clawk

Give a coding agent its own disposable Linux machine, not yours. -lightgrey Install · Quickstart · Why a VM? · How it works · Compared to · FAQ · Docs A coding agent is only useful when you let it actually do things: install packages, run the code it writes, start servers, use the network. On you...

Exploit for CVE-2026-107360

CVE-2026-107360 — rubygem-safemode compound-assignment Jail al...

CVE-2026-126982

A type allow-list bypass in the BSON serialization library of the MongoDB C Driver allows a type-restriction check to be circumvented when polymorphic data is deserialized into loosely typed members. An unauthorized party who can supply or plant BSON/JSON data that the application later...

EUVD-2026-124807

A type allow-list bypass in the BSON serialization library of the MongoDB C Driver allows a type-restriction check to be circumvented when polymorphic data is deserialized into loosely typed members. An unauthorized party who can supply or plant BSON/JSON data that the application later...

CVE-2026-126982

The MongoDB C# Driver BSON serialization library contains a type allow-list bypass vulnerability. This flaw allows an attacker to circumvent type-restriction checks when polymorphic data is deserialized into loosely typed members. By supplying or planting malicious BSON/JSON data, an unauthorized...

CVE-2026-126982 Remote code execution via generic-type allow-list bypass in BSON object deserialization

A type allow-list bypass in the BSON serialization library of the MongoDB C Driver allows a type-restriction check to be circumvented when polymorphic data is deserialized into loosely typed members. An unauthorized party who can supply or plant BSON/JSON data that the application later...

CVE-2026-126356: honojs hono: Hono is a Web application framework that provides support for any JavaScript runtime

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.5.1 until 4.13.16, validator'form' uses a strict whole-header pattern that fails to recognize multipart/form-data when its Content-Type includes another legal parameter or extra whitespace after a...

PT-2026-146100

A type allow-list bypass in the BSON serialization library of the MongoDB C Driver allows a type-restriction check to be circumvented when polymorphic data is deserialized into loosely typed members. An unauthorized party who can supply or plant BSON/JSON data that the application later...

CVE-2026-126839

A deserialization type-restriction control in the BSON serialization component can be bypassed because the check for compiler-generated types uses an overly permissive heuristic instead of precise identification. An unauthorized party can provide BSON content that, when deserialized into a loosel...

CVE-2026-126839 Deserialization allow-list bypass via anonymous-type misdetection in BSON object deserialization

A deserialization type-restriction control in the BSON serialization component can be bypassed because the check used to recognize a class of compiler-generated types relies on an overly permissive heuristic rather than a precise identification. An unauthorized party able to supply BSON content...

rubygem-safemode: safemode: Jail allow-list bypass via op-assign expressions

A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument methods on objects exposed to the template...

rubygem-safemode: safemode: Jail allow-list bypass via op-assign expressions

A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument methods on objects exposed to the template...

rubygem-safemode: safemode: Jail allow-list bypass via op-assign expressions

A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument methods on objects exposed to the template...

CVE-2026-107360

A vulnerability exists in rubygem-safemode where compound assignment expressions in sandboxed code bypass the Jail allow-list . This allows an authenticated attacker capable of supplying template content to invoke arbitrary no-argument methods on objects exposed to the template renderer. Potentia...

CVE-2026-107360 Rubygem-safemode: safemode: jail allow-list bypass via op-assign expressions

A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument methods on objects exposed to the template...

cve-2026-22874-gitea-ssrf-allowlist

CVE-2026-22874 — Incomplete SSRF protection in Gitea webhook and migration allow-list Technical writeup and references for CVE-2026-22874 GHSA-2r5c-gw76-rh3w: an incomplete SSRF allow-list in Gitea's webhook delivery and repository migration, fixed in Gitea 1.26.3. I independently reported this...

grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default

A flaw in Grafana's Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation...

Important: Red Hat Security Advisory: grafana security update

An update for grafana is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default

A flaw in Grafana's Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation...

CVE-2026-125755 Nodemailer 3.0.0 before 10.4.1 Recipient Allow-List Bypass via addressparser

Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in addressparser that truncates domains at folding whitespace or comments before a dot, allowing attackers to bypass recipient domain restrictions. Attackers can submit crafted to, cc, bcc or replyTo addresses that pass RFC 5322 doma...