Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-122224

WebVirtCloud through commit bb920b0 Missing Authorization in REST API Migrate and Create Endpoints

WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permission_classes are declared, so Django REST Framework defaults to AllowAny. Attackers can send requests to /api/v1/migrate/ or the compute instance create endpoint to migrate or undefine other users' virtual machines and create volumes and domains on any compute host.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Retspen
Products
Webvirtcloud
CVE-2026-92761

WebVirtCloud Missing Authorization on Instance Control Actions

WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform privileged actions. Attackers with read-only grants can power off virtual machines, reset root passwords, install SSH keys, and manage ISO images by exploiting the get_instance gate that only checks grant existence.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Retspen
Products
Webvirtcloud