Llxc

Products

Exploited and recent CVEs

• CVE-2026-100395 Medium 6.8 LXC: lxc-copy host-context hostname update follows symlink 0.2%
• CVE-2026-115378 Medium 5.8 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pull 0.3%
• CVE-2026-115377 Critical 9.9 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Stream 0.4%
• CVE-2026-115376 High 7.7 Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 Project Restriction Bypass via Custom Volume Copy 0.3%
• CVE-2026-115375 Critical 9.9 Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes 0.4%
• CVE-2026-115374 High 7.1 Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Unsigned Header Bypass in Presigned S3 Upload URLs 0.2%
• CVE-2026-115373 Medium 6.3 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid} 0.3%
• CVE-2026-115372 High 8.5 Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options 0.4%
• CVE-2026-115371 High 7.1 LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential Disclosure via Storage Bucket Keys Endpoints 0.2%
• CVE-2026-115370 Medium 4.3 Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refresh 0.4%
• CVE-2026-52727 High 7.2 lxc-ci: Pacman keyring stored in archlinux image with a private key 0.6%
• CVE-2026-63343 Critical 9.9 Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root 0.5%
• CVE-2026-63125 Critical 9.9 Incus vulnerable to root RCE via image backup.yaml symlink 0.7%
• CVE-2026-62941 Critical 9.9 Incus: Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge 0.4%
• CVE-2026-62940 Critical 9.9 Incus has a project restriction bypass via instance migration config override 0.4%
• CVE-2026-62867 Critical 9.9 Incus has an argument injection in storage volume block.create_options that leads to arbitrary command execution 0.5%
• CVE-2026-62313 Medium 4.3 Incus: Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated` 0.4%
• CVE-2026-55622 High 7.7 Incus has a project restriction bypass in instance copy across projects 0.5%
• CVE-2026-55621 High 7.7 Incus has a project restriction bypass for custom volume copy across projects 0.4%
• CVE-2026-48769 Critical 9.9 Incus has an arbitrary file write on its client due to trusted image hash 0.8%
• CVE-2026-48755 Critical 9.9 Incus has an argument injection in backup compression algorithm leading to AFW and ACE 0.8%
• CVE-2026-48754 Low 2.1 Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} 0.4%
• CVE-2026-48753 Critical 9.9 Incus has an arbitrary file write via path traversal in S3 multipart upload 0.7%
• CVE-2026-48752 Critical 9.9 Incus has arbitrary file read+write on host via templates/ symlink in malicious image 0.8%
• CVE-2026-48751 Critical 9.9 Incus has a restricted project bypass leading to arbitrary command execution 0.7%
• CVE-2026-48750 Critical 9.9 Incus has an arbitrary file write on host via `exec-output` symlink in crafted image 0.8%
• CVE-2026-48749 Critical 9.9 Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image 0.8%
• CVE-2026-47753 Medium 4.4 Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) 0.2%
• CVE-2026-48756 Low 2.1 Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) 0.4%
• CVE-2026-41685 Medium 4.3 Incus: Unbounded binary import disk exhaustion 0.3%