CVE Vulnerability Catalog

Incus before version 7.1.0 has a nil-pointer dereference vulnerability in `(*backend).CreateInstanceFromBackup`. An authenticated user with permission to create instances can remotely trigger a crash of the Incus daemon by uploading a crafted backup tarball, causing denial of service to all projects on that cluster member.

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyse_resultat_skel.

OMEN Gaming Hub versions prior to 1101.2608.0.0 have a vulnerability that could allow a local attacker to escalate privileges due to insufficient access controls.

The PassPortal browser extension by N-able before version 3.49.6 has a vulnerability allowing vault token disclosure via unvalidated postMessage, enabling authentication abuse.

Roskus Prospero Flow CRM versions 4.9.1 through 5.14.0 have an authorization bypass vulnerability via user-controlled key in the transaction save endpoint. A user with transaction creation permissions can disclose another company's bank account name, bank name, and card last four digits by providing a foreign `bank_account_id` or `bank_card_id` in POST /transaction/save.

The Joomla extension Zoo (from yootheme.com) before version 4.1.66 has a reflected XSS and open redirect vulnerability via the submission redirect parameter.

YOOtheme Pro for Joomla versions 1.0.0-5.0.40 contains an SQL injection vulnerability that allows any contributor-level user to inject own content into SQL queries.

Joomla Extension - yootheme.com - Zoo prior to version 4.1.66 has unauthenticated stored XSS. User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector.

The Joomla extension Zoo (from yootheme.com) before version 4.1.66 has an unauthenticated arbitrary directory listing vulnerability via the Gallery element.

Joomla Extension - yootheme.com - YOOtheme Pro 2.3.0-5.0.40 has authenticated, privileged arbitrary file read. The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files.

Apache CloudStack versions 4.7.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 have a missing release of resource after effective lifetime vulnerability in the scoped global configuration functionality. This may lead to denial of service (DoS) for the management server.

Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points, and nothing binds the value to the caller. A client can name another user's identifier and read or write that user's stored LLM memory. The fix introduces a single resolve_memory_identity seam that honors the header only for loopback or allowlisted callers and otherwise binds the identity to the proxy-token fingerprint or the operating system user. The pip console script binds 127.0.0.1 by default, but the reference docker-compose.yml ships --host 0.0.0.0 with published ports and no required HEADROOM_PROXY_TOKEN, exposing the affected data-plane routes to the network without authentication.

Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header. No check rejects loopback, link-local, or RFC 1918 destinations, so requests reach internal services and cloud metadata addresses. The Authorization header is forwarded unchanged to the caller-designated host. The reference docker-compose.yml exposes ports without required token, increasing risk.

Roskus Prospero Flow CRM versions 5.0.0 through 5.3.5 have an authorization bypass through user-controlled key in the transaction API. An authenticated user can read transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/{id}, without company scoping or permission check.

The Joomla extension Zoo (from yootheme.com) before version 4.1.66 has missing CSRF tokens on front-end state changes, enabling CSRF attacks.

Spring AI versions 2.0.0, 1.1.0-1.1.8, and 1.0.0-1.0.9 have a vulnerability in tool calling support where the per-request tool list is not fully enforced. Under certain conditions, a tool not made available to the current request could be invoked, potentially leading to privilege escalation.

In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be shared across unrelated contexts. Affected versions: Spring AI 2.0.0.

The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not limit the number of sessions it retains and by default does not require client authentication. A remote attacker can cause unbounded session accumulation, gradually exhausting memory and leading to Denial of Service (DoS) for all legitimate clients. Affects Spring AI version 2.0.0.

The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauthenticated attackers to store shortcodes that are then executed when the page is viewed, disclosing a chosen user's email address, login and registration date.

The Limit Login Attempts Reloaded WordPress plugin before version 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway.