CVE-2026-62941

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check AllowInstanceCreation runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys including...

CVE-2026-62940

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configuration overrides including security-critical keys like security.privileged and raw.lxc are applied without any project restriction enforcemen...

CVE-2026-62941 Incus: Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check AllowInstanceCreation runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys including...

CVE-2026-62941 Incus: Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check AllowInstanceCreation runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys including...

CVE-2026-62941

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check AllowInstanceCreation runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys including...

CVE-2026-62941

Incus (system container and VM manager) versions prior to 7.3.0 contain a TOCTOU vulnerability in cross-project instance copying. The AllowInstanceCreation project restriction check executes before the source instance's configuration is merged into the request, allowing dangerous keys such as sec...

EUVD-2026-63951

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check AllowInstanceCreation runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys including...

CVE-2026-62941 Incus: Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check AllowInstanceCreation runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys including...

CVE-2026-62940 Incus has a project restriction bypass via instance migration config override

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configuration overrides including security-critical keys like security.privileged and raw.lxc are applied without any project restriction enforcemen...

CVE-2026-62940

Incus (a system container and virtual machine manager) prior to version 7.3.0 is vulnerable to a project restriction bypass during instance migration. When migrating an instance to another cluster member, user-supplied configuration overrides—including security-critical keys such as security.priv...

CVE-2026-62940 Incus has a project restriction bypass via instance migration config override

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configuration overrides including security-critical keys like security.privileged and raw.lxc are applied without any project restriction enforcemen...

CVE-2026-62313

Incus is a system container and virtual machine manager. Prior to version 7.3.0, project-level enforcement of restricted.containers.privilege=isolated can be trivially bypassed, allowing a user to create a non-isolated shared host idmap container in a project that is configured to forbid them. Th...

CVE-2026-72848 langchain-community SitemapLoader Does Not Apply restrict_to_same_domain to Nested Sitemap Index Entries, Allowing Server-Side Request Forgery

SitemapLoader.parsesitemap in langchaincommunity/documentloaders/sitemap.py applies the documented restricttosamedomain control only to leaf url entries. The loop over url elements filters cross-domain locations, but the loop over nested sitemap elements passes the child loc straight to...

CVE-2026-72848 langchain-community SitemapLoader Does Not Apply restrict_to_same_domain to Nested Sitemap Index Entries, Allowing Server-Side Request Forgery

SitemapLoader.parsesitemap in langchaincommunity/documentloaders/sitemap.py applies the documented restricttosamedomain control only to leaf url entries. The loop over url elements filters cross-domain locations, but the loop over nested sitemap elements passes the child loc straight to...

EUVD-2026-63570

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor...

CVE-2026-53783

A time-of-check to time-of-use TOCTOU race condition flaw in the rrsync restricted shell wrapper allows authenticated remote attackers to escape directory restrictions. By replacing a validated path component with a symbolic link prior to file transfer execution, an attacker can bypass intended...

MobSF has SSRF port restriction bypass in assetlinks_check

Summary MobSF's Android App Link assetlinks checker validates only the manifest android:host value with validhost, but then appends the separate android:port value into the URL used for the server-side request. This bypasses the current port restriction in validhost and lets a crafted APK cause...

CVE-2026-68927

MobSF (Mobile Security Framework) prior to 4.5.1 contains an SSRF port restriction bypass in the Android App Link assetlinks checker. The function get_browsable_activities in manifest_analysis.py validates only the android:host value via valid_host(), but appends a separately supplied android:por...

EUVD-2026-58797

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to write arbitrary files due to improper limitation of a pathname to a restricted directory...

CVE-2026-17079 IBM Db2 Mirror for i is affected by multiple vulnerabilities

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to the ability to disable server-side input validation via a request parameter...