IN
Product
Incus
18
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 2High 5Medium 11Low 0
Watch
Add Incus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-33897 | 9.9 | Mar 26 | Incus vulnerable to arbitrary file read and write through pongo templates Affected: before 6.23.0 |
| CVE-2026-33945 | 9.6 | Mar 26 | Abitrary file write through systemd-creds option Affected: before 6.23.0 |
| CVE-2026-33898 | 8.8 | Mar 26 | Local Incus UI web server vulnerable to nuthentication bypass Affected: before 6.23.0 |
| CVE-2026-23954 | 8.7 | Jan 22 | Incus is a system container and virtual machine manager Affected: through 6.0.5; 6.1.0 before 6.21.0 |
| CVE-2026-23953 | 8.7 | Jan 22 | Incus is a system container and virtual machine manager Affected: through 6.0.5; 6.1.0 before 6.21.0 |
| CVE-2026-33711 | 7.8 | Mar 26 | Incus vulnerable to local privilege escalation through VM screenshot path Affected: before 6.23.0 |
| CVE-2025-64507 | 7.8 | Nov 10 | Incus is a system container and virtual machine manager Affected: before 6.0.6; 6.1.0 before 6.19.0 |
| CVE-2026-41684 | 6.5 | May 7 | Incus: Nil Dereferences on Restore via Malformed YAML Affected: before 7.0.0 |
| CVE-2026-41647 | 6.5 | May 7 | Incus: Nil-Pointer Dereference via S3 Bucket Import Affected: before 7.0.0 |
| CVE-2026-40251 | 6.5 | May 6 | Incus out-of-bounds panic in snapshot metadata handling allows denial of service Affected: before 7.0.0 |
| CVE-2026-40197 | 6.5 | May 6 | Incus nil-pointer dereference in custom volume import allows denial of service Affected: before 7.0.0 |
| CVE-2026-40195 | 6.5 | May 6 | Incus nil-pointer dereference in storage bucket import allows denial of service Affected: before 7.0.0 |
| CVE-2026-33743 | 6.5 | Mar 26 | Incus vulnerable to denial of source through crafted bucket backup file Affected: before 6.23.0 |
| CVE-2026-41648 | 5.0 | May 7 | Incus: Unbounded YAML Metadata Decode via Parsing Affected: before 7.0.0 |
| CVE-2026-35527 | 5.0 | May 5 | Incus blind SSRF via image import preflight HEAD request Affected: before 7.0.0 |
| CVE-2026-40243 | 4.8 | May 6 | Incus OVN TLS verification accepts peer-supplied roots and permits endpoint impersonation Affected: before 7.0.0 |
| CVE-2026-33542 | 4.8 | Mar 26 | Incus does not verify combined fingerprint when downloading images from simplestreams servers Affected: before 6.23.0 |
| CVE-2026-41685 | 4.3 | May 7 | Incus: Unbounded binary import disk exhaustion Affected: before 7.0.0 |
Showing 18
