clawk

Give a coding agent its own disposable Linux machine, not yours. -lightgrey Install · Quickstart · Why a VM? · How it works · Compared to · FAQ · Docs A coding agent is only useful when you let it actually do things: install packages, run the code it writes, start servers, use the network. On you...

CVE-2026-121949 Symfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypass

The Symfony HtmlSanitizer component does not apply the media URL policy to the srcset and imagesrcset attributes, allowing values that point to hosts or schemes not permitted by allowMediaSchemes or allowMediaHosts to bypass it, so that browsers load images from disallowed hosts in Symfony versio...

CVE-2026-121949

The Symfony HtmlSanitizer component fails to apply media URL policies to the srcset and imagesrcset attributes in versions 6.1.x (prior to 6.4.50), 7.x (prior to 7.4.23), and 8.x (prior to 8.1.11). While these attributes are permitted by the sanitizer, their URL candidates are never validated and...

CVE-2026-118517

The Symfony HtmlSanitizer component UrlSanitizer parses URLs differently from browsers, allowing the allowLinkHosts and allowMediaHosts checks to be bypassed for URLs without a well-formed authority, resulting in untrusted hosts being referenced in sanitized output in Symfony versions 6.1.x prior...

CVE-2026-121426

The Nodemailer library (versions 3.0.0 to 10.1.4) contains an address parsing vulnerability within the addressparser component. The flaw occurs because the parser incorrectly ends an angle-addr at a ">> ** character found inside a quoted local part, comment, or domain literal. This allows a...

EUVD-2026-115958

Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domai...

Linux Distros Unpatched Vulnerability : CVE-2026-121425

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments...

CVE-2026-121426: nodemailer: Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr…

Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domai...

CVE-2026-121425: nodemailer: Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon…

Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and...

cve-2026-22874-gitea-ssrf-allowlist

CVE-2026-22874 — Incomplete SSRF protection in Gitea webhook and migration allow-list Technical writeup and references for CVE-2026-22874 GHSA-2r5c-gw76-rh3w: an incomplete SSRF allow-list in Gitea's webhook delivery and repository migration, fixed in Gitea 1.26.3. I independently reported this...

CVE-2026-112255

OpenText Advanced Authentication Server is vulnerable to an insecure default configuration issue (CWE-1188) affecting versions 6.4.0.0 through 6.4.3.x , 6.5.0.0 through 6.5.0.x , and 6.6.0.0 through 6.6.1.0 . The root cause is an insecure default allow-list that permits Excessive Allocation of re...

CVE-2026-112255 Endpoint credential minting (insecure default allow-list)

Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from 6.6.0.0 through 6.6.1.0. The fix for...

XStream 1.4.18 - Remote Code Execution

XStream 1.4.18 is susceptible to remote code execution. An attacker can execute commands of the host by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the...

RHLW-2026-6E6E3B76EDF3A10B Lightwell Security Advisory: mina-core 2.2.5.rhlw-00009

Red Hat Lightwell has released org.apache.mina:mina-core 2.2.5.rhlw-00009 with a backported security fix. CVE-2026-47065: Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232 This patched artifact is a drop-in replacement for org.apache.mina:mina-core 2.2.5 fr...

Security Bulletin: A Security Vulnerability in Apache MINA Core affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-94301)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed this security vulnerability Vulnerability Details CVEID:CVE-2026-94301 DESCRIPTION: The fix for CVE-2026-47065/ZDRES-232 "resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy",...

UBUNTU-CVE-2026-110870

Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal character...

CVE-2026-110870

Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal character...

CVE-2026-110870

A flaw was found in Nodemailer. A remote attacker can bypass domain allow-lists or cause email delivery failures by submitting specially crafted recipient addresses. Because the address parser fails to properly strip parenthesized comments within formatted email addresses, unvalidated characters...

CVE-2026-110870

Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal character...

CVE-2026-110870 Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments

Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal character...