CVE-2026-86335 LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse

Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests...

CVE-2026-86335 LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse

Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests...

CVE-2026-86335 LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse

Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests...

CVE-2026-100618: Authorization Bypass Through User-Controlled Key

Capgo capgo.app is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled icon value, normalizes it, and stores it in public.apps.iconurl without verifying that the image path belongs to the target app's own image namespace e.g...

PT-2026-99289

Name of the Vulnerable Software and Affected Versions Capgo capgo.app affected versions not specified Description An authorization flaw exists in the app icon update process. The 'PUT /app/:id' endpoint accepts a user-controlled icon value and stores it in public.apps.icon url without verifying i...

Exploit for CVE-2026-27771

CVE-2026-27771 — Gitea Container Registry Auth Bypass CVSS:...

PT-2023-14936

Name of the Vulnerable Software and Affected Versions Harbor versions 1.X.X through 2.5.3 Description An access control issue allows attackers to access public and private image repositories without authentication. The vendor states this behavior is documented as a feature. There is no informatio...

GHSA-XPV7-93CM-4MXV img_auth.php may leak private extension images into the public cache

In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the imgauth.php image authorization security feature may have had their files cached publicly, so any unauthorized user could view them. This occurs because...

PT-2012-3364

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 7.14 Description The issue concerns the image module in Drupal, where it fails to properly check permissions when caching derivative image styles of private images. This allows remote attackers to read private image...

CVE-2012-1591: Undefined Security Weakness

The image module in Drupal 7.x before 7.14 does not properly check permissions when caching derivative image styles of private images, which allows remote attackers to read private image styles...

CVE-2010-1190

thumb.php in MediaWiki before 1.15.2, when used with access-restriction mechanisms such as imgauth.php, does not check user permissions before providing scaled images, which allows remote attackers to bypass intended access restrictions and read private images via unspecified manipulations...