BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Germondai

CVE-2026-122140: Trawl 1.5.0 before 1.10.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass the MCP outbound URL policy using

CVE-2026-122140 Nov 4, 2026 Source: Vendor

Trawl 1.5.0 before 1.10.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass the MCP outbound URL policy using IPv4-mapped IPv6 addresses. Attackers can supply hex-normalized addresses like ::ffff:7f00:1 directly or via redirects to fetch loopback, private, and cloud metadata services and read responses.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-122140
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

2 lines
All 2 CVEs 2 Additional recognition 0 Unclaimed only
No lines match. , clear filters
Nothing here matches those filters. Clear them to see all 2 lines.