https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-06T05:02:53.642097+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-72574 CVE-2026-72574 — picocms Pico - Host Header Injection Enables Script Source Hijacking 2026-10-06T05:02:53.657365+00:00

Affected: picocms Pico

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When base_url is unset (the default), Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port request headers.