Canonical LXD

• CVE-2026-112816 Critical 10.0 Improper certificate validation in the HTTPS listener in LXD 0.3%
• CVE-2026-87798 Medium 5.8 LXD client recursive file pull allows directory escape via malicious VM agent 0.2%
• CVE-2026-87799 Critical 9.9 Arbitrary file write on LXD host via symlink in migration stream 0.4%
• CVE-2026-97335 High 7.7 Incorrect authorization in LXD storage volume API allows reading volumes from other projects 0.2%
• CVE-2026-85185 Critical 9.6 Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root 0.4%
• CVE-2026-85526 Critical 9.9 Path traversal via Btrfs optimized-backup subvolumes[].path enables root file/dir manipulation in LXD 0.5%
• CVE-2026-86335 Medium 6.3 LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse 0.2%
• CVE-2026-86334 Medium 4.2 CLI Path Traversal via Content-Disposition in LXD Image Export/Copy 0.3%
• CVE-2026-66897 Critical 9.9 Instance template path traversal allows arbitrary host file write as root 0.7%
• CVE-2026-55622 High 7.7 Incus has a project restriction bypass in instance copy across projects 0.5%
• CVE-2026-55621 High 7.7 Incus has a project restriction bypass for custom volume copy across projects 0.4%
• CVE-2026-48769 Critical 9.9 Incus has an arbitrary file write on its client due to trusted image hash 0.8%
• CVE-2026-48755 Critical 9.9 Incus has an argument injection in backup compression algorithm leading to AFW and ACE 0.8%
• CVE-2026-48752 Critical 9.9 Incus has arbitrary file read+write on host via templates/ symlink in malicious image 0.8%
• CVE-2026-48751 Critical 9.9 Incus has a restricted project bypass leading to arbitrary command execution 0.7%
• CVE-2026-48750 Critical 9.9 Incus has an arbitrary file write on host via `exec-output` symlink in crafted image 0.8%
• CVE-2026-48749 Critical 9.9 Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image 0.8%
• CVE-2026-16033 High 8.5 Arbitrary file read+write on host via templates/ symlink in malicious image 0.5%
• CVE-2026-66898 Critical 9.9 Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE 0.6%
• CVE-2026-63293 Critical 9.9 Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root 0.6%
• CVE-2026-63294 Critical 9.9 Root RCE via image backup.yaml symlink 0.9%
• CVE-2026-63295 Medium 4.3 Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated` 0.3%
• CVE-2026-63296 Critical 9.9 Project restriction bypass via instance migration config override 0.4%
• CVE-2026-63297 Critical 9.9 Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge 0.3%
• CVE-2026-63298 High 8.7 LXD arbitrary lxc.conf directive injection via NVIDIA instance configuration 0.7%
• CVE-2026-63299 High 8.5 Storage volume cross-project move and snapshot restore bypass project disk limits 0.6%
• CVE-2026-62420 Critical 9.9 Cross-project cluster migration bypasses project restrictions via cluster notification flag 0.5%
• CVE-2026-63300 Critical 9.9 Cross-project instance move bypasses all project restrictions allowing host command execution 0.5%
• CVE-2026-28385 Medium 5.0 SSRF via image import from URL allows internal network probing by authenticated users 0.3%
• CVE-2026-9640 High 7.2 LXD Snapshot Import Privilege Escalation Vulnerability 0.6%
• CVE-2026-9639 Medium 6.5 Authenticated Denial of Service via Malicious Backup Tarball in LXD 0.5%
• CVE-2026-12411 High 8.4 Broken Access Control in Canonical LXD DevLXD API 0.2%
• CVE-2026-34179 Critical 9.1 Update of type field in restricted TLS certificate allows privilege escalation to cluster admin 0.3%
• CVE-2026-34178 Critical 9.1 Importing a crafted backup leads to project restriction bypass 0.4%
• CVE-2026-34177 Critical 9.1 VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf 0.4%
• CVE-2026-28384 Critical 9.4 Authenticated RCE via unsanitized compression_algorithm 0.7%
• CVE-2026-3351 Low 2.1 Authorization Bypass in LXD GET /1.0/certificates Endpoint 0.2%
• CVE-2025-54293 High 7.1 Path Traversal in LXD Instance Log File Retrieval 0.6%
• CVE-2025-54292 Medium 4.8 Client-Side Path Traversal in LXD-UI 0.3%
• CVE-2025-54291 Medium 6.9 Project existence disclosure in LXD images API 0.4%
• CVE-2025-54290 Medium 6.9 Project Existence Disclosure via Error Handling in LXD Image Export 0.3%
• CVE-2025-54289 High 7.4 Privilege Escalation via WebSocket Connection Hijacking in LXD Operations API 0.2%
• CVE-2025-54288 Medium 5.1 Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server 0.4%
• CVE-2025-54287 High 7.1 Arbitrary File Read via Template Injection in Snapshot Patterns 0.4%
• CVE-2025-54286 High 7.5 CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI 0.1%