IN
Product
Incus
by Linuxcontainers · last CVE May 7, 2026
18
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 2High 5Medium 11Low 0
Watch

Add Incus to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-33897
9.9
0%
Mar 26
Incus vulnerable to arbitrary file read and write through pongo templates
Affected: before 6.23.0
CVE-2026-33945
9.6
0%
Mar 26
Abitrary file write through systemd-creds option
Affected: before 6.23.0
CVE-2026-33898
8.8
0%
Mar 26
Local Incus UI web server vulnerable to nuthentication bypass
Affected: before 6.23.0
CVE-2026-23954
8.7
1%
Jan 22
Incus is a system container and virtual machine manager
Affected: through 6.0.5; 6.1.0 before 6.21.0
CVE-2026-23953
8.7
0%
Jan 22
Incus is a system container and virtual machine manager
Affected: through 6.0.5; 6.1.0 before 6.21.0
CVE-2026-33711
7.8
0%
Mar 26
Incus vulnerable to local privilege escalation through VM screenshot path
Affected: before 6.23.0
CVE-2025-64507
7.8
0%
Nov 10
Incus is a system container and virtual machine manager
Affected: before 6.0.6; 6.1.0 before 6.19.0
CVE-2026-41684
6.5
0%
May 7
Incus: Nil Dereferences on Restore via Malformed YAML
Affected: before 7.0.0
CVE-2026-41647
6.5
0%
May 7
Incus: Nil-Pointer Dereference via S3 Bucket Import
Affected: before 7.0.0
CVE-2026-40251
6.5
0%
May 6
Incus out-of-bounds panic in snapshot metadata handling allows denial of service
Affected: before 7.0.0
CVE-2026-40197
6.5
0%
May 6
Incus nil-pointer dereference in custom volume import allows denial of service
Affected: before 7.0.0
CVE-2026-40195
6.5
0%
May 6
Incus nil-pointer dereference in storage bucket import allows denial of service
Affected: before 7.0.0
CVE-2026-33743
6.5
0%
Mar 26
Incus vulnerable to denial of source through crafted bucket backup file
Affected: before 6.23.0
CVE-2026-41648
5.0
0%
May 7
Incus: Unbounded YAML Metadata Decode via Parsing
Affected: before 7.0.0
CVE-2026-35527
5.0
0%
May 5
Incus blind SSRF via image import preflight HEAD request
Affected: before 7.0.0
CVE-2026-40243
4.8
0%
May 6
Incus OVN TLS verification accepts peer-supplied roots and permits endpoint impersonation
Affected: before 7.0.0
CVE-2026-33542
4.8
0%
Mar 26
Incus does not verify combined fingerprint when downloading images from simplestreams servers
Affected: before 6.23.0
CVE-2026-41685
4.3
0%
May 7
Incus: Unbounded binary import disk exhaustion
Affected: before 7.0.0
Showing 18