CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository

CVE-2026-75911

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in

历史摘要 · 未重新核验 · GitHub Advisory

CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)

CVE-2026-75858

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in

历史摘要 · 未重新核验 · GitHub Advisory

CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval

CVE-2026-75912

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in

历史摘要 · 未重新核验 · GitHub Advisory

CodeWhale: SSRF‌ bypass - TOCTOU on DNS failure for DNS pinning

CVE-2026-75856

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in

历史摘要 · 未重新核验 · GitHub Advisory

CodeWhale: js_execution leaks parent environment to model context via missing env scrub

CVE-2026-75915

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in

历史摘要 · 未重新核验 · GitHub Advisory

CodeWhale: Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval

CVE-2026-75913

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in

历史摘要 · 未重新核验 · GitHub Advisory

CodeWhale: exec_shell_interact sends LLM-controlled input to a running shell without an approval prompt (privilege escalation)

CVE-2026-75857

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in

历史摘要 · 未重新核验 · GitHub Advisory

CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository

CVE-2026-75859

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in

历史摘要 · 未重新核验 · GitHub Advisory

CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes

CVE-2026-75914

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in

历史摘要 · 未重新核验 · GitHub Advisory

SurrealDB allows bypass of deny-net flags via DNS resolution

CVE-2025-71390

SurrealDB offers http functions that can access external network endpoints. A typical, albeit [not recommended ](https:/

历史摘要 · 未重新核验 · GitHub Advisory

Hurl: Cookies in Cookies section leak when redirecting to a different host

CVE-2026-63481

## The Bug Hurl <= 8.0.1 lets you define cookies two ways in a .hurl file: 1. As a raw Cookie: header in the [Header]/

历史摘要 · 未重新核验 · GitHub Advisory

Wasmtime has a leak in WASIp1 `fd_renumber` implementation

CVE-2026-54786

### Impact Wasmtime's native implementation of WASIp1 suffers from a leak in the `fd_renumber` function where the file

历史摘要 · 未重新核验 · GitHub Advisory

mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)

CVE-2026-55663

### Summary mediasoup's built-in SCTP stack (introduced in v3.20.0) authenticates SCTP state cookies using only hardcod

历史摘要 · 未重新核验 · GitHub Advisory

vibeio-http has a DoS vulnerability in HTTP/1.x chunked encoding parser triggered by maliciously crafted chunk lengths

When using the affected versions of the `vibeio-http` crate, an attacker could craft a malicious HTTP/1.x request with a

历史摘要 · 未重新核验 · GitHub Advisory

tokio-postgres: Panic on a `DataRow` with fewer fields than columns allows denial of service

A malicious or compromised server can send a row containing fewer fields than its row description declares columns. Read

历史摘要 · 未重新核验 · GitHub Advisory

postgres-protocol: Panic decoding a malformed `hstore` value allows denial of service

A malicious or compromised server can return a binary `hstore` value with an invalid internal length field, causing the

历史摘要 · 未重新核验 · GitHub Advisory

postgres-protocol: Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service

A malicious, compromised, or man-in-the-middle server can supply an arbitrarily large SCRAM-SHA-256 PBKDF2 iteration cou

历史摘要 · 未重新核验 · GitHub Advisory

Rust for Secure Backend Development: A Critical Review and Extended Vulnerability Comparison with Node.js and Django

该论文对 Rust 在安全后端开发中的适用性进行了批判性回顾与扩展性漏洞比较。作者首先回顾了既有关于 Rust 安全性的工业研究，指出现有分类法（基于 SANS Top 25、OWASP Top 10 和 19 Deadly Sins 框架

历史摘要 · 未重新核验 · arXiv cs.CR

block_buffer: panic corrupts inline buffer position

### Summary A caught panic may leave the cursor position of `EagerBuffer` or `ReadBuffer` in a corrupted state; this in

历史摘要 · 未重新核验 · GitHub Advisory

Triton VM Soundness Vulnerability due to Missing Constraint

The instruction `sponge_absorb_mem` Triton VM fails to verify that hashed values come from the claimed memory location.

历史摘要 · 未重新核验 · GitHub Advisory