AgentWard

AgentWard · 玄甲OS AgentWard 玄甲 是一个专为可信、可扩展的 AI 智能体部署而构建的全栈安全操作系统，原生适配 OpenClaw。AgentWard 将智能体接入、安全推理与可信执行统一在一个紧凑的安全架构中，并即将原生支持其他主流智能体框架。其异构纵深防御设计将智能体工作流重构为启动、感知、记忆、决策和执行五个协同的安全层，通过动态跨阶段防护机制，验证基础完整性、阻止对抗欺骗、防止内存篡改，并验证每个自主决策和高风险指令——形成一个完整、端到端的闭环安全体系，实现“初始可信、过程可控、结果可靠”的安全承诺。如果您觉得这个仓库有用，请引用我们关于 AgentWa...

fence

Fence 将命令包裹在沙箱中，默认阻止网络访问，并根据可配置的规则限制文件系统操作。它最适合运行半可信代码（包安装、构建脚本、CI 任务、不熟悉的仓库）并控制其副作用，也可以作为纵深防御手段补充 AI 编码智能体。 root@kitploit: 默认阻止所有网络访问 fence curl https://example.com → 403 禁止 允许特定域名 fence -t code npm install → 使用 'code' 模板，允许 npm/pypi 等 阻止危险命令 fence -c "rm -rf /" → 被命令拒绝规则阻止 Fence 同时也是 CLI...

DEBIAN-CVE-2026-93228

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Write/Reply chunks with segcount 0 A peer can send a Write or Reply chunk whose segcount field is zero. xdrcheckwritechunk only rejects segcount rcmaxpages, so zero passes the range check, and xdrinlinedecodestrea...

EUVD-2026-86233

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Write/Reply chunks with segcount 0 A peer can send a Write or Reply chunk whose segcount field is zero. xdrcheckwritechunk only rejects segcount rcmaxpages, so zero passes the range check, and xdrinlinedecodestrea...

CVE-2026-93228

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Write/Reply chunks with segcount 0 A peer can send a Write or Reply chunk whose segcount field is zero. xdrcheckwritechunk only rejects segcount rcmaxpages, so zero passes the range check, and xdrinlinedecodestrea...

bug-bounty-findings-o-research-disclosures.

bug-bounty-findings-o-research-disclosures. Bug Bounty: CVE-2023-50839 IDOR identificado en un componente de soporte de terceros a través de 'gau' y 'Nuclei'. A pesar de las redirecciones perimetrales, el software desactualizado permaneció expuesto. Confirmado mediante análisis manual de cabecera...

pmg

Package Manager Guard PMG 在恶意 npm 和 pip 包安装之前将其拦截。 为你已在使用的包管理器提供纵深防御。...

CVE-2026-93067: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: tc358767: clamp the reported AUX read size to the request tcauxtransfer clamps an AUX read to the payload limit: sizet size = mintsizet, DPAUXMAXPAYLOADBYTES - 1, msg-size; After the transfer it replaces size with the...

CVE-2026-87065

A flaw was found in konflux-operator-tasks. Tekton task steps within this component run with root privileges without sufficient security hardening. This lack of defense-in-depth controls, such as restricted capabilities or disabled privilege escalation, could potentially allow an attacker to...

PT-2026-85076

A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered and were not validated when the configuration was saved. As a result, an authenticated user able to modify dashboard widg...

pmg v0.27.0

Package Manager Guard PMG Block malicious npm and pip packages before they install. Defense in depth for the package managers you already use. Why PMG? Developers and AI coding agents install packages every day. Each npm install or pip install executes thousands of lines of code that nobody...

CVE-2026-55165 Lemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure

Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetchtokenheader to read headerdata"alg" from an unverified token and passed that attacker-controlled value to decodewithmultiplesecrets. PyJWT 2.x rejects alg=none with the configured...

ANT-2026-66X46XSC · supabase/supabase · other

other low Severity Claude low · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-66X46XSC: X-Content-Type-Options header set to invalid value The Next.js headers configuration for the Supabase...

CVE-2026-66883 Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup

Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidccplug Oidcc.Plug.Authorize module renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session. This vulnerability is associated with program files...

EUVD-2026-52658

Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidccplug Oidcc.Plug.Authorize module renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session. This vulnerability is associated with program files...

Acrisure KARR BT and DR-100

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to perform unauthorized vehicle control operations. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure...

Rockwell Automation CompactLogix 5380 ControlLogix 5580 / 1756-EN4TR Communications Module

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for all...

​​Better security starts with better questions

As organizations move beyond AI experimentation, success will depend on how effectively they combine intelligence and trust. The same systems that amplify knowledge, accelerate decisions, and unlock new outcomes must also protect data, govern AI, and build resilience. In this next phase of...

Panduit IntraVUE

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker with access to the IT network to manipulate industrial control devices without requiring physical access, specialized insider knowledge, or advanced tooling. 2. RECOMMENDED PRACTICES CISA recommends users...

Rockwell Automation 1718-AENTR/1719-AENTR

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow for an attacker to cause a denial-of-service condition on the product. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network...