CVE-2026-108372

The LoopX state kernel (versions 0.0.1 through 0.4.5 ) is vulnerable to a permissive CORS policy in the loopx/status_server.py component. Specifically, the loopx serve-status command uses StatusRequestHandler._send_json() and do_OPTIONS() to send Access-Control-Allow-Origin: * for unauthenticated...