github.com/lxc/incus/v6
Powerful system container and virtual machine manager
View on Github
Activity
- Latest release
- 5mo ago
- Total releases
- 20
- Cadence
- ~28 days
- Last 12 months
- 7
Reach
- Stars
- 6.1k
Details
- First release
- Oct 03, 2024
| Version | Released | |
|---|---|---|
v6.23.0
minor
24 CVEs
CVE-2026-55621
GO-2026-6318
GHSA-64f3-v33m-w89f
Sep 02, 2026
Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-55622
GO-2026-6319
GHSA-c9f5-j9c3-mhrg
Sep 02, 2026
Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus References
Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-48753
GO-2026-5802
GHSA-ccjc-4qc3-jxqc
Jul 07, 2026
Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48754
GO-2026-5800
GHSA-4xg6-52mh-fpw8
Jul 07, 2026
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48750
GO-2026-5801
GHSA-73hr-m85f-64v9
Jul 07, 2026
Incus has an arbitrary file write on host via `exec-output` symlink in crafted image in github.com/lxc/incus Incus has an arbitrary file write on host via Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48749
GO-2026-5798
GHSA-2q3f-q5pq-g8wv
Jul 07, 2026
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48755
GO-2026-5808
GHSA-v6mj-8pf4-hhw4
Jul 07, 2026
Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48756
GO-2026-5810
GHSA-xhqx-mgh3-3h7q
Jul 07, 2026
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48752
GO-2026-5803
GHSA-vxp5-584q-c479
Jul 07, 2026
Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48751
GO-2026-5799
GHSA-48q5-w887-33wv
Jul 07, 2026
Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48769
GO-2026-5806
GHSA-f6m5-xw2g-xc4x
Jul 07, 2026
Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-41684
GO-2026-5742
GHSA-x5r6-jr56-89pv
Jun 25, 2026
Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40197
GO-2026-5612
GHSA-r7w7-mmxr-47r9
Jun 25, 2026
Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41685
GO-2026-5280
GHSA-98vh-x9cx-9cfp
Jun 25, 2026
Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41647
GO-2026-5384
GHSA-fwj8-62r8-8p8m
Jun 25, 2026
Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40195
GO-2026-5397
GHSA-gc7j-g665-rxr9
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40243
GO-2026-5319
GHSA-c839-4qxr-j4x3
Jun 25, 2026
Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-47753
GO-2026-5252
GHSA-8g7m-96c8-8wwc
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-35527
GO-2026-5254
GHSA-8gw4-p4wq-4hcv
Jun 25, 2026
Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41648
GO-2026-5168
GHSA-67wx-r9xr-x75x
Jun 25, 2026
Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40251
GO-2026-5127
GHSA-4m88-wxj4-9qj6
Jun 25, 2026
Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-23954
GO-2026-4357
GHSA-7f67-crqm-jgh7
Feb 05, 2026
Incus container image templating arbitrary host file read and write in github.com/lxc/incus Incus container image templating arbitrary host file read and write in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2026-23953
GO-2026-4359
GHSA-x6jc-phwx-hp32
Feb 05, 2026
Incus container environment configuration newline injection in github.com/lxc/incus Incus container environment configuration newline injection in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2025-64507
GO-2025-4115
GHSA-56mx-8g9f-5crf
Nov 17, 2025
Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus References Updated Mar 03, 2026 · Source: OSV.dev |
v6.23.0
minor
Dependencies (67)
+ 59 more |
|
v6.22.0
minor
30 CVEs
CVE-2026-55621
GO-2026-6318
GHSA-64f3-v33m-w89f
Sep 02, 2026
Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-55622
GO-2026-6319
GHSA-c9f5-j9c3-mhrg
Sep 02, 2026
Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus References
Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-48753
GO-2026-5802
GHSA-ccjc-4qc3-jxqc
Jul 07, 2026
Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48754
GO-2026-5800
GHSA-4xg6-52mh-fpw8
Jul 07, 2026
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48750
GO-2026-5801
GHSA-73hr-m85f-64v9
Jul 07, 2026
Incus has an arbitrary file write on host via `exec-output` symlink in crafted image in github.com/lxc/incus Incus has an arbitrary file write on host via Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48749
GO-2026-5798
GHSA-2q3f-q5pq-g8wv
Jul 07, 2026
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48755
GO-2026-5808
GHSA-v6mj-8pf4-hhw4
Jul 07, 2026
Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48756
GO-2026-5810
GHSA-xhqx-mgh3-3h7q
Jul 07, 2026
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48752
GO-2026-5803
GHSA-vxp5-584q-c479
Jul 07, 2026
Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48751
GO-2026-5799
GHSA-48q5-w887-33wv
Jul 07, 2026
Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48769
GO-2026-5806
GHSA-f6m5-xw2g-xc4x
Jul 07, 2026
Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-41684
GO-2026-5742
GHSA-x5r6-jr56-89pv
Jun 25, 2026
Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40197
GO-2026-5612
GHSA-r7w7-mmxr-47r9
Jun 25, 2026
Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41685
GO-2026-5280
GHSA-98vh-x9cx-9cfp
Jun 25, 2026
Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41647
GO-2026-5384
GHSA-fwj8-62r8-8p8m
Jun 25, 2026
Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40195
GO-2026-5397
GHSA-gc7j-g665-rxr9
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40243
GO-2026-5319
GHSA-c839-4qxr-j4x3
Jun 25, 2026
Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-47753
GO-2026-5252
GHSA-8g7m-96c8-8wwc
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-35527
GO-2026-5254
GHSA-8gw4-p4wq-4hcv
Jun 25, 2026
Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41648
GO-2026-5168
GHSA-67wx-r9xr-x75x
Jun 25, 2026
Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40251
GO-2026-5127
GHSA-4m88-wxj4-9qj6
Jun 25, 2026
Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-33542
GO-2026-4882
GHSA-p8mm-23gg-jc9r
Apr 07, 2026
Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Fixed in
6.23.0
References
Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33898
GO-2026-4879
GHSA-453r-g2pg-cxxq
Apr 07, 2026
Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33945
GO-2026-4884
GHSA-q4q8-7f2j-9h9f
Apr 07, 2026
Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33743
GO-2026-4886
GHSA-vg76-xmhg-j5x3
Apr 07, 2026
Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33897
GO-2026-4881
GHSA-83xr-5xxr-mh92
Apr 07, 2026
Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33711
GO-2026-4885
GHSA-q9vp-3wcg-8p4x
Apr 07, 2026
Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-23954
GO-2026-4357
GHSA-7f67-crqm-jgh7
Feb 05, 2026
Incus container image templating arbitrary host file read and write in github.com/lxc/incus Incus container image templating arbitrary host file read and write in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2026-23953
GO-2026-4359
GHSA-x6jc-phwx-hp32
Feb 05, 2026
Incus container environment configuration newline injection in github.com/lxc/incus Incus container environment configuration newline injection in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2025-64507
GO-2025-4115
GHSA-56mx-8g9f-5crf
Nov 17, 2025
Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus References Updated Mar 03, 2026 · Source: OSV.dev |
v6.22.0
minor
Dependencies (66)
+ 58 more |
|
v6.21.0
minor
30 CVEs
CVE-2026-55621
GO-2026-6318
GHSA-64f3-v33m-w89f
Sep 02, 2026
Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-55622
GO-2026-6319
GHSA-c9f5-j9c3-mhrg
Sep 02, 2026
Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus References
Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-48753
GO-2026-5802
GHSA-ccjc-4qc3-jxqc
Jul 07, 2026
Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48754
GO-2026-5800
GHSA-4xg6-52mh-fpw8
Jul 07, 2026
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48750
GO-2026-5801
GHSA-73hr-m85f-64v9
Jul 07, 2026
Incus has an arbitrary file write on host via `exec-output` symlink in crafted image in github.com/lxc/incus Incus has an arbitrary file write on host via Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48749
GO-2026-5798
GHSA-2q3f-q5pq-g8wv
Jul 07, 2026
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48755
GO-2026-5808
GHSA-v6mj-8pf4-hhw4
Jul 07, 2026
Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48756
GO-2026-5810
GHSA-xhqx-mgh3-3h7q
Jul 07, 2026
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48752
GO-2026-5803
GHSA-vxp5-584q-c479
Jul 07, 2026
Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48751
GO-2026-5799
GHSA-48q5-w887-33wv
Jul 07, 2026
Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48769
GO-2026-5806
GHSA-f6m5-xw2g-xc4x
Jul 07, 2026
Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-41684
GO-2026-5742
GHSA-x5r6-jr56-89pv
Jun 25, 2026
Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40197
GO-2026-5612
GHSA-r7w7-mmxr-47r9
Jun 25, 2026
Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41685
GO-2026-5280
GHSA-98vh-x9cx-9cfp
Jun 25, 2026
Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41647
GO-2026-5384
GHSA-fwj8-62r8-8p8m
Jun 25, 2026
Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40195
GO-2026-5397
GHSA-gc7j-g665-rxr9
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40243
GO-2026-5319
GHSA-c839-4qxr-j4x3
Jun 25, 2026
Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-47753
GO-2026-5252
GHSA-8g7m-96c8-8wwc
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-35527
GO-2026-5254
GHSA-8gw4-p4wq-4hcv
Jun 25, 2026
Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41648
GO-2026-5168
GHSA-67wx-r9xr-x75x
Jun 25, 2026
Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40251
GO-2026-5127
GHSA-4m88-wxj4-9qj6
Jun 25, 2026
Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-33542
GO-2026-4882
GHSA-p8mm-23gg-jc9r
Apr 07, 2026
Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Fixed in
6.23.0
References
Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33898
GO-2026-4879
GHSA-453r-g2pg-cxxq
Apr 07, 2026
Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33945
GO-2026-4884
GHSA-q4q8-7f2j-9h9f
Apr 07, 2026
Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33743
GO-2026-4886
GHSA-vg76-xmhg-j5x3
Apr 07, 2026
Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33897
GO-2026-4881
GHSA-83xr-5xxr-mh92
Apr 07, 2026
Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33711
GO-2026-4885
GHSA-q9vp-3wcg-8p4x
Apr 07, 2026
Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-23954
GO-2026-4357
GHSA-7f67-crqm-jgh7
Feb 05, 2026
Incus container image templating arbitrary host file read and write in github.com/lxc/incus Incus container image templating arbitrary host file read and write in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2026-23953
GO-2026-4359
GHSA-x6jc-phwx-hp32
Feb 05, 2026
Incus container environment configuration newline injection in github.com/lxc/incus Incus container environment configuration newline injection in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2025-64507
GO-2025-4115
GHSA-56mx-8g9f-5crf
Nov 17, 2025
Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus References Updated Mar 03, 2026 · Source: OSV.dev |
v6.21.0
minor
Dependencies (65)
+ 57 more |
|
v6.20.0
minor
30 CVEs
CVE-2026-55621
GO-2026-6318
GHSA-64f3-v33m-w89f
Sep 02, 2026
Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-55622
GO-2026-6319
GHSA-c9f5-j9c3-mhrg
Sep 02, 2026
Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus References
Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-48753
GO-2026-5802
GHSA-ccjc-4qc3-jxqc
Jul 07, 2026
Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48754
GO-2026-5800
GHSA-4xg6-52mh-fpw8
Jul 07, 2026
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48750
GO-2026-5801
GHSA-73hr-m85f-64v9
Jul 07, 2026
Incus has an arbitrary file write on host via `exec-output` symlink in crafted image in github.com/lxc/incus Incus has an arbitrary file write on host via Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48749
GO-2026-5798
GHSA-2q3f-q5pq-g8wv
Jul 07, 2026
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48755
GO-2026-5808
GHSA-v6mj-8pf4-hhw4
Jul 07, 2026
Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48756
GO-2026-5810
GHSA-xhqx-mgh3-3h7q
Jul 07, 2026
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48752
GO-2026-5803
GHSA-vxp5-584q-c479
Jul 07, 2026
Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48751
GO-2026-5799
GHSA-48q5-w887-33wv
Jul 07, 2026
Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48769
GO-2026-5806
GHSA-f6m5-xw2g-xc4x
Jul 07, 2026
Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-41684
GO-2026-5742
GHSA-x5r6-jr56-89pv
Jun 25, 2026
Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40197
GO-2026-5612
GHSA-r7w7-mmxr-47r9
Jun 25, 2026
Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41685
GO-2026-5280
GHSA-98vh-x9cx-9cfp
Jun 25, 2026
Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41647
GO-2026-5384
GHSA-fwj8-62r8-8p8m
Jun 25, 2026
Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40195
GO-2026-5397
GHSA-gc7j-g665-rxr9
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40243
GO-2026-5319
GHSA-c839-4qxr-j4x3
Jun 25, 2026
Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-47753
GO-2026-5252
GHSA-8g7m-96c8-8wwc
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-35527
GO-2026-5254
GHSA-8gw4-p4wq-4hcv
Jun 25, 2026
Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41648
GO-2026-5168
GHSA-67wx-r9xr-x75x
Jun 25, 2026
Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40251
GO-2026-5127
GHSA-4m88-wxj4-9qj6
Jun 25, 2026
Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-33542
GO-2026-4882
GHSA-p8mm-23gg-jc9r
Apr 07, 2026
Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Fixed in
6.23.0
References
Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33898
GO-2026-4879
GHSA-453r-g2pg-cxxq
Apr 07, 2026
Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33945
GO-2026-4884
GHSA-q4q8-7f2j-9h9f
Apr 07, 2026
Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33743
GO-2026-4886
GHSA-vg76-xmhg-j5x3
Apr 07, 2026
Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33897
GO-2026-4881
GHSA-83xr-5xxr-mh92
Apr 07, 2026
Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33711
GO-2026-4885
GHSA-q9vp-3wcg-8p4x
Apr 07, 2026
Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-23954
GO-2026-4357
GHSA-7f67-crqm-jgh7
Feb 05, 2026
Incus container image templating arbitrary host file read and write in github.com/lxc/incus Incus container image templating arbitrary host file read and write in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2026-23953
GO-2026-4359
GHSA-x6jc-phwx-hp32
Feb 05, 2026
Incus container environment configuration newline injection in github.com/lxc/incus Incus container environment configuration newline injection in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2025-64507
GO-2025-4115
GHSA-56mx-8g9f-5crf
Nov 17, 2025
Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus References Updated Mar 03, 2026 · Source: OSV.dev |
v6.20.0
minor
Dependencies (64)
+ 56 more |
|
v6.19.1
patch
30 CVEs
CVE-2026-55621
GO-2026-6318
GHSA-64f3-v33m-w89f
Sep 02, 2026
Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-55622
GO-2026-6319
GHSA-c9f5-j9c3-mhrg
Sep 02, 2026
Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus References
Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-48753
GO-2026-5802
GHSA-ccjc-4qc3-jxqc
Jul 07, 2026
Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48754
GO-2026-5800
GHSA-4xg6-52mh-fpw8
Jul 07, 2026
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48750
GO-2026-5801
GHSA-73hr-m85f-64v9
Jul 07, 2026
Incus has an arbitrary file write on host via `exec-output` symlink in crafted image in github.com/lxc/incus Incus has an arbitrary file write on host via Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48749
GO-2026-5798
GHSA-2q3f-q5pq-g8wv
Jul 07, 2026
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48755
GO-2026-5808
GHSA-v6mj-8pf4-hhw4
Jul 07, 2026
Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48756
GO-2026-5810
GHSA-xhqx-mgh3-3h7q
Jul 07, 2026
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48752
GO-2026-5803
GHSA-vxp5-584q-c479
Jul 07, 2026
Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48751
GO-2026-5799
GHSA-48q5-w887-33wv
Jul 07, 2026
Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48769
GO-2026-5806
GHSA-f6m5-xw2g-xc4x
Jul 07, 2026
Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-41684
GO-2026-5742
GHSA-x5r6-jr56-89pv
Jun 25, 2026
Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40197
GO-2026-5612
GHSA-r7w7-mmxr-47r9
Jun 25, 2026
Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41685
GO-2026-5280
GHSA-98vh-x9cx-9cfp
Jun 25, 2026
Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41647
GO-2026-5384
GHSA-fwj8-62r8-8p8m
Jun 25, 2026
Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40195
GO-2026-5397
GHSA-gc7j-g665-rxr9
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40243
GO-2026-5319
GHSA-c839-4qxr-j4x3
Jun 25, 2026
Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-47753
GO-2026-5252
GHSA-8g7m-96c8-8wwc
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-35527
GO-2026-5254
GHSA-8gw4-p4wq-4hcv
Jun 25, 2026
Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41648
GO-2026-5168
GHSA-67wx-r9xr-x75x
Jun 25, 2026
Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40251
GO-2026-5127
GHSA-4m88-wxj4-9qj6
Jun 25, 2026
Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-33542
GO-2026-4882
GHSA-p8mm-23gg-jc9r
Apr 07, 2026
Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Fixed in
6.23.0
References
Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33898
GO-2026-4879
GHSA-453r-g2pg-cxxq
Apr 07, 2026
Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33945
GO-2026-4884
GHSA-q4q8-7f2j-9h9f
Apr 07, 2026
Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33743
GO-2026-4886
GHSA-vg76-xmhg-j5x3
Apr 07, 2026
Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33897
GO-2026-4881
GHSA-83xr-5xxr-mh92
Apr 07, 2026
Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33711
GO-2026-4885
GHSA-q9vp-3wcg-8p4x
Apr 07, 2026
Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-23954
GO-2026-4357
GHSA-7f67-crqm-jgh7
Feb 05, 2026
Incus container image templating arbitrary host file read and write in github.com/lxc/incus Incus container image templating arbitrary host file read and write in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2026-23953
GO-2026-4359
GHSA-x6jc-phwx-hp32
Feb 05, 2026
Incus container environment configuration newline injection in github.com/lxc/incus Incus container environment configuration newline injection in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2025-64507
GO-2025-4115
GHSA-56mx-8g9f-5crf
Nov 17, 2025
Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus References Updated Mar 03, 2026 · Source: OSV.dev |
v6.19.1
patch
Dependencies (64)
+ 56 more |
|
v6.19.0
minor
30 CVEs
CVE-2026-55621
GO-2026-6318
GHSA-64f3-v33m-w89f
Sep 02, 2026
Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-55622
GO-2026-6319
GHSA-c9f5-j9c3-mhrg
Sep 02, 2026
Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus References
Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-48753
GO-2026-5802
GHSA-ccjc-4qc3-jxqc
Jul 07, 2026
Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48754
GO-2026-5800
GHSA-4xg6-52mh-fpw8
Jul 07, 2026
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48750
GO-2026-5801
GHSA-73hr-m85f-64v9
Jul 07, 2026
Incus has an arbitrary file write on host via `exec-output` symlink in crafted image in github.com/lxc/incus Incus has an arbitrary file write on host via Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48749
GO-2026-5798
GHSA-2q3f-q5pq-g8wv
Jul 07, 2026
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48755
GO-2026-5808
GHSA-v6mj-8pf4-hhw4
Jul 07, 2026
Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48756
GO-2026-5810
GHSA-xhqx-mgh3-3h7q
Jul 07, 2026
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48752
GO-2026-5803
GHSA-vxp5-584q-c479
Jul 07, 2026
Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48751
GO-2026-5799
GHSA-48q5-w887-33wv
Jul 07, 2026
Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48769
GO-2026-5806
GHSA-f6m5-xw2g-xc4x
Jul 07, 2026
Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-41684
GO-2026-5742
GHSA-x5r6-jr56-89pv
Jun 25, 2026
Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40197
GO-2026-5612
GHSA-r7w7-mmxr-47r9
Jun 25, 2026
Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41685
GO-2026-5280
GHSA-98vh-x9cx-9cfp
Jun 25, 2026
Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41647
GO-2026-5384
GHSA-fwj8-62r8-8p8m
Jun 25, 2026
Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40195
GO-2026-5397
GHSA-gc7j-g665-rxr9
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40243
GO-2026-5319
GHSA-c839-4qxr-j4x3
Jun 25, 2026
Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-47753
GO-2026-5252
GHSA-8g7m-96c8-8wwc
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-35527
GO-2026-5254
GHSA-8gw4-p4wq-4hcv
Jun 25, 2026
Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41648
GO-2026-5168
GHSA-67wx-r9xr-x75x
Jun 25, 2026
Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40251
GO-2026-5127
GHSA-4m88-wxj4-9qj6
Jun 25, 2026
Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-33542
GO-2026-4882
GHSA-p8mm-23gg-jc9r
Apr 07, 2026
Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Fixed in
6.23.0
References
Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33898
GO-2026-4879
GHSA-453r-g2pg-cxxq
Apr 07, 2026
Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33945
GO-2026-4884
GHSA-q4q8-7f2j-9h9f
Apr 07, 2026
Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33743
GO-2026-4886
GHSA-vg76-xmhg-j5x3
Apr 07, 2026
Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33897
GO-2026-4881
GHSA-83xr-5xxr-mh92
Apr 07, 2026
Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33711
GO-2026-4885
GHSA-q9vp-3wcg-8p4x
Apr 07, 2026
Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-23954
GO-2026-4357
GHSA-7f67-crqm-jgh7
Feb 05, 2026
Incus container image templating arbitrary host file read and write in github.com/lxc/incus Incus container image templating arbitrary host file read and write in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2026-23953
GO-2026-4359
GHSA-x6jc-phwx-hp32
Feb 05, 2026
Incus container environment configuration newline injection in github.com/lxc/incus Incus container environment configuration newline injection in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2025-64507
GO-2025-4115
GHSA-56mx-8g9f-5crf
Nov 17, 2025
Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus References Updated Mar 03, 2026 · Source: OSV.dev |
v6.19.0
minor
Dependencies (64)
+ 56 more |
|
v6.18.0
minor
30 CVEs
CVE-2026-55621
GO-2026-6318
GHSA-64f3-v33m-w89f
Sep 02, 2026
Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-55622
GO-2026-6319
GHSA-c9f5-j9c3-mhrg
Sep 02, 2026
Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus References
Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-48753
GO-2026-5802
GHSA-ccjc-4qc3-jxqc
Jul 07, 2026
Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48754
GO-2026-5800
GHSA-4xg6-52mh-fpw8
Jul 07, 2026
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48750
GO-2026-5801
GHSA-73hr-m85f-64v9
Jul 07, 2026
Incus has an arbitrary file write on host via `exec-output` symlink in crafted image in github.com/lxc/incus Incus has an arbitrary file write on host via Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48749
GO-2026-5798
GHSA-2q3f-q5pq-g8wv
Jul 07, 2026
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48755
GO-2026-5808
GHSA-v6mj-8pf4-hhw4
Jul 07, 2026
Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48756
GO-2026-5810
GHSA-xhqx-mgh3-3h7q
Jul 07, 2026
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48752
GO-2026-5803
GHSA-vxp5-584q-c479
Jul 07, 2026
Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48751
GO-2026-5799
GHSA-48q5-w887-33wv
Jul 07, 2026
Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48769
GO-2026-5806
GHSA-f6m5-xw2g-xc4x
Jul 07, 2026
Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-41684
GO-2026-5742
GHSA-x5r6-jr56-89pv
Jun 25, 2026
Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40197
GO-2026-5612
GHSA-r7w7-mmxr-47r9
Jun 25, 2026
Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41685
GO-2026-5280
GHSA-98vh-x9cx-9cfp
Jun 25, 2026
Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41647
GO-2026-5384
GHSA-fwj8-62r8-8p8m
Jun 25, 2026
Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40195
GO-2026-5397
GHSA-gc7j-g665-rxr9
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40243
GO-2026-5319
GHSA-c839-4qxr-j4x3
Jun 25, 2026
Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-47753
GO-2026-5252
GHSA-8g7m-96c8-8wwc
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-35527
GO-2026-5254
GHSA-8gw4-p4wq-4hcv
Jun 25, 2026
Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41648
GO-2026-5168
GHSA-67wx-r9xr-x75x
Jun 25, 2026
Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40251
GO-2026-5127
GHSA-4m88-wxj4-9qj6
Jun 25, 2026
Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-33542
GO-2026-4882
GHSA-p8mm-23gg-jc9r
Apr 07, 2026
Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Fixed in
6.23.0
References
Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33898
GO-2026-4879
GHSA-453r-g2pg-cxxq
Apr 07, 2026
Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33945
GO-2026-4884
GHSA-q4q8-7f2j-9h9f
Apr 07, 2026
Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33743
GO-2026-4886
GHSA-vg76-xmhg-j5x3
Apr 07, 2026
Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33897
GO-2026-4881
GHSA-83xr-5xxr-mh92
Apr 07, 2026
Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33711
GO-2026-4885
GHSA-q9vp-3wcg-8p4x
Apr 07, 2026
Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-23954
GO-2026-4357
GHSA-7f67-crqm-jgh7
Feb 05, 2026
Incus container image templating arbitrary host file read and write in github.com/lxc/incus Incus container image templating arbitrary host file read and write in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2026-23953
GO-2026-4359
GHSA-x6jc-phwx-hp32
Feb 05, 2026
Incus container environment configuration newline injection in github.com/lxc/incus Incus container environment configuration newline injection in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2025-64507
GO-2025-4115
GHSA-56mx-8g9f-5crf
Nov 17, 2025
Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus References Updated Mar 03, 2026 · Source: OSV.dev |
v6.18.0
minor
Dependencies (63)
+ 55 more |
|
v6.17.0
minor
30 CVEs
CVE-2026-55621
GO-2026-6318
GHSA-64f3-v33m-w89f
Sep 02, 2026
Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-55622
GO-2026-6319
GHSA-c9f5-j9c3-mhrg
Sep 02, 2026
Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus References
Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-48753
GO-2026-5802
GHSA-ccjc-4qc3-jxqc
Jul 07, 2026
Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48754
GO-2026-5800
GHSA-4xg6-52mh-fpw8
Jul 07, 2026
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48750
GO-2026-5801
GHSA-73hr-m85f-64v9
Jul 07, 2026
Incus has an arbitrary file write on host via `exec-output` symlink in crafted image in github.com/lxc/incus Incus has an arbitrary file write on host via Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48749
GO-2026-5798
GHSA-2q3f-q5pq-g8wv
Jul 07, 2026
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48755
GO-2026-5808
GHSA-v6mj-8pf4-hhw4
Jul 07, 2026
Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48756
GO-2026-5810
GHSA-xhqx-mgh3-3h7q
Jul 07, 2026
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48752
GO-2026-5803
GHSA-vxp5-584q-c479
Jul 07, 2026
Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48751
GO-2026-5799
GHSA-48q5-w887-33wv
Jul 07, 2026
Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48769
GO-2026-5806
GHSA-f6m5-xw2g-xc4x
Jul 07, 2026
Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-41684
GO-2026-5742
GHSA-x5r6-jr56-89pv
Jun 25, 2026
Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40197
GO-2026-5612
GHSA-r7w7-mmxr-47r9
Jun 25, 2026
Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41685
GO-2026-5280
GHSA-98vh-x9cx-9cfp
Jun 25, 2026
Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41647
GO-2026-5384
GHSA-fwj8-62r8-8p8m
Jun 25, 2026
Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40195
GO-2026-5397
GHSA-gc7j-g665-rxr9
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40243
GO-2026-5319
GHSA-c839-4qxr-j4x3
Jun 25, 2026
Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-47753
GO-2026-5252
GHSA-8g7m-96c8-8wwc
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-35527
GO-2026-5254
GHSA-8gw4-p4wq-4hcv
Jun 25, 2026
Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41648
GO-2026-5168
GHSA-67wx-r9xr-x75x
Jun 25, 2026
Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40251
GO-2026-5127
GHSA-4m88-wxj4-9qj6
Jun 25, 2026
Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-33542
GO-2026-4882
GHSA-p8mm-23gg-jc9r
Apr 07, 2026
Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Fixed in
6.23.0
References
Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33898
GO-2026-4879
GHSA-453r-g2pg-cxxq
Apr 07, 2026
Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33945
GO-2026-4884
GHSA-q4q8-7f2j-9h9f
Apr 07, 2026
Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33743
GO-2026-4886
GHSA-vg76-xmhg-j5x3
Apr 07, 2026
Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33897
GO-2026-4881
GHSA-83xr-5xxr-mh92
Apr 07, 2026
Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33711
GO-2026-4885
GHSA-q9vp-3wcg-8p4x
Apr 07, 2026
Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-23954
GO-2026-4357
GHSA-7f67-crqm-jgh7
Feb 05, 2026
Incus container image templating arbitrary host file read and write in github.com/lxc/incus Incus container image templating arbitrary host file read and write in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2026-23953
GO-2026-4359
GHSA-x6jc-phwx-hp32
Feb 05, 2026
Incus container environment configuration newline injection in github.com/lxc/incus Incus container environment configuration newline injection in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2025-64507
GO-2025-4115
GHSA-56mx-8g9f-5crf
Nov 17, 2025
Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus References Updated Mar 03, 2026 · Source: OSV.dev |
v6.17.0
minor
Dependencies (62)
+ 54 more |
|
v6.16.0
minor
30 CVEs
CVE-2026-55621
GO-2026-6318
GHSA-64f3-v33m-w89f
Sep 02, 2026
Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-55622
GO-2026-6319
GHSA-c9f5-j9c3-mhrg
Sep 02, 2026
Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus References
Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-48753
GO-2026-5802
GHSA-ccjc-4qc3-jxqc
Jul 07, 2026
Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48754
GO-2026-5800
GHSA-4xg6-52mh-fpw8
Jul 07, 2026
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48750
GO-2026-5801
GHSA-73hr-m85f-64v9
Jul 07, 2026
Incus has an arbitrary file write on host via `exec-output` symlink in crafted image in github.com/lxc/incus Incus has an arbitrary file write on host via Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48749
GO-2026-5798
GHSA-2q3f-q5pq-g8wv
Jul 07, 2026
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48755
GO-2026-5808
GHSA-v6mj-8pf4-hhw4
Jul 07, 2026
Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48756
GO-2026-5810
GHSA-xhqx-mgh3-3h7q
Jul 07, 2026
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48752
GO-2026-5803
GHSA-vxp5-584q-c479
Jul 07, 2026
Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48751
GO-2026-5799
GHSA-48q5-w887-33wv
Jul 07, 2026
Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48769
GO-2026-5806
GHSA-f6m5-xw2g-xc4x
Jul 07, 2026
Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-41684
GO-2026-5742
GHSA-x5r6-jr56-89pv
Jun 25, 2026
Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40197
GO-2026-5612
GHSA-r7w7-mmxr-47r9
Jun 25, 2026
Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41685
GO-2026-5280
GHSA-98vh-x9cx-9cfp
Jun 25, 2026
Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41647
GO-2026-5384
GHSA-fwj8-62r8-8p8m
Jun 25, 2026
Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40195
GO-2026-5397
GHSA-gc7j-g665-rxr9
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40243
GO-2026-5319
GHSA-c839-4qxr-j4x3
Jun 25, 2026
Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-47753
GO-2026-5252
GHSA-8g7m-96c8-8wwc
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-35527
GO-2026-5254
GHSA-8gw4-p4wq-4hcv
Jun 25, 2026
Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41648
GO-2026-5168
GHSA-67wx-r9xr-x75x
Jun 25, 2026
Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40251
GO-2026-5127
GHSA-4m88-wxj4-9qj6
Jun 25, 2026
Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-33542
GO-2026-4882
GHSA-p8mm-23gg-jc9r
Apr 07, 2026
Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Fixed in
6.23.0
References
Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33898
GO-2026-4879
GHSA-453r-g2pg-cxxq
Apr 07, 2026
Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33945
GO-2026-4884
GHSA-q4q8-7f2j-9h9f
Apr 07, 2026
Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33743
GO-2026-4886
GHSA-vg76-xmhg-j5x3
Apr 07, 2026
Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33897
GO-2026-4881
GHSA-83xr-5xxr-mh92
Apr 07, 2026
Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33711
GO-2026-4885
GHSA-q9vp-3wcg-8p4x
Apr 07, 2026
Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-23954
GO-2026-4357
GHSA-7f67-crqm-jgh7
Feb 05, 2026
Incus container image templating arbitrary host file read and write in github.com/lxc/incus Incus container image templating arbitrary host file read and write in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2026-23953
GO-2026-4359
GHSA-x6jc-phwx-hp32
Feb 05, 2026
Incus container environment configuration newline injection in github.com/lxc/incus Incus container environment configuration newline injection in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2025-64507
GO-2025-4115
GHSA-56mx-8g9f-5crf
Nov 17, 2025
Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus References Updated Mar 03, 2026 · Source: OSV.dev |
v6.16.0
minor
Dependencies (62)
+ 54 more |
|
v6.15.0
minor
30 CVEs
CVE-2026-55621
GO-2026-6318
GHSA-64f3-v33m-w89f
Sep 02, 2026
Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-55622
GO-2026-6319
GHSA-c9f5-j9c3-mhrg
Sep 02, 2026
Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus References
Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-48753
GO-2026-5802
GHSA-ccjc-4qc3-jxqc
Jul 07, 2026
Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48754
GO-2026-5800
GHSA-4xg6-52mh-fpw8
Jul 07, 2026
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48750
GO-2026-5801
GHSA-73hr-m85f-64v9
Jul 07, 2026
Incus has an arbitrary file write on host via `exec-output` symlink in crafted image in github.com/lxc/incus Incus has an arbitrary file write on host via Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48749
GO-2026-5798
GHSA-2q3f-q5pq-g8wv
Jul 07, 2026
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48755
GO-2026-5808
GHSA-v6mj-8pf4-hhw4
Jul 07, 2026
Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48756
GO-2026-5810
GHSA-xhqx-mgh3-3h7q
Jul 07, 2026
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48752
GO-2026-5803
GHSA-vxp5-584q-c479
Jul 07, 2026
Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48751
GO-2026-5799
GHSA-48q5-w887-33wv
Jul 07, 2026
Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48769
GO-2026-5806
GHSA-f6m5-xw2g-xc4x
Jul 07, 2026
Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-41684
GO-2026-5742
GHSA-x5r6-jr56-89pv
Jun 25, 2026
Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40197
GO-2026-5612
GHSA-r7w7-mmxr-47r9
Jun 25, 2026
Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41685
GO-2026-5280
GHSA-98vh-x9cx-9cfp
Jun 25, 2026
Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41647
GO-2026-5384
GHSA-fwj8-62r8-8p8m
Jun 25, 2026
Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40195
GO-2026-5397
GHSA-gc7j-g665-rxr9
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40243
GO-2026-5319
GHSA-c839-4qxr-j4x3
Jun 25, 2026
Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-47753
GO-2026-5252
GHSA-8g7m-96c8-8wwc
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-35527
GO-2026-5254
GHSA-8gw4-p4wq-4hcv
Jun 25, 2026
Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41648
GO-2026-5168
GHSA-67wx-r9xr-x75x
Jun 25, 2026
Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40251
GO-2026-5127
GHSA-4m88-wxj4-9qj6
Jun 25, 2026
Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-33542
GO-2026-4882
GHSA-p8mm-23gg-jc9r
Apr 07, 2026
Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Fixed in
6.23.0
References
Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33898
GO-2026-4879
GHSA-453r-g2pg-cxxq
Apr 07, 2026
Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33945
GO-2026-4884
GHSA-q4q8-7f2j-9h9f
Apr 07, 2026
Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33743
GO-2026-4886
GHSA-vg76-xmhg-j5x3
Apr 07, 2026
Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33897
GO-2026-4881
GHSA-83xr-5xxr-mh92
Apr 07, 2026
Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33711
GO-2026-4885
GHSA-q9vp-3wcg-8p4x
Apr 07, 2026
Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-23954
GO-2026-4357
GHSA-7f67-crqm-jgh7
Feb 05, 2026
Incus container image templating arbitrary host file read and write in github.com/lxc/incus Incus container image templating arbitrary host file read and write in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2026-23953
GO-2026-4359
GHSA-x6jc-phwx-hp32
Feb 05, 2026
Incus container environment configuration newline injection in github.com/lxc/incus Incus container environment configuration newline injection in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2025-64507
GO-2025-4115
GHSA-56mx-8g9f-5crf
Nov 17, 2025
Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus References Updated Mar 03, 2026 · Source: OSV.dev |
v6.15.0
minor
Dependencies (61)
+ 53 more |
|
v6.14.0
minor
30 CVEs
CVE-2026-55621
GO-2026-6318
GHSA-64f3-v33m-w89f
Sep 02, 2026
Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-55622
GO-2026-6319
GHSA-c9f5-j9c3-mhrg
Sep 02, 2026
Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus References
Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-48753
GO-2026-5802
GHSA-ccjc-4qc3-jxqc
Jul 07, 2026
Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48754
GO-2026-5800
GHSA-4xg6-52mh-fpw8
Jul 07, 2026
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48750
GO-2026-5801
GHSA-73hr-m85f-64v9
Jul 07, 2026
Incus has an arbitrary file write on host via `exec-output` symlink in crafted image in github.com/lxc/incus Incus has an arbitrary file write on host via Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48749
GO-2026-5798
GHSA-2q3f-q5pq-g8wv
Jul 07, 2026
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48755
GO-2026-5808
GHSA-v6mj-8pf4-hhw4
Jul 07, 2026
Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48756
GO-2026-5810
GHSA-xhqx-mgh3-3h7q
Jul 07, 2026
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48752
GO-2026-5803
GHSA-vxp5-584q-c479
Jul 07, 2026
Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48751
GO-2026-5799
GHSA-48q5-w887-33wv
Jul 07, 2026
Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48769
GO-2026-5806
GHSA-f6m5-xw2g-xc4x
Jul 07, 2026
Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-41684
GO-2026-5742
GHSA-x5r6-jr56-89pv
Jun 25, 2026
Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40197
GO-2026-5612
GHSA-r7w7-mmxr-47r9
Jun 25, 2026
Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41685
GO-2026-5280
GHSA-98vh-x9cx-9cfp
Jun 25, 2026
Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41647
GO-2026-5384
GHSA-fwj8-62r8-8p8m
Jun 25, 2026
Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40195
GO-2026-5397
GHSA-gc7j-g665-rxr9
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40243
GO-2026-5319
GHSA-c839-4qxr-j4x3
Jun 25, 2026
Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-47753
GO-2026-5252
GHSA-8g7m-96c8-8wwc
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-35527
GO-2026-5254
GHSA-8gw4-p4wq-4hcv
Jun 25, 2026
Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41648
GO-2026-5168
GHSA-67wx-r9xr-x75x
Jun 25, 2026
Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40251
GO-2026-5127
GHSA-4m88-wxj4-9qj6
Jun 25, 2026
Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-33542
GO-2026-4882
GHSA-p8mm-23gg-jc9r
Apr 07, 2026
Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Fixed in
6.23.0
References
Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33898
GO-2026-4879
GHSA-453r-g2pg-cxxq
Apr 07, 2026
Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33945
GO-2026-4884
GHSA-q4q8-7f2j-9h9f
Apr 07, 2026
Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33743
GO-2026-4886
GHSA-vg76-xmhg-j5x3
Apr 07, 2026
Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33897
GO-2026-4881
GHSA-83xr-5xxr-mh92
Apr 07, 2026
Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33711
GO-2026-4885
GHSA-q9vp-3wcg-8p4x
Apr 07, 2026
Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-23954
GO-2026-4357
GHSA-7f67-crqm-jgh7
Feb 05, 2026
Incus container image templating arbitrary host file read and write in github.com/lxc/incus Incus container image templating arbitrary host file read and write in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2026-23953
GO-2026-4359
GHSA-x6jc-phwx-hp32
Feb 05, 2026
Incus container environment configuration newline injection in github.com/lxc/incus Incus container environment configuration newline injection in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2025-64507
GO-2025-4115
GHSA-56mx-8g9f-5crf
Nov 17, 2025
Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus References Updated Mar 03, 2026 · Source: OSV.dev |
v6.14.0
minor
Dependencies (61)
+ 53 more |
|
v6.13.0
minor
32 CVEs
CVE-2026-55621
GO-2026-6318
GHSA-64f3-v33m-w89f
Sep 02, 2026
Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-55622
GO-2026-6319
GHSA-c9f5-j9c3-mhrg
Sep 02, 2026
Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus References
Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-48753
GO-2026-5802
GHSA-ccjc-4qc3-jxqc
Jul 07, 2026
Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48754
GO-2026-5800
GHSA-4xg6-52mh-fpw8
Jul 07, 2026
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48750
GO-2026-5801
GHSA-73hr-m85f-64v9
Jul 07, 2026
Incus has an arbitrary file write on host via `exec-output` symlink in crafted image in github.com/lxc/incus Incus has an arbitrary file write on host via Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48749
GO-2026-5798
GHSA-2q3f-q5pq-g8wv
Jul 07, 2026
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48755
GO-2026-5808
GHSA-v6mj-8pf4-hhw4
Jul 07, 2026
Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48756
GO-2026-5810
GHSA-xhqx-mgh3-3h7q
Jul 07, 2026
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48752
GO-2026-5803
GHSA-vxp5-584q-c479
Jul 07, 2026
Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48751
GO-2026-5799
GHSA-48q5-w887-33wv
Jul 07, 2026
Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48769
GO-2026-5806
GHSA-f6m5-xw2g-xc4x
Jul 07, 2026
Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-41684
GO-2026-5742
GHSA-x5r6-jr56-89pv
Jun 25, 2026
Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40197
GO-2026-5612
GHSA-r7w7-mmxr-47r9
Jun 25, 2026
Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41685
GO-2026-5280
GHSA-98vh-x9cx-9cfp
Jun 25, 2026
Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41647
GO-2026-5384
GHSA-fwj8-62r8-8p8m
Jun 25, 2026
Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40195
GO-2026-5397
GHSA-gc7j-g665-rxr9
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40243
GO-2026-5319
GHSA-c839-4qxr-j4x3
Jun 25, 2026
Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-47753
GO-2026-5252
GHSA-8g7m-96c8-8wwc
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-35527
GO-2026-5254
GHSA-8gw4-p4wq-4hcv
Jun 25, 2026
Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41648
GO-2026-5168
GHSA-67wx-r9xr-x75x
Jun 25, 2026
Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40251
GO-2026-5127
GHSA-4m88-wxj4-9qj6
Jun 25, 2026
Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-33542
GO-2026-4882
GHSA-p8mm-23gg-jc9r
Apr 07, 2026
Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Fixed in
6.23.0
References
Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33898
GO-2026-4879
GHSA-453r-g2pg-cxxq
Apr 07, 2026
Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33945
GO-2026-4884
GHSA-q4q8-7f2j-9h9f
Apr 07, 2026
Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33743
GO-2026-4886
GHSA-vg76-xmhg-j5x3
Apr 07, 2026
Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33897
GO-2026-4881
GHSA-83xr-5xxr-mh92
Apr 07, 2026
Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33711
GO-2026-4885
GHSA-q9vp-3wcg-8p4x
Apr 07, 2026
Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-23954
GO-2026-4357
GHSA-7f67-crqm-jgh7
Feb 05, 2026
Incus container image templating arbitrary host file read and write in github.com/lxc/incus Incus container image templating arbitrary host file read and write in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2026-23953
GO-2026-4359
GHSA-x6jc-phwx-hp32
Feb 05, 2026
Incus container environment configuration newline injection in github.com/lxc/incus Incus container environment configuration newline injection in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2025-64507
GO-2025-4115
GHSA-56mx-8g9f-5crf
Nov 17, 2025
Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus References Updated Mar 03, 2026 · Source: OSV.dev
CVE-2025-52890
GO-2025-3782
GHSA-p7fw-vjjm-2rwp
Jul 28, 2025
Incus creates nftables rules that partially bypass security options in github.com/lxc/incus Incus creates nftables rules that partially bypass security options in github.com/lxc/incus Fixed in
6.14.0
References Updated Mar 03, 2026 · Source: OSV.dev
CVE-2025-52889
GO-2025-3781
GHSA-9q7c-qmhm-jv86
Jul 28, 2025
Incus Allocation of Resources Without Limits allows firewall rule bypass on managed bridge networks in github.com/lxc/incus Incus Allocation of Resources Without Limits allows firewall rule bypass on managed bridge networks in github.com/lxc/incus Fixed in
6.14.0
References Updated Mar 03, 2026 · Source: OSV.dev |
v6.13.0
minor
Dependencies (61)
+ 53 more |
|
v6.12.0
minor
32 CVEs
CVE-2026-55621
GO-2026-6318
GHSA-64f3-v33m-w89f
Sep 02, 2026
Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-55622
GO-2026-6319
GHSA-c9f5-j9c3-mhrg
Sep 02, 2026
Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus References
Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-48753
GO-2026-5802
GHSA-ccjc-4qc3-jxqc
Jul 07, 2026
Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48754
GO-2026-5800
GHSA-4xg6-52mh-fpw8
Jul 07, 2026
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48750
GO-2026-5801
GHSA-73hr-m85f-64v9
Jul 07, 2026
Incus has an arbitrary file write on host via `exec-output` symlink in crafted image in github.com/lxc/incus Incus has an arbitrary file write on host via Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48749
GO-2026-5798
GHSA-2q3f-q5pq-g8wv
Jul 07, 2026
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48755
GO-2026-5808
GHSA-v6mj-8pf4-hhw4
Jul 07, 2026
Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48756
GO-2026-5810
GHSA-xhqx-mgh3-3h7q
Jul 07, 2026
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48752
GO-2026-5803
GHSA-vxp5-584q-c479
Jul 07, 2026
Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48751
GO-2026-5799
GHSA-48q5-w887-33wv
Jul 07, 2026
Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48769
GO-2026-5806
GHSA-f6m5-xw2g-xc4x
Jul 07, 2026
Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-41684
GO-2026-5742
GHSA-x5r6-jr56-89pv
Jun 25, 2026
Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40197
GO-2026-5612
GHSA-r7w7-mmxr-47r9
Jun 25, 2026
Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41685
GO-2026-5280
GHSA-98vh-x9cx-9cfp
Jun 25, 2026
Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41647
GO-2026-5384
GHSA-fwj8-62r8-8p8m
Jun 25, 2026
Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40195
GO-2026-5397
GHSA-gc7j-g665-rxr9
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40243
GO-2026-5319
GHSA-c839-4qxr-j4x3
Jun 25, 2026
Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-47753
GO-2026-5252
GHSA-8g7m-96c8-8wwc
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-35527
GO-2026-5254
GHSA-8gw4-p4wq-4hcv
Jun 25, 2026
Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41648
GO-2026-5168
GHSA-67wx-r9xr-x75x
Jun 25, 2026
Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40251
GO-2026-5127
GHSA-4m88-wxj4-9qj6
Jun 25, 2026
Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-33542
GO-2026-4882
GHSA-p8mm-23gg-jc9r
Apr 07, 2026
Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Fixed in
6.23.0
References
Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33898
GO-2026-4879
GHSA-453r-g2pg-cxxq
Apr 07, 2026
Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33945
GO-2026-4884
GHSA-q4q8-7f2j-9h9f
Apr 07, 2026
Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33743
GO-2026-4886
GHSA-vg76-xmhg-j5x3
Apr 07, 2026
Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33897
GO-2026-4881
GHSA-83xr-5xxr-mh92
Apr 07, 2026
Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33711
GO-2026-4885
GHSA-q9vp-3wcg-8p4x
Apr 07, 2026
Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-23954
GO-2026-4357
GHSA-7f67-crqm-jgh7
Feb 05, 2026
Incus container image templating arbitrary host file read and write in github.com/lxc/incus Incus container image templating arbitrary host file read and write in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2026-23953
GO-2026-4359
GHSA-x6jc-phwx-hp32
Feb 05, 2026
Incus container environment configuration newline injection in github.com/lxc/incus Incus container environment configuration newline injection in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2025-64507
GO-2025-4115
GHSA-56mx-8g9f-5crf
Nov 17, 2025
Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus References Updated Mar 03, 2026 · Source: OSV.dev
CVE-2025-52890
GO-2025-3782
GHSA-p7fw-vjjm-2rwp
Jul 28, 2025
Incus creates nftables rules that partially bypass security options in github.com/lxc/incus Incus creates nftables rules that partially bypass security options in github.com/lxc/incus Fixed in
6.14.0
References Updated Mar 03, 2026 · Source: OSV.dev
CVE-2025-52889
GO-2025-3781
GHSA-9q7c-qmhm-jv86
Jul 28, 2025
Incus Allocation of Resources Without Limits allows firewall rule bypass on managed bridge networks in github.com/lxc/incus Incus Allocation of Resources Without Limits allows firewall rule bypass on managed bridge networks in github.com/lxc/incus Fixed in
6.14.0
References Updated Mar 03, 2026 · Source: OSV.dev |
v6.12.0
minor
Dependencies (61)
+ 53 more |
|
v6.11.0
minor
30 CVEs
CVE-2026-55621
GO-2026-6318
GHSA-64f3-v33m-w89f
Sep 02, 2026
Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-55622
GO-2026-6319
GHSA-c9f5-j9c3-mhrg
Sep 02, 2026
Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus References
Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-48753
GO-2026-5802
GHSA-ccjc-4qc3-jxqc
Jul 07, 2026
Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48754
GO-2026-5800
GHSA-4xg6-52mh-fpw8
Jul 07, 2026
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48750
GO-2026-5801
GHSA-73hr-m85f-64v9
Jul 07, 2026
Incus has an arbitrary file write on host via `exec-output` symlink in crafted image in github.com/lxc/incus Incus has an arbitrary file write on host via Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48749
GO-2026-5798
GHSA-2q3f-q5pq-g8wv
Jul 07, 2026
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48755
GO-2026-5808
GHSA-v6mj-8pf4-hhw4
Jul 07, 2026
Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48756
GO-2026-5810
GHSA-xhqx-mgh3-3h7q
Jul 07, 2026
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48752
GO-2026-5803
GHSA-vxp5-584q-c479
Jul 07, 2026
Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48751
GO-2026-5799
GHSA-48q5-w887-33wv
Jul 07, 2026
Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48769
GO-2026-5806
GHSA-f6m5-xw2g-xc4x
Jul 07, 2026
Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-41684
GO-2026-5742
GHSA-x5r6-jr56-89pv
Jun 25, 2026
Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40197
GO-2026-5612
GHSA-r7w7-mmxr-47r9
Jun 25, 2026
Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41685
GO-2026-5280
GHSA-98vh-x9cx-9cfp
Jun 25, 2026
Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41647
GO-2026-5384
GHSA-fwj8-62r8-8p8m
Jun 25, 2026
Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40195
GO-2026-5397
GHSA-gc7j-g665-rxr9
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40243
GO-2026-5319
GHSA-c839-4qxr-j4x3
Jun 25, 2026
Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-47753
GO-2026-5252
GHSA-8g7m-96c8-8wwc
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-35527
GO-2026-5254
GHSA-8gw4-p4wq-4hcv
Jun 25, 2026
Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41648
GO-2026-5168
GHSA-67wx-r9xr-x75x
Jun 25, 2026
Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40251
GO-2026-5127
GHSA-4m88-wxj4-9qj6
Jun 25, 2026
Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-33542
GO-2026-4882
GHSA-p8mm-23gg-jc9r
Apr 07, 2026
Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Fixed in
6.23.0
References
Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33898
GO-2026-4879
GHSA-453r-g2pg-cxxq
Apr 07, 2026
Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33945
GO-2026-4884
GHSA-q4q8-7f2j-9h9f
Apr 07, 2026
Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33743
GO-2026-4886
GHSA-vg76-xmhg-j5x3
Apr 07, 2026
Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33897
GO-2026-4881
GHSA-83xr-5xxr-mh92
Apr 07, 2026
Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33711
GO-2026-4885
GHSA-q9vp-3wcg-8p4x
Apr 07, 2026
Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-23954
GO-2026-4357
GHSA-7f67-crqm-jgh7
Feb 05, 2026
Incus container image templating arbitrary host file read and write in github.com/lxc/incus Incus container image templating arbitrary host file read and write in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2026-23953
GO-2026-4359
GHSA-x6jc-phwx-hp32
Feb 05, 2026
Incus container environment configuration newline injection in github.com/lxc/incus Incus container environment configuration newline injection in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2025-64507
GO-2025-4115
GHSA-56mx-8g9f-5crf
Nov 17, 2025
Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus References Updated Mar 03, 2026 · Source: OSV.dev |
v6.11.0
minor
Dependencies (63)
+ 55 more |
|
v6.10.1
patch
30 CVEs
CVE-2026-55621
GO-2026-6318
GHSA-64f3-v33m-w89f
Sep 02, 2026
Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-55622
GO-2026-6319
GHSA-c9f5-j9c3-mhrg
Sep 02, 2026
Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus References
Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-48753
GO-2026-5802
GHSA-ccjc-4qc3-jxqc
Jul 07, 2026
Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48754
GO-2026-5800
GHSA-4xg6-52mh-fpw8
Jul 07, 2026
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48750
GO-2026-5801
GHSA-73hr-m85f-64v9
Jul 07, 2026
Incus has an arbitrary file write on host via `exec-output` symlink in crafted image in github.com/lxc/incus Incus has an arbitrary file write on host via Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48749
GO-2026-5798
GHSA-2q3f-q5pq-g8wv
Jul 07, 2026
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48755
GO-2026-5808
GHSA-v6mj-8pf4-hhw4
Jul 07, 2026
Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48756
GO-2026-5810
GHSA-xhqx-mgh3-3h7q
Jul 07, 2026
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48752
GO-2026-5803
GHSA-vxp5-584q-c479
Jul 07, 2026
Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48751
GO-2026-5799
GHSA-48q5-w887-33wv
Jul 07, 2026
Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48769
GO-2026-5806
GHSA-f6m5-xw2g-xc4x
Jul 07, 2026
Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-41684
GO-2026-5742
GHSA-x5r6-jr56-89pv
Jun 25, 2026
Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40197
GO-2026-5612
GHSA-r7w7-mmxr-47r9
Jun 25, 2026
Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41685
GO-2026-5280
GHSA-98vh-x9cx-9cfp
Jun 25, 2026
Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41647
GO-2026-5384
GHSA-fwj8-62r8-8p8m
Jun 25, 2026
Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40195
GO-2026-5397
GHSA-gc7j-g665-rxr9
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40243
GO-2026-5319
GHSA-c839-4qxr-j4x3
Jun 25, 2026
Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-47753
GO-2026-5252
GHSA-8g7m-96c8-8wwc
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-35527
GO-2026-5254
GHSA-8gw4-p4wq-4hcv
Jun 25, 2026
Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41648
GO-2026-5168
GHSA-67wx-r9xr-x75x
Jun 25, 2026
Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40251
GO-2026-5127
GHSA-4m88-wxj4-9qj6
Jun 25, 2026
Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-33542
GO-2026-4882
GHSA-p8mm-23gg-jc9r
Apr 07, 2026
Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Fixed in
6.23.0
References
Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33898
GO-2026-4879
GHSA-453r-g2pg-cxxq
Apr 07, 2026
Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33945
GO-2026-4884
GHSA-q4q8-7f2j-9h9f
Apr 07, 2026
Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33743
GO-2026-4886
GHSA-vg76-xmhg-j5x3
Apr 07, 2026
Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33897
GO-2026-4881
GHSA-83xr-5xxr-mh92
Apr 07, 2026
Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33711
GO-2026-4885
GHSA-q9vp-3wcg-8p4x
Apr 07, 2026
Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-23954
GO-2026-4357
GHSA-7f67-crqm-jgh7
Feb 05, 2026
Incus container image templating arbitrary host file read and write in github.com/lxc/incus Incus container image templating arbitrary host file read and write in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2026-23953
GO-2026-4359
GHSA-x6jc-phwx-hp32
Feb 05, 2026
Incus container environment configuration newline injection in github.com/lxc/incus Incus container environment configuration newline injection in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2025-64507
GO-2025-4115
GHSA-56mx-8g9f-5crf
Nov 17, 2025
Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus References Updated Mar 03, 2026 · Source: OSV.dev |
v6.10.1
patch
Dependencies (63)
+ 55 more |
|
v6.10.0
minor
30 CVEs
CVE-2026-55621
GO-2026-6318
GHSA-64f3-v33m-w89f
Sep 02, 2026
Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-55622
GO-2026-6319
GHSA-c9f5-j9c3-mhrg
Sep 02, 2026
Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus References
Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-48753
GO-2026-5802
GHSA-ccjc-4qc3-jxqc
Jul 07, 2026
Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48754
GO-2026-5800
GHSA-4xg6-52mh-fpw8
Jul 07, 2026
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48750
GO-2026-5801
GHSA-73hr-m85f-64v9
Jul 07, 2026
Incus has an arbitrary file write on host via `exec-output` symlink in crafted image in github.com/lxc/incus Incus has an arbitrary file write on host via Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48749
GO-2026-5798
GHSA-2q3f-q5pq-g8wv
Jul 07, 2026
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48755
GO-2026-5808
GHSA-v6mj-8pf4-hhw4
Jul 07, 2026
Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48756
GO-2026-5810
GHSA-xhqx-mgh3-3h7q
Jul 07, 2026
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48752
GO-2026-5803
GHSA-vxp5-584q-c479
Jul 07, 2026
Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48751
GO-2026-5799
GHSA-48q5-w887-33wv
Jul 07, 2026
Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48769
GO-2026-5806
GHSA-f6m5-xw2g-xc4x
Jul 07, 2026
Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-41684
GO-2026-5742
GHSA-x5r6-jr56-89pv
Jun 25, 2026
Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40197
GO-2026-5612
GHSA-r7w7-mmxr-47r9
Jun 25, 2026
Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41685
GO-2026-5280
GHSA-98vh-x9cx-9cfp
Jun 25, 2026
Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41647
GO-2026-5384
GHSA-fwj8-62r8-8p8m
Jun 25, 2026
Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40195
GO-2026-5397
GHSA-gc7j-g665-rxr9
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40243
GO-2026-5319
GHSA-c839-4qxr-j4x3
Jun 25, 2026
Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-47753
GO-2026-5252
GHSA-8g7m-96c8-8wwc
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-35527
GO-2026-5254
GHSA-8gw4-p4wq-4hcv
Jun 25, 2026
Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41648
GO-2026-5168
GHSA-67wx-r9xr-x75x
Jun 25, 2026
Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40251
GO-2026-5127
GHSA-4m88-wxj4-9qj6
Jun 25, 2026
Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-33542
GO-2026-4882
GHSA-p8mm-23gg-jc9r
Apr 07, 2026
Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Fixed in
6.23.0
References
Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33898
GO-2026-4879
GHSA-453r-g2pg-cxxq
Apr 07, 2026
Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33945
GO-2026-4884
GHSA-q4q8-7f2j-9h9f
Apr 07, 2026
Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33743
GO-2026-4886
GHSA-vg76-xmhg-j5x3
Apr 07, 2026
Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33897
GO-2026-4881
GHSA-83xr-5xxr-mh92
Apr 07, 2026
Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33711
GO-2026-4885
GHSA-q9vp-3wcg-8p4x
Apr 07, 2026
Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-23954
GO-2026-4357
GHSA-7f67-crqm-jgh7
Feb 05, 2026
Incus container image templating arbitrary host file read and write in github.com/lxc/incus Incus container image templating arbitrary host file read and write in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2026-23953
GO-2026-4359
GHSA-x6jc-phwx-hp32
Feb 05, 2026
Incus container environment configuration newline injection in github.com/lxc/incus Incus container environment configuration newline injection in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2025-64507
GO-2025-4115
GHSA-56mx-8g9f-5crf
Nov 17, 2025
Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus References Updated Mar 03, 2026 · Source: OSV.dev |
v6.10.0
minor
Dependencies (63)
+ 55 more |
|
v6.9.0
minor
30 CVEs
CVE-2026-55621
GO-2026-6318
GHSA-64f3-v33m-w89f
Sep 02, 2026
Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-55622
GO-2026-6319
GHSA-c9f5-j9c3-mhrg
Sep 02, 2026
Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus References
Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-48753
GO-2026-5802
GHSA-ccjc-4qc3-jxqc
Jul 07, 2026
Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48754
GO-2026-5800
GHSA-4xg6-52mh-fpw8
Jul 07, 2026
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48750
GO-2026-5801
GHSA-73hr-m85f-64v9
Jul 07, 2026
Incus has an arbitrary file write on host via `exec-output` symlink in crafted image in github.com/lxc/incus Incus has an arbitrary file write on host via Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48749
GO-2026-5798
GHSA-2q3f-q5pq-g8wv
Jul 07, 2026
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48755
GO-2026-5808
GHSA-v6mj-8pf4-hhw4
Jul 07, 2026
Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48756
GO-2026-5810
GHSA-xhqx-mgh3-3h7q
Jul 07, 2026
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48752
GO-2026-5803
GHSA-vxp5-584q-c479
Jul 07, 2026
Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48751
GO-2026-5799
GHSA-48q5-w887-33wv
Jul 07, 2026
Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48769
GO-2026-5806
GHSA-f6m5-xw2g-xc4x
Jul 07, 2026
Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-41684
GO-2026-5742
GHSA-x5r6-jr56-89pv
Jun 25, 2026
Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40197
GO-2026-5612
GHSA-r7w7-mmxr-47r9
Jun 25, 2026
Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41685
GO-2026-5280
GHSA-98vh-x9cx-9cfp
Jun 25, 2026
Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41647
GO-2026-5384
GHSA-fwj8-62r8-8p8m
Jun 25, 2026
Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40195
GO-2026-5397
GHSA-gc7j-g665-rxr9
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40243
GO-2026-5319
GHSA-c839-4qxr-j4x3
Jun 25, 2026
Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-47753
GO-2026-5252
GHSA-8g7m-96c8-8wwc
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-35527
GO-2026-5254
GHSA-8gw4-p4wq-4hcv
Jun 25, 2026
Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41648
GO-2026-5168
GHSA-67wx-r9xr-x75x
Jun 25, 2026
Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40251
GO-2026-5127
GHSA-4m88-wxj4-9qj6
Jun 25, 2026
Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-33542
GO-2026-4882
GHSA-p8mm-23gg-jc9r
Apr 07, 2026
Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Fixed in
6.23.0
References
Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33898
GO-2026-4879
GHSA-453r-g2pg-cxxq
Apr 07, 2026
Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33945
GO-2026-4884
GHSA-q4q8-7f2j-9h9f
Apr 07, 2026
Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33743
GO-2026-4886
GHSA-vg76-xmhg-j5x3
Apr 07, 2026
Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33897
GO-2026-4881
GHSA-83xr-5xxr-mh92
Apr 07, 2026
Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33711
GO-2026-4885
GHSA-q9vp-3wcg-8p4x
Apr 07, 2026
Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-23954
GO-2026-4357
GHSA-7f67-crqm-jgh7
Feb 05, 2026
Incus container image templating arbitrary host file read and write in github.com/lxc/incus Incus container image templating arbitrary host file read and write in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2026-23953
GO-2026-4359
GHSA-x6jc-phwx-hp32
Feb 05, 2026
Incus container environment configuration newline injection in github.com/lxc/incus Incus container environment configuration newline injection in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2025-64507
GO-2025-4115
GHSA-56mx-8g9f-5crf
Nov 17, 2025
Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus References Updated Mar 03, 2026 · Source: OSV.dev |
v6.9.0
minor
Dependencies (61)
+ 53 more |
|
v6.8.0
minor
30 CVEs
CVE-2026-55621
GO-2026-6318
GHSA-64f3-v33m-w89f
Sep 02, 2026
Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-55622
GO-2026-6319
GHSA-c9f5-j9c3-mhrg
Sep 02, 2026
Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus References
Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-48753
GO-2026-5802
GHSA-ccjc-4qc3-jxqc
Jul 07, 2026
Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48754
GO-2026-5800
GHSA-4xg6-52mh-fpw8
Jul 07, 2026
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48750
GO-2026-5801
GHSA-73hr-m85f-64v9
Jul 07, 2026
Incus has an arbitrary file write on host via `exec-output` symlink in crafted image in github.com/lxc/incus Incus has an arbitrary file write on host via Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48749
GO-2026-5798
GHSA-2q3f-q5pq-g8wv
Jul 07, 2026
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48755
GO-2026-5808
GHSA-v6mj-8pf4-hhw4
Jul 07, 2026
Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48756
GO-2026-5810
GHSA-xhqx-mgh3-3h7q
Jul 07, 2026
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48752
GO-2026-5803
GHSA-vxp5-584q-c479
Jul 07, 2026
Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48751
GO-2026-5799
GHSA-48q5-w887-33wv
Jul 07, 2026
Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48769
GO-2026-5806
GHSA-f6m5-xw2g-xc4x
Jul 07, 2026
Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-41684
GO-2026-5742
GHSA-x5r6-jr56-89pv
Jun 25, 2026
Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40197
GO-2026-5612
GHSA-r7w7-mmxr-47r9
Jun 25, 2026
Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41685
GO-2026-5280
GHSA-98vh-x9cx-9cfp
Jun 25, 2026
Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41647
GO-2026-5384
GHSA-fwj8-62r8-8p8m
Jun 25, 2026
Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40195
GO-2026-5397
GHSA-gc7j-g665-rxr9
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40243
GO-2026-5319
GHSA-c839-4qxr-j4x3
Jun 25, 2026
Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-47753
GO-2026-5252
GHSA-8g7m-96c8-8wwc
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-35527
GO-2026-5254
GHSA-8gw4-p4wq-4hcv
Jun 25, 2026
Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41648
GO-2026-5168
GHSA-67wx-r9xr-x75x
Jun 25, 2026
Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40251
GO-2026-5127
GHSA-4m88-wxj4-9qj6
Jun 25, 2026
Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-33542
GO-2026-4882
GHSA-p8mm-23gg-jc9r
Apr 07, 2026
Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Fixed in
6.23.0
References
Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33898
GO-2026-4879
GHSA-453r-g2pg-cxxq
Apr 07, 2026
Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33945
GO-2026-4884
GHSA-q4q8-7f2j-9h9f
Apr 07, 2026
Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33743
GO-2026-4886
GHSA-vg76-xmhg-j5x3
Apr 07, 2026
Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33897
GO-2026-4881
GHSA-83xr-5xxr-mh92
Apr 07, 2026
Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33711
GO-2026-4885
GHSA-q9vp-3wcg-8p4x
Apr 07, 2026
Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-23954
GO-2026-4357
GHSA-7f67-crqm-jgh7
Feb 05, 2026
Incus container image templating arbitrary host file read and write in github.com/lxc/incus Incus container image templating arbitrary host file read and write in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2026-23953
GO-2026-4359
GHSA-x6jc-phwx-hp32
Feb 05, 2026
Incus container environment configuration newline injection in github.com/lxc/incus Incus container environment configuration newline injection in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2025-64507
GO-2025-4115
GHSA-56mx-8g9f-5crf
Nov 17, 2025
Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus References Updated Mar 03, 2026 · Source: OSV.dev |
v6.8.0
minor
Dependencies (61)
+ 53 more |
|
v6.7.0
minor
30 CVEs
CVE-2026-55621
GO-2026-6318
GHSA-64f3-v33m-w89f
Sep 02, 2026
Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-55622
GO-2026-6319
GHSA-c9f5-j9c3-mhrg
Sep 02, 2026
Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus References
Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-48753
GO-2026-5802
GHSA-ccjc-4qc3-jxqc
Jul 07, 2026
Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48754
GO-2026-5800
GHSA-4xg6-52mh-fpw8
Jul 07, 2026
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48750
GO-2026-5801
GHSA-73hr-m85f-64v9
Jul 07, 2026
Incus has an arbitrary file write on host via `exec-output` symlink in crafted image in github.com/lxc/incus Incus has an arbitrary file write on host via Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48749
GO-2026-5798
GHSA-2q3f-q5pq-g8wv
Jul 07, 2026
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48755
GO-2026-5808
GHSA-v6mj-8pf4-hhw4
Jul 07, 2026
Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48756
GO-2026-5810
GHSA-xhqx-mgh3-3h7q
Jul 07, 2026
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48752
GO-2026-5803
GHSA-vxp5-584q-c479
Jul 07, 2026
Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48751
GO-2026-5799
GHSA-48q5-w887-33wv
Jul 07, 2026
Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48769
GO-2026-5806
GHSA-f6m5-xw2g-xc4x
Jul 07, 2026
Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-41684
GO-2026-5742
GHSA-x5r6-jr56-89pv
Jun 25, 2026
Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40197
GO-2026-5612
GHSA-r7w7-mmxr-47r9
Jun 25, 2026
Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41685
GO-2026-5280
GHSA-98vh-x9cx-9cfp
Jun 25, 2026
Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41647
GO-2026-5384
GHSA-fwj8-62r8-8p8m
Jun 25, 2026
Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40195
GO-2026-5397
GHSA-gc7j-g665-rxr9
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40243
GO-2026-5319
GHSA-c839-4qxr-j4x3
Jun 25, 2026
Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-47753
GO-2026-5252
GHSA-8g7m-96c8-8wwc
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-35527
GO-2026-5254
GHSA-8gw4-p4wq-4hcv
Jun 25, 2026
Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41648
GO-2026-5168
GHSA-67wx-r9xr-x75x
Jun 25, 2026
Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40251
GO-2026-5127
GHSA-4m88-wxj4-9qj6
Jun 25, 2026
Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-33542
GO-2026-4882
GHSA-p8mm-23gg-jc9r
Apr 07, 2026
Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Fixed in
6.23.0
References
Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33898
GO-2026-4879
GHSA-453r-g2pg-cxxq
Apr 07, 2026
Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33945
GO-2026-4884
GHSA-q4q8-7f2j-9h9f
Apr 07, 2026
Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33743
GO-2026-4886
GHSA-vg76-xmhg-j5x3
Apr 07, 2026
Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33897
GO-2026-4881
GHSA-83xr-5xxr-mh92
Apr 07, 2026
Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33711
GO-2026-4885
GHSA-q9vp-3wcg-8p4x
Apr 07, 2026
Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-23954
GO-2026-4357
GHSA-7f67-crqm-jgh7
Feb 05, 2026
Incus container image templating arbitrary host file read and write in github.com/lxc/incus Incus container image templating arbitrary host file read and write in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2026-23953
GO-2026-4359
GHSA-x6jc-phwx-hp32
Feb 05, 2026
Incus container environment configuration newline injection in github.com/lxc/incus Incus container environment configuration newline injection in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2025-64507
GO-2025-4115
GHSA-56mx-8g9f-5crf
Nov 17, 2025
Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus References Updated Mar 03, 2026 · Source: OSV.dev |
v6.7.0
minor
Dependencies (61)
+ 53 more |
|
v6.6.0
initial
30 CVEs
CVE-2026-55621
GO-2026-6318
GHSA-64f3-v33m-w89f
Sep 02, 2026
Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-55622
GO-2026-6319
GHSA-c9f5-j9c3-mhrg
Sep 02, 2026
Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus References
Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-48753
GO-2026-5802
GHSA-ccjc-4qc3-jxqc
Jul 07, 2026
Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48754
GO-2026-5800
GHSA-4xg6-52mh-fpw8
Jul 07, 2026
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48750
GO-2026-5801
GHSA-73hr-m85f-64v9
Jul 07, 2026
Incus has an arbitrary file write on host via `exec-output` symlink in crafted image in github.com/lxc/incus Incus has an arbitrary file write on host via Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48749
GO-2026-5798
GHSA-2q3f-q5pq-g8wv
Jul 07, 2026
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48755
GO-2026-5808
GHSA-v6mj-8pf4-hhw4
Jul 07, 2026
Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48756
GO-2026-5810
GHSA-xhqx-mgh3-3h7q
Jul 07, 2026
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48752
GO-2026-5803
GHSA-vxp5-584q-c479
Jul 07, 2026
Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48751
GO-2026-5799
GHSA-48q5-w887-33wv
Jul 07, 2026
Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-48769
GO-2026-5806
GHSA-f6m5-xw2g-xc4x
Jul 07, 2026
Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-41684
GO-2026-5742
GHSA-x5r6-jr56-89pv
Jun 25, 2026
Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40197
GO-2026-5612
GHSA-r7w7-mmxr-47r9
Jun 25, 2026
Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41685
GO-2026-5280
GHSA-98vh-x9cx-9cfp
Jun 25, 2026
Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41647
GO-2026-5384
GHSA-fwj8-62r8-8p8m
Jun 25, 2026
Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40195
GO-2026-5397
GHSA-gc7j-g665-rxr9
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40243
GO-2026-5319
GHSA-c839-4qxr-j4x3
Jun 25, 2026
Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-47753
GO-2026-5252
GHSA-8g7m-96c8-8wwc
Jun 25, 2026
Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-35527
GO-2026-5254
GHSA-8gw4-p4wq-4hcv
Jun 25, 2026
Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-41648
GO-2026-5168
GHSA-67wx-r9xr-x75x
Jun 25, 2026
Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-40251
GO-2026-5127
GHSA-4m88-wxj4-9qj6
Jun 25, 2026
Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-33542
GO-2026-4882
GHSA-p8mm-23gg-jc9r
Apr 07, 2026
Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus Fixed in
6.23.0
References
Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33898
GO-2026-4879
GHSA-453r-g2pg-cxxq
Apr 07, 2026
Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33945
GO-2026-4884
GHSA-q4q8-7f2j-9h9f
Apr 07, 2026
Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33743
GO-2026-4886
GHSA-vg76-xmhg-j5x3
Apr 07, 2026
Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33897
GO-2026-4881
GHSA-83xr-5xxr-mh92
Apr 07, 2026
Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-33711
GO-2026-4885
GHSA-q9vp-3wcg-8p4x
Apr 07, 2026
Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus Fixed in
6.23.0
References Updated Apr 07, 2026 · Source: OSV.dev
CVE-2026-23954
GO-2026-4357
GHSA-7f67-crqm-jgh7
Feb 05, 2026
Incus container image templating arbitrary host file read and write in github.com/lxc/incus Incus container image templating arbitrary host file read and write in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2026-23953
GO-2026-4359
GHSA-x6jc-phwx-hp32
Feb 05, 2026
Incus container environment configuration newline injection in github.com/lxc/incus Incus container environment configuration newline injection in github.com/lxc/incus References
Updated Feb 05, 2026 · Source: OSV.dev
CVE-2025-64507
GO-2025-4115
GHSA-56mx-8g9f-5crf
Nov 17, 2025
Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus References Updated Mar 03, 2026 · Source: OSV.dev |
v6.6.0
initial
Dependencies (61)
+ 53 more |