cve-2024-10220-test

CVE-2024-10220 Test Repository This repository is used for testing CVE-2024-10220 Kubernetes gitRepo volume vulnerability as part of HPC security research at the University of Central Oklahoma. WARNING: This repository contains a malicious Git hook for controlled security testing. Do not use in...

virt-firmware

Tools for ovmf / armvirt firmware volumes This is a small collection of tools for edk2 firmware images. They support decoding and printing the content of firmware volumes. Variable stores OVMFVARS.fd can be modified, for example to enroll secure boot certificates. virt-fw-dump Decodes and prints...

CVE-2026-127080

OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. Attackers can set the host path to / in the Define HostPath Volume configuration to mount th...

EUVD-2026-125102

OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. Attackers can set the host path to / in the Define HostPath Volume configuration to mount th...

CVE-2026-127080

OpsTree BuildPiper versions before 2.7.0 are vulnerable to an improper authorization flaw allowing authenticated deploy users to define arbitrary Kubernetes hostPath volumes without policy checks. By setting the host path to / in the Define HostPath Volume configuration, an attacker can mount the...

CVE-2026-127080 OpsTree BuildPiper before 2.7.0 Container Escape via Unrestricted HostPath Volumes

OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. Attackers can set the host path to / in the Define HostPath Volume configuration to mount th...

CVE-2026-124501: Tidelift moto: A weakness has been identified in Tidelift moto up to 5.2.4

A weakness has been identified in Tidelift moto up to 5.2.4. Affected is an unknown function of the file moto/batch/models.py of the component AWS Batch Emulation. This manipulation of the argument privileged/volumes causes improper privilege management. Remote exploitation of the attack is...

CVE-2026-124431

Craft CMS from 5.10.0 before 5.11.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to browse volumes they lack permissions for. Attackers can delete a linked asset and use the replacement volume browser modal to view directory structures of all...

EUVD-2026-119569

Craft CMS from 5.10.0 before 5.11.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to browse volumes they lack permissions for. Attackers can delete a linked asset and use the replacement volume browser modal to view directory structures of all...

PT-2026-139947

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.10.0 through 5.11.1 Description An authorization bypass allows authenticated users with low privileges to browse volumes for which they lack permissions. By deleting a linked asset and utilizing the replacement volume...

CVE-2026-124431: craftcms cms: Craft CMS from 5.10.0 before 5.11.2 contains an authorization bypass vulnerability that allows authenticated…

Craft CMS from 5.10.0 before 5.11.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to browse volumes they lack permissions for. Attackers can delete a linked asset and use the replacement volume browser modal to view directory structures of all...

CVE-2026-122224

A flaw was found in WebVirtCloud. Missing access controls on virtual machine management endpoints allow authenticated low-privileged users to manipulate or delete virtual machines belonging to other users. By submitting requests directly to unprotected REST API Application Programming Interface...

EUVD-2026-39788

lxd allows Cross-guest volume hijack via DevLXD device patch...

CVE-2026-120460 Jpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker Controllers

Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any workspace can control containers, images, volumes and networks...

CVE-2026-120460

The Jpom application (versions through 2.11.12 ) is vulnerable to a cross-workspace authorization bypass via Docker controllers. Authenticated users with Docker permissions in any workspace can manage Docker hosts belonging to other workspaces by providing foreign Docker asset ids . This vulnerab...

CLEANSTART-2026-KJ76524 Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes

Security vulnerability affects the nodetaint package. The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes...

Linux Distros Unpatched Vulnerability : CVE-2026-115376

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omittin...

UBUNTU-CVE-2026-115376

Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type. Attackers can send crafted POST requests to the custom volumes endpoint with a chosen source.project to copy and read othe...

CVE-2026-115376

Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type. Attackers can send crafted POST requests to the custom volumes endpoint with a chosen source.project to copy and read othe...

DEBIAN-CVE-2026-115376

Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type. Attackers can send crafted POST requests to the custom volumes endpoint with a chosen source.project to copy and read othe...