Threats affecting pkg:github/picocms/Pico

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	6.1	EPSS 0.4%	CVE-2026-72574picocms Pico · Improper Neutralization of HTTP Headers for Scripting Syntax Medium6.1EPSS 0.4%2026-08-10CVE Database V5CVE-2026-72574 CVE-2026-72574 is a host header injection vulnerability in picocms/Pico versions prior to 2.1.5. It allows an unauthenticated remote attacker to manipulate the origin of JavaScript and CSS assets loaded by the default theme by exploiting how the base URL is constructed from unvalidated HTTP headers when base_url is unset. EPSS 0.4%Vulnerability CWE-644 #ghsa-563g-2g6p-xmpf	CVE Database V5	2026-08-10

Page 1 of 1