CVE-2026-72574 picocms Pico - Host Header Injection Enables Script Source Hijacking

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When baseurl is unset the default, Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated...

CVE-2026-72574

The CVE-2026-72574 entry describes a host header injection in Pico CMS (Pico, up to version 2.1.4) where Pico::getBaseUrl() builds the base URL from unvalidated request headers (Host, X-Forwarded-Host, X-Forwarded-Proto, X-Forwarded-Port) when base_url is unset. This allows an unauthenticated rem...

CVE-2026-72574 picocms Pico - Host Header Injection Enables Script Source Hijacking

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When baseurl is unset the default, Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated...

CVE-2026-72574: Improper Neutralization of HTTP Headers for Scripting Syntax

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When baseurl is unset the default, Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated...

PT-2026-69458

Name of the Vulnerable Software and Affected Versions picocms/Pico versions prior to 2.1.5 Description A host header injection issue allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When the base url is unset, the getBaseUrl...

CVE-2026-16197

A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. The affected element is the function handleMessageReceive of the file pkg/channels/feishu/feishu64.go of the component Group Message Handler. Such manipulation leads to missing authorization. The attack can be launched...

CVE-2026-16196

Affected product: Sipeed PicoClaw

CVE-2026-16083

A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This affects the function webhook.ParseRequest of the file pkg/channels/line/line.go of the component LINE Webhook. The manipulation results in authentication bypass by capture-replay. The attack may be launched remotely. The...

CVE-2026-16084

A weakness has been identified in Sipeed PicoClaw up to 0.2.9. This impacts the function webfetch of the file pkg/tools/integration/web.go. This manipulation causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made available to the public and...

CVE-2026-16084

Affected software/hardware: Sipeed PicoClaw (up to version 0.2.9). Vulnerable component: function web_fetch in pkg/tools/integration/web.go. Root cause: manipulation enabling server-side request forgery (SSRF). Impact: remote exploitation possible with low attack complexity and network access; ab...

CVE-2026-16082 Sipeed PicoClaw pipeline_execute.go ExecTool.executeRun toctou

A vulnerability was identified in Sipeed PicoClaw up to 0.2.9. The impacted element is the function ExecTool.executeRun of the file pkg/agent/pipelineexecute.go. The manipulation of the argument cwe leads to time-of-check time-of-use. The attack must be carried out locally. The exploit is publicl...

CVE-2026-16082

Summary of CVE-2026-16082 : Affects Sipeed PicoClaw up to version 0.2.9. The vulnerability is in the function ExecTool.executeRun (file: pkg/agent/pipeline_execute.go) where manipulation of the argument cwe leads to a time-of-check time-of-use issue. Exploitation is local, and a public exploit is...

CVE-2026-16081 Sipeed PicoClaw auth.go cross-site request forgery

A vulnerability was determined in Sipeed PicoClaw up to 0.2.9. The affected element is an unknown function of the file web/backend/api/auth.go. Executing a manipulation can lead to cross-site request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be...

CVE-2025-51678

An issue was discovered in RISC-V PicoRV32 commit 87c89a. A mismatch in the PCPI INSN and memory address can lead to unexpected behavior...

PT-2026-60870

Name of the Vulnerable Software and Affected Versions RISC-V PicoRV32 version 87c89a Description A mismatch between the PCPI INSN and the memory address can result in unexpected behavior. PCPI Processor Control Interface is a mechanism used to handle specific processor control instructions...

CVE-2025-51678

The RISC-V PicoRV32 processor (specifically commit 87c89a ) is affected by a vulnerability where a mismatch between the PCPI INSN and the memory address can lead to unexpected behavior. PCPI is a mechanism used to handle specific processor control instructions. No information regarding a patched ...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the rt.ReloadConfig function when processing the message.send argument. An attacker can cause unauthorized configuration reloads and potentially disrupt service integrity and availability by sending crafted...

CVE-2026-15320 Sipeed PicoClaw pico.go rt.ReloadConfig authorization

A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. This vulnerability affects the function rt.ReloadConfig of the file pkg/channels/pico/pico.go. Performing a manipulation of the argument message.send results in missing authorization. It is possible to initiate the attack remotely. The...

CVE-2026-15320

CVE-2026-15320 affects Sipeed PicoClaw software up to version 0.2.9. The vulnerability targets the function rt.ReloadConfig in the file pkg/channels/pico/pico.go, where manipulation of the message.send argument can bypass authorization. This potentially allows a remote attacker to trigger the iss...

CVE-2026-15319

The CVE-2026-15319 entry concerns Sipeed PicoClaw up to version 0.2.9, where the IPAllowlist function in web/backend/middleware/access_control.go within the Launcher component can be manipulated, leading to improper access controls. This vulnerability is exploitable remotely, and public disclosur...