SUSE CVE-2026-62941

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check AllowInstanceCreation runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys including...

CVE-2026-62941

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check AllowInstanceCreation runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys including...

CVE-2026-62941

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check AllowInstanceCreation runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys including...

CVE-2026-62941

Incus (system container and VM manager) versions prior to 7.3.0 contain a TOCTOU vulnerability in cross-project instance copying. The AllowInstanceCreation project restriction check executes before the source instance's configuration is merged into the request, allowing dangerous keys such as sec...

EUVD-2026-63951

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check AllowInstanceCreation runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys including...

UBUNTU-CVE-2026-63297

An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction checks before...

CVE-2026-63297 Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge

An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction checks before...

CVE-2026-63297

An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction checks before...

EUVD-2026-57513

An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction checks before...

CVE-2026-63297 Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge

An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction checks before...

CVE-2026-63297 Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge

An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction checks before...

CVE-2026-67618

marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious baseurl in PEP-723 inline script metadata, which is merged into session configuration with higher precedence than the operator's own setting...

Prototype Pollution

Overview org.webjars.npm:jodit is a Jodit is awesome and usefully wysiwyg editor with filebrowser Affected versions of this package are vulnerable to Prototype Pollution via the ConfigMerge and ConfigProto helpers in the configuration code. An attacker can mutate Object.prototype by supplying...