CVE Vulnerability Catalog

Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).createDependentVolumesFromBackup` in `internal/server/storage/backend.go` contains a cluster of unguarded pointer derefs on every dependent-volume entry's `VolumeSnapshots[i]`, `Volume`, and `Pool` sub-fields. An authenticated user with `can_create_instances` permission on any project can crash the `incusd` daemon by uploading an instance backup tarball whose `dependent_volumes[*]` block contains a nil snapshot pointer (or omits `volume:` / `pool:`). This is a sibling-field variant of the 2026-05-04 batch fix `d768f81c0a1d985f35ae56219519822b080bf5e3` ("Properly check dependent volumes on import"). That commit added `if disk == nil` at the top of the outer loop, but did not guard the four sub-pointer fields the loop body dereferences naked. Version 7.1.0 contains an updated patch.

Incus prior to version 7.1.0 has a path traversal vulnerability in the S3 protocol upload endpoint, allowing creation of arbitrary files on the host. This could lead to arbitrary command execution. Version 7.1.0 fixes the issue.

Incus prior to version 7.2.0 allows a specially crafted image or instance backup to read or create/write arbitrary files on the host, possibly leading to arbitrary command execution. Version 7.2.0 patches the issue.

Incus prior to version 7.2.0 ignores the `restricted.containers.lowlevel=block` setting for instance snapshots, allowing arbitrary command execution on the Incus server by abusing lowlevel hooks such as `raw.lxc` and `raw.qemu`. Version 7.2.0 patches the issue.

Incus prior to version 7.2.0 has a vulnerability in the `record-output` parameter of the `/instances/$name/exec` endpoint, where if `exec-output` is a symlink, files named `exec_UUID.stdout` and `exec_UUID.stderr` can be written to an arbitrary location, with the `.stdout` file containing arbitrary content. This can be abused for arbitrary command execution. Version 7.2.0 contains a patch.

Incus prior to version 7.2.0 allows a specially crafted image to read or create/write arbitrary files on the host, possibly leading to arbitrary command execution. Version 7.2.0 fixes the issue.

Incus before version 7.1.0 has a nil-pointer dereference vulnerability in `(*backend).CreateInstanceFromBackup`. An authenticated user with permission to create instances can remotely trigger a crash of the Incus daemon by uploading a crafted backup tarball, causing denial of service to all projects on that cluster member.

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyse_resultat_skel.

OMEN Gaming Hub versions prior to 1101.2608.0.0 have a vulnerability that could allow a local attacker to escalate privileges due to insufficient access controls.

The PassPortal browser extension by N-able before version 3.49.6 has a vulnerability allowing vault token disclosure via unvalidated postMessage, enabling authentication abuse.

Roskus Prospero Flow CRM versions 4.9.1 through 5.14.0 have an authorization bypass vulnerability via user-controlled key in the transaction save endpoint. A user with transaction creation permissions can disclose another company's bank account name, bank name, and card last four digits by providing a foreign `bank_account_id` or `bank_card_id` in POST /transaction/save.

The Joomla extension Zoo (from yootheme.com) before version 4.1.66 has a reflected XSS and open redirect vulnerability via the submission redirect parameter.

YOOtheme Pro for Joomla versions 1.0.0-5.0.40 contains an SQL injection vulnerability that allows any contributor-level user to inject own content into SQL queries.

Joomla Extension - yootheme.com - Zoo prior to version 4.1.66 has unauthenticated stored XSS. User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector.

The Joomla extension Zoo (from yootheme.com) before version 4.1.66 has an unauthenticated arbitrary directory listing vulnerability via the Gallery element.

Joomla Extension - yootheme.com - YOOtheme Pro 2.3.0-5.0.40 has authenticated, privileged arbitrary file read. The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files.

Apache CloudStack versions 4.7.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 have a missing release of resource after effective lifetime vulnerability in the scoped global configuration functionality. This may lead to denial of service (DoS) for the management server.

Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points, and nothing binds the value to the caller. A client can name another user's identifier and read or write that user's stored LLM memory. The fix introduces a single resolve_memory_identity seam that honors the header only for loopback or allowlisted callers and otherwise binds the identity to the proxy-token fingerprint or the operating system user. The pip console script binds 127.0.0.1 by default, but the reference docker-compose.yml ships --host 0.0.0.0 with published ports and no required HEADROOM_PROXY_TOKEN, exposing the affected data-plane routes to the network without authentication.

Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header. No check rejects loopback, link-local, or RFC 1918 destinations, so requests reach internal services and cloud metadata addresses. The Authorization header is forwarded unchanged to the caller-designated host. The reference docker-compose.yml exposes ports without required token, increasing risk.

Roskus Prospero Flow CRM versions 5.0.0 through 5.3.5 have an authorization bypass through user-controlled key in the transaction API. An authenticated user can read transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/{id}, without company scoping or permission check.