clawk

코딩 에이전트에게 당신의 머신이 아닌, 전용 임시 Linux 머신을 주세요. -lightgrey 설치 · 빠른 시작 · 왜 VM인가? · 작동 방식 · 비교 · FAQ · 문서 코딩 에이전트는 실제로 작업 을 하게 할 때만 유용합니다: 패키지 설치, 작성한 코드 실행, 서버 시작, 네트워크 사용. 당신의 머신에서는 두 가지 나쁜 선택지가 남습니다. 모든 명령을 승인하거나몇 초마다 프롬프트를 지켜봐야 함, --dangerously-skip-permissions를 실행하고 중요한 것이 rm -rf 한 번이나 토큰 유출 하나로 사라...

CVE-2026-92598

A flaw was found in Nodemailer. This vulnerability arises from the failure to properly apply UTS-46 normalization when encoding international domain names. A remote attacker can exploit this by crafting recipient addresses with invisible characters or compatibility mappings. This allows them to...

XStream 1.4.18 - Remote Code Execution

XStream 1.4.18 is susceptible to remote code execution. An attacker can execute commands of the host by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the...

EUVD-2026-81298

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

CVE-2026-92598

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

CVE-2026-92598 Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

CVE-2026-92598 Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

CVE-2026-92598 Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

CVE-2026-92598

Nodemailer before 9.1.0 (a widely used Node.js mail library) fails to apply UTS-46 normalization when encoding international domain names. This causes the library's internal domain resolver to compute a different Punycode A-label than standards-compliant parsers. An attacker can craft recipient a...

cve-2026-22874-gitea-ssrf-allowlist

CVE-2026-22874 — Gitea 웹훅 및 마이그레이션 허용 목록의 불완전한 SSRF 보호 CVE-2026-22874 GHSA-2r5c-gw76-rh3w에 대한 기술적 분석 및 참고 자료: Gitea의 웹훅 전달 및 저장소 마이그레이션에서 불완전한 SSRF 허용 목록, Gitea 1.26.3 에서 수정됨. 저는 이 SSRF 클래스를 Gitea 유지관리자에게 독립적으로 보고했으며, 공개된 권고에서 기여자other로 인정받았습니다. 권고의 주요 보고자는 J. Leitschuh입니다. 이 저장소는 공개 권고에 대한 방어적이고...

grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default

A flaw in Grafana's Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation...

Important: Red Hat Security Advisory: grafana security update

An update for grafana is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default

A flaw in Grafana's Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation...

RHEL 9 : grafana (RHSA-2026:67518)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67518 advisory. Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: crypto/x509:...

CVE-2026-54529

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sortquery in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured columnsortablelist server-side allow-list in self.sortfields. The value is...

UBUNTU-CVE-2026-89259

Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration --allow-addons, --allow-child-process, --allow-worker. As a result, the...

EUVD-2026-76071

Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration --allow-addons, --allow-child-process, --allow-worker. As a result, the...

Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain

Summary Nodemailer resolves an international IDN / non-ASCII recipient domain to a different Punycode xn-- label than every UTS‑46‑conformant parser web browsers, the WHATWG URL Standard, Node's url.domainToASCII, Python's idna. Its address normalizer normalizeAddress in lib/mime-node/index.js us...

GHSA-WMMP-3585-3RMP Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain

Summary Nodemailer resolves an international IDN / non-ASCII recipient domain to a different Punycode xn-- label than every UTS‑46‑conformant parser web browsers, the WHATWG URL Standard, Node's url.domainToASCII, Python's idna. Its address normalizer normalizeAddress in lib/mime-node/index.js us...

CVE-2026-82586

Improper Protection of Alternate Path vulnerability in ash-project ashlua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action's...