler. The function GenerateResources in pkg/cel/libs/context.go does not reject cross-namespace targets, and the validato...
CVE-2026-54523 Kyverno: NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system
Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.applynamespace, resources with an arbitrary...