fence

Fence wraps commands in a sandbox that blocks network access by default and restricts filesystem operations based on configurable rules. It's most useful for running semi-trusted code package installs, build scripts, CI jobs, unfamiliar repos with controlled side effects, and it can also compleme...

AgentWard

AgentWard · 玄甲OS AgentWard 玄甲 is a full-stack security operating system purpose-built for trustworthy, scalable AI agent deployment, with native code adaptation to OpenClaw. AgentWard unifies agent onboarding, secure reasoning, and trusted execution in one cohesive security architecture, with...

bug-bounty-findings-o-research-disclosures.

bug-bounty-findings-o-research-disclosures. Bug Bounty: CVE-2023-50839 IDOR identified in a third-party support component via 'gau' and 'Nuclei'. Despite perimeter redirects, the outdated software remained exposed. Confirmed through manual header analysis. Severity: 5.3 Medium. Focused on Defense...

Medium: containerd

Issue Overview: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse ...

Amazon Linux 2023 : ecs-init (ALAS2023-2026-3359)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3359 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by th...

Medium: yq

Issue Overview: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse ...

Medium: amazon-ssm-agent

Issue Overview: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse ...

Medium: containerd

Issue Overview: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse ...

Amazon Linux 2 : ecs-init (ALASECS-2026-156)

The version of ecs-init installed on the remote host is prior to 1.108.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2026-156 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the...

GO-2026-6699 Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza

Coraza: ProcessURI silently drops QUERYSTRING and ARGSGET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza...

PT-2026-118021

Coraza: ProcessURI silently drops QUERY STRING and ARGS GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza...

CVE-2026-102597

Impact On some endpoints, Synapse will accept extraneous suffix data on the path of some endpoints. When Synapse is protected by a reverse proxy such as Nginx and the reverse proxy normalises paths when routing e.g. by converting "/a/../b" to "/b" for routing purposes, this can lead to a bypass o...

pmg

Package Manager Guard PMG Bloquea paquetes maliciosos antes de que se instalen. ¿Por qué PMG? Los desarrolladores y los agentes de codificación con IA instalan paquetes todos los días. Cada npm install o pip install ejecuta miles de líneas de código que nadie revisa. Compromisos recientes en...

CVE-2026-107825 OWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in internal/corazawaf/transaction.go handles a url.ParseRequestURI failure by retaining the raw URI but leaving QUERYSTRING, ARGSGET, ARGSGETNAMES, and the GET-derived portion ...

CVE-2026-107825

The OWASP Coraza WAF library (versions 3.0.0 through 3.8.0 ) contains a vulnerability in the ProcessURI function located in internal/corazawaf/transaction.go. When url.ParseRequestURI fails, the system retains the raw URI but leaves variables like QUERY_STRING and ARGS_GET empty. An unauthenticat...

CVE-2026-107825 OWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in internal/corazawaf/transaction.go handles a url.ParseRequestURI failure by retaining the raw URI but leaving QUERYSTRING, ARGSGET, ARGSGETNAMES, and the GET-derived portion ...

CVE-2026-107825 OWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in internal/corazawaf/transaction.go handles a url.ParseRequestURI failure by retaining the raw URI but leaving QUERYSTRING, ARGSGET, ARGSGETNAMES, and the GET-derived portion ...

GHSA-X26Q-WVHG-FH4M Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

Root Cause File: internal/corazawaf/transaction.go, lines 834–866. go parsedURL, err := url.ParseRequestURIuri query := "" if err != nil tx.variables.urlencodedError.Seterr.Error path = uri tx.variables.requestURI.Seturi / tx.Variables.VARIABLEURIPARSEERROR.Set"1" posRawQuery := strings.Indexuri,...

Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

Root Cause File: internal/corazawaf/transaction.go, lines 834–866. go parsedURL, err := url.ParseRequestURIuri query := "" if err != nil tx.variables.urlencodedError.Seterr.Error path = uri tx.variables.requestURI.Seturi / tx.Variables.VARIABLEURIPARSEERROR.Set"1" posRawQuery := strings.Indexuri,...

Defense-In-Depth at the Perception-Reasoning Interface of LLM-Centric Agentic UAV Swarms

Large Language Models LLMs increasingly support Uncrewed Aerial Vehicle UAV swarm operations such as data collection scheduling, where the model reads structured sensor reports and decides which sensors to visit. An adversary who quietly manipulates those reports can redirect the swarm without...