CVE-2026-52727 | High | 7.2 | 2026-09-17 | lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinu… |
CVE-2026-63343 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a `metadata.yaml` symlink pointing to an arbitrar… |
CVE-2026-63125 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user (a non-admin TLS/RBAC identity wi… |
CVE-2026-62941 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check (`Allo… |
CVE-2026-62940 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configurat… |
CVE-2026-62867 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided `block.create_options` in storage volume… |
CVE-2026-62313 | Medium | 4.3 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.3.0, project-level enforcement of `restricted.containers.privilege=isolated` can be… |
CVE-2026-55622 | High | 7.7 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker know… |
CVE-2026-55621 | High | 7.7 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker… |
CVE-2026-48769 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image serv… |
CVE-2026-48756 | | | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateCustomVolumeFromBackup` in `internal/server/storage/backend… |
CVE-2026-48755 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to arg… |
CVE-2026-48754 | | | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).createDependentVolumesFromBackup` in `internal/server/storage/back… |
CVE-2026-48753 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows cre… |
CVE-2026-48752 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to read or create/wri… |
CVE-2026-48751 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore the `restricted.containers.lowlevel=block` setting… |
CVE-2026-48750 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output` parameter of the `/instances/$name/exec` endpoint stores t… |
CVE-2026-48749 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/write arbitrary files… |
CVE-2026-47753 | | | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateInstanceFromBackup` in `internal/server/storage/backend.go`… |
CVE-2026-41685 | Medium | 4.3 | 2026-05-07 | Incus is a system container and virtual machine manager. Prior to version 7.0.0, uploads of large amount of data by authenticated users can run the Incus serve… |
CVE-2026-41684 | Medium | 6.5 | 2026-05-07 | Incus is a system container and virtual machine manager. Prior to version 7.0.0, backup.GetInfo() trusts the inline backup/index.yaml config when present and o… |
CVE-2026-41648 | Medium | 5.0 | 2026-05-07 | Incus is a system container and virtual machine manager. Prior to version 7.0.0, user provided image and backup tarballs would be unpacked and YAML files parse… |
CVE-2026-41647 | Medium | 6.5 | 2026-05-07 | Incus is a system container and virtual machine manager. Prior to version 7.0.0, a missing error handling could lead an authenticated Incus user to cause a dae… |
CVE-2026-40251 | Medium | 6.5 | 2026-05-06 | Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authen… |
CVE-2026-40243 | Medium | 4.8 | 2026-05-06 | Incus is a system container and virtual machine manager. In versions before 7.0.0, broken TLS validation logic in the OVN database connection logic can allow c… |
CVE-2026-40197 | Medium | 6.5 | 2026-05-06 | Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authen… |
CVE-2026-40195 | Medium | 6.5 | 2026-05-06 | Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage bucket import logic allows an authen… |
CVE-2026-39402 | Medium | 6.5 | 2026-05-05 | lxc is a Linux container runtime. In the setuid helper lxc-user-nic, the delete path contains a logic flaw in the find_line() function that allows an unprivile… |
CVE-2026-35527 | Medium | 5.0 | 2026-05-05 | Incus is an open source container and virtual machine manager. In versions prior to 7.0.0, the image import flow issues an outbound HEAD request to a user-supp… |
CVE-2026-33945 | Critical | 9.9 | 2026-03-27 | Incus is a system container and virtual machine manager. Incus instances have an option to provide credentials to systemd in the guest. For containers, this is… |
CVE-2026-33898 | High | 8.8 | 2026-03-27 | Incus is a system container and virtual machine manager. Prior to version 6.23.0, the web server spawned by `incus webui` incorrectly validates the authenticat… |
CVE-2026-33897 | Critical | 9.9 | 2026-03-26 | Incus is a system container and virtual machine manager. Prior to version 6.23.0, instance template files can be used to cause arbitrary read or writes as root… |
CVE-2026-33743 | Medium | 6.5 | 2026-03-26 | Incus is a system container and virtual machine manager. Prior to version 6.23.0, a specially crafted storage bucket backup can be used by an user with access… |
CVE-2026-33711 | High | 7.8 | 2026-03-26 | Incus is a system container and virtual machine manager. Incus provides an API to retrieve VM screenshots. That API relies on the use of a temporary file for Q… |
CVE-2026-33542 | Medium | 4.8 | 2026-03-26 | Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from simplestr… |
CVE-2026-32606 | High | 7.6 | 2026-03-18 | IncusOS is an immutable OS image dedicated to running Incus. Prior to 202603142010, the default configuration of systemd-cryptenroll as used by IncusOS through… |
CVE-2026-23954 | High | 8.7 | 2026-01-22 | Incus is a system container and virtual machine manager. Versions 6.21.0 and below allow a user with the ability to launch a container with a custom image (e.g… |
CVE-2026-23953 | High | 8.7 | 2026-01-22 | Incus is a system container and virtual machine manager. In versions 6.20.0 and below, a user with the ability to launch a container with a custom YAML configu… |
CVE-2025-64507 | High | 7.8 | 2025-11-10 | Incus is a system container and virtual machine manager. An issue in versions prior to 6.0.6 and 6.19.0 affects any Incus user in an environment where an unpri… |
CVE-2025-52890 | High | 8.1 | 2025-06-25 | Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus versions 6.12 and 6.13generates nftables ru… |
CVE-2025-52889 | Low | 3.4 | 2025-06-25 | Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus version 6.12 and 6.13 generates nftables ru… |