IN
Product
incus
45
CVEs
0
On KEV
9.9
Max CVSS
9
New 30D
Severity mix
Critical 16High 11Medium 16Low 2
Watch
Add incus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-33898 | 8.8 | Mar 26 | Local Incus UI web server vulnerable to nuthentication bypass Affected: < 6.23.0 |
| CVE-2026-23954 | 8.7 | Jan 22 | Incus container image templating arbitrary host file read and write Affected: >= 6.1.0, <= 6.20.0; <= 6.0.5 |
| CVE-2026-23953 | 8.7 | Jan 22 | Incus container environment configuration newline injection Affected: >= 6.1.0, <= 6.20.0; <= 6.0.5 |
| CVE-2026-115372 New | 8.5 | Oct 22 | Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options Affected: 7.3.0 before 7.5.0 |
| CVE-2026-33711 | 7.8 | Mar 26 | Incus vulnerable to local privilege escalation through VM screenshot path Affected: < 6.23.0 |
| CVE-2025-64507 | 7.8 | Nov 10 | Incus vulnerable to local privilege escalation through custom storage volumes Affected: < 6.0.6; >= 6.1.0, < 6.19.0 |
| CVE-2026-115376 New | 7.7 | Oct 22 | Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 Project Restriction Bypass via Custom Volume Copy Affected: 7.0.1 before 7.0.2; 7.2.0 before 7.5.0 |
| CVE-2026-55622 | 7.7 | Aug 21 | Incus has a project restriction bypass in instance copy across projects Affected: < 7.2.0 |
| CVE-2026-55621 | 7.7 | Aug 21 | Incus has a project restriction bypass for custom volume copy across projects Affected: < 7.2.0 |
| CVE-2026-115374 New | 7.1 | Oct 22 | Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Unsigned Header Bypass in Presigned S3 Upload URLs Affected: 7.0.0 before 7.0.2; 7.1.0 before 7.5.0 |
| CVE-2026-115371 New | 7.1 | Oct 22 | LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential Disclosure via Storage Bucket Keys Endpoints Affected: 6.0.3 before 6.0.7; 6.6.0 before 7.0.2; 7.1.0 before 7.5.0 |
Showing 11