Vulnerabilities in lxc
51 resultsCVE-2026-40251HIGHIncus out-of-bounds panic in snapshot metadata handling allows denial of serviceEPSS 0.4%CVE-2026-115377CRITICALIncus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration StreamEPSS 0.4%CVE-2026-115375CRITICALIncus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent VolumesEPSS 0.4%CVE-2026-40195HIGHIncus nil-pointer dereference in storage bucket import allows denial of serviceEPSS 0.4%CVE-2026-41647MEDIUMIncus: Nil-Pointer Dereference via S3 Bucket ImportEPSS 0.4%CVE-2026-33743MEDIUMIncus vulnerable to denial of source through crafted bucket backup fileEPSS 0.4%CVE-2026-40197HIGHIncus nil-pointer dereference in custom volume import allows denial of serviceEPSS 0.4%CVE-2026-48756LOWIncus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)EPSS 0.4%CVE-2026-48754LOWIncus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}EPSS 0.4%CVE-2026-115370MEDIUMIncus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration RefreshEPSS 0.4%CVE-2026-33711MEDIUMIncus vulnerable to local privilege escalation through VM screenshot pathEPSS 0.4%CVE-2026-115372CRITICALIncus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_optionsEPSS 0.4%CVE-2026-62313MEDIUMIncus: Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated`EPSS 0.4%CVE-2026-33898HIGHLocal Incus UI web server vulnerable to nuthentication bypassEPSS 0.4%CVE-2026-41685MEDIUMIncus: Unbounded binary import disk exhaustionEPSS 0.3%CVE-2026-115373HIGHIncus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid}EPSS 0.3%CVE-2026-115378MEDIUMIncus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File PullEPSS 0.3%CVE-2026-115376HIGHIncus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 Project Restriction Bypass via Custom Volume CopyEPSS 0.3%CVE-2026-35527MEDIUMIncus blind SSRF via image import preflight HEAD requestEPSS 0.3%CVE-2026-41648MEDIUMIncus: Unbounded YAML Metadata Decode via ParsingEPSS 0.3%