CVE-2026-108372High· 7.1▾ MidnightPoC availableOpen and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5, `loopx serve-status` in `loopx/status_server.py` uses `StatusRequestHandler._send_json()` …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 39.1 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 17.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Last analysed / modified upstream
Exploit / PoC code exists
0.2% → 0.3%
Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5, loopx serve-status in loopx/status_server.py uses StatusRequestHandler._send_json() and do_OPTIONS() to send Access-Control-Allow-Origin: * for unauthenticated responses on predictable loopback ports. A remote attacker can cause an operator who visits attacker-controlled web content to issue cross-origin requests to GET /status.json, GET /review-material?goal_id=...&path=..., GET /, and POST /control-plane/configure-goal/dry-run, exposing control-plane state, goal and run information, local absolute paths, private Markdown files below registered goal roots, and dry-run configuration projections. The affected routes do not provide cross-origin writes or arbitrary-file access. This issue is fixed in version 0.4.5.
loopx >= 0.0.1, < 0.4.5Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
loopx >= 0.0.1, < 0.4.5Patched in:
loopx 0.4.5Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-57112High· 8.3PraisonAI is a multi-agent teams system
CVE-2026-110737Low· 2.3Push Endpoint Returns Permissive CORS Headers
CVE-2026-83813Low· 3.1Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation
CVE-2026-55842Medium· 5.4Scoold is a Q&A and a knowledge sharing platform for teams
CVE-2026-107295High· 7.6Pydantic AI is a Python agent framework for building applications and workflows with Generative AI
CVE-2026-107292Medium· 6.4Pydantic AI is a Python agent framework for building applications and workflows with Generative AI