scopeblind-gateway

protect-mcp Fail-closed Cedar policy gate plus signed receipts for AI agent tool calls. protect-mcp is a gate that sits in front of an AI agent's tool calls. It evaluates each call against a Cedar policy the same language AWS uses for IAM, blocks what breaks the rules before it runs, and signs an...

clawdstrike

Clawdstrike EDR for the age of the swarm. Fail closed. Sign the truth. Status: pre-1.0 beta. Public APIs are stable; defaults may still tighten before 1.0. Clawdstrike is a policy engine, an EDR, and a signed audit chain in one binary. An AI agent's toolcall sits in the same event taxonomy as a...

syswarden

SysWarden Linux defense. Your host. Your rules. Host-local Linux defense with auditable, fail-closed enforcement. Website | Documentation | Build from source | Roadmap SysWarden is an open-source Linux security orchestrator that combines an authoritative nftables policy, host telemetry,...

scopeblind-gateway v0.13.1

protect-mcp Fail-closed Cedar policy gate plus signed receipts for AI agent tool calls. protect-mcp is a gate that sits in front of an AI agent's tool calls. It evaluates each call against a Cedar policy the same language AWS uses for IAM, blocks what breaks the rules before it runs, and signs an...

CVE-2026-86287 Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths

Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table. The result is that the lookup will silently succe...

CVE-2026-46482

Impact The registration component does not validate the text-based Security Question CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Details The public Registration workflow member.php?action=doregister...

EUVD-2026-61052

Impact The registration component does not validate the text-based Security Question CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Details The public Registration workflow member.php?action=doregister...

CVE-2026-46482

Impact The registration component does not validate the text-based Security Question CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Details The public Registration workflow member.php?action=doregister...

PT-2026-77184

Impact The registration component does not validate the text-based Security Question CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Details The public Registration workflow member.php?action=do register...

DEBIAN-CVE-2026-73501

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load in openapi3filter/validationhandler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI...

PT-2026-71357

Name of the Vulnerable Software and Affected Versions kin-openapi versions prior to 0.144.0 Description In the ValidationHandler.Load function within openapi3filter/validation handler.go, a nil AuthenticationFunc is silently replaced with NoopAuthenticationFunc. This function returns nil without...

CVE-2026-54357

An improper authorization vulnerability in MISP allowed an authenticated organization administrator to access or modify user settings belonging to site administrator accounts within the same organization. The affected access-control checks scoped administrative actions by organization membership...

CVE-2026-54357

CVE-2026-54357 describes an improper authorization flaw in MISP where an authenticated organization administrator could access or modify user settings of site administrators within the same organization. The underlying issue is that access-control checks scoped administrative actions by organizat...

CVE-2026-54357 MISP improper authorization allows organization administrators to modify site administrator user settings

An improper authorization vulnerability in MISP allowed an authenticated organization administrator to access or modify user settings belonging to site administrator accounts within the same organization. The affected access-control checks scoped administrative actions by organization membership...

CVE-2026-54357 MISP improper authorization allows organization administrators to modify site administrator user settings

An improper authorization vulnerability in MISP allowed an authenticated organization administrator to access or modify user settings belonging to site administrator accounts within the same organization. The affected access-control checks scoped administrative actions by organization membership...

PT-2026-48966

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description An improper authorization issue allows an authenticated organization administrator to access or modify user settings of site administrator accounts within the same organization. This occurs...

AgenticMail API/storage and outbound relay hardening fixes

The current upstream main branch at commit 7e0206d was reviewed, and the fix-first patch set was rebased on 2026-05-18. The patches cover: validated and bound inactive-agent hour filtering; storage SQL identifier validation; metadata-backed ownership checks for raw storage SQL; blocking direct...

OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes

Summary The agent-facing gateway tool protects config.apply and config.patch with a model-to-operator trust boundary. That guard used a hand-maintained denylist of protected config paths. The config schema outgrew that denylist, leaving sensitive subtrees writable through model-driven gateway...

CVE-2026-41081 Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failure

Improper Handling of TLS Client Authentication Failure Leading to Anonymous Principal Assignment in Apache Storm Versions Affected: up to 2.8.7 Description: When TLS transport is enabled in Apache Storm without requiring client certificate authentication the default configuration, the...

CVE-2026-41081 Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failure

Improper Handling of TLS Client Authentication Failure Leading to Anonymous Principal Assignment in Apache Storm Versions Affected: up to 2.8.7 Description: When TLS transport is enabled in Apache Storm without requiring client certificate authentication the default configuration, the...