Vulnerabilities

TI-2026-30202 CVE-2026-41685 · GHSA-98vh-x9cx-9cfp

Incus: Unbounded binary import disk exhaustion

MEDIUM 53

Incus is a system container and virtual machine manager.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00333 Published 2026-05-07 Fixed in 7.0.0 CWE-770

TI-2026-30201 CVE-2026-41684 · GHSA-x5r6-jr56-89pv

Incus: Nil Dereferences on Restore via Malformed YAML

LOW 29

Incus is a system container and virtual machine manager.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00408 Published 2026-05-07 Fixed in 7.0.0 CWE-476

TI-2026-30167 CVE-2026-41648 · GHSA-67wx-r9xr-x75x

Incus: Unbounded YAML Metadata Decode via Parsing

MEDIUM 57

Incus is a system container and virtual machine manager.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00269 Published 2026-05-07 Fixed in 7.0.0 CWE-770

TI-2026-30166 CVE-2026-41647 · GHSA-fwj8-62r8-8p8m

Incus: Nil-Pointer Dereference via S3 Bucket Import

LOW 29

Incus is a system container and virtual machine manager.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00394 Published 2026-05-07 Fixed in 7.0.0 CWE-476

TI-2026-29045 CVE-2026-40251 · GHSA-4m88-wxj4-9qj6

Incus out-of-bounds panic in snapshot metadata handling allows denial of service

HIGH 70

Incus is a system container and virtual machine manager.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00408 Published 2026-05-06 Fixed in 7.0.0 CWE-129

TI-2026-29037 CVE-2026-40243 · GHSA-c839-4qxr-j4x3

Incus OVN TLS verification accepts peer-supplied roots and permits endpoint impersonation

MEDIUM 45

Incus is a system container and virtual machine manager.

CVSS 4.0LOW 2.3 Adjacent network No auth No interaction EPSS 0.00173 Published 2026-05-06 Fixed in 7.0.0 CWE-295

TI-2026-29011 CVE-2026-40197 · GHSA-r7w7-mmxr-47r9

Incus nil-pointer dereference in custom volume import allows denial of service

LOW 31

Incus is a system container and virtual machine manager.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00385 Published 2026-05-06 Fixed in 7.0.0 CWE-476

TI-2026-29009 CVE-2026-40195 · GHSA-gc7j-g665-rxr9

Incus nil-pointer dereference in storage bucket import allows denial of service

MEDIUM 64

Incus is a system container and virtual machine manager.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00398 Published 2026-05-06 Fixed in 7.0.0 CWE-476

TI-2026-27642 CVE-2026-35527 · GHSA-8gw4-p4wq-4hcv

Incus blind SSRF via image import preflight HEAD request

MEDIUM 57

Incus is an open source container and virtual machine manager.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00271 Published 2026-05-05 Fixed in 7.0.0 CWE-918

TI-2026-26295 CVE-2026-33945 · GHSA-q4q8-7f2j-9h9f

Abitrary file write through systemd-creds option

MEDIUM 43

Incus is a system container and virtual machine manager.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00455 Published 2026-03-26 Fixed in 6.23.0 CWE-22

TI-2026-26256 CVE-2026-33898 · GHSA-453r-g2pg-cxxq

Local Incus UI web server vulnerable to nuthentication bypass

MEDIUM 40

Incus is a system container and virtual machine manager.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00353 Published 2026-03-26 Fixed in 6.23.0 CWE-287

TI-2026-26255 CVE-2026-33897 · GHSA-83xr-5xxr-mh92

Incus vulnerable to arbitrary file read and write through pongo templates

MEDIUM 49

Incus is a system container and virtual machine manager.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00489 Published 2026-03-26 Fixed in 6.23.0 CWE-1336

TI-2026-26122 CVE-2026-33743 · GHSA-vg76-xmhg-j5x3

Incus vulnerable to denial of source through crafted bucket backup file

MEDIUM 62

Incus is a system container and virtual machine manager.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00392 Published 2026-03-26 Fixed in 6.23.0 CWE-770

TI-2026-26090 CVE-2026-33711 · GHSA-q9vp-3wcg-8p4x

Incus vulnerable to local privilege escalation through VM screenshot path

MEDIUM 55

Incus is a system container and virtual machine manager.

CVSS 4.0MEDIUM 4.7 Local Low privileges No interaction EPSS 0.00364 Published 2026-03-26 Fixed in 6.23.0 CWE-61

TI-2026-25935 CVE-2026-33542 · GHSA-p8mm-23gg-jc9r

Incus does not verify combined fingerprint when downloading images from simplestreams servers

MEDIUM 59

Incus is a system container and virtual machine manager.

CVSS 4.0MEDIUM 5.7 Network Low privileges No interaction EPSS 0.00183 Published 2026-03-26 Fixed in 6.23.0 CWE-295

TI-2026-19296 CVE-2026-23954 · GHSA-7f67-crqm-jgh7

Incus container image templating arbitrary host file read and write

HIGH 73

Incus is a system container and virtual machine manager.

CVSS 3.1HIGH 8.7 Adjacent network Low privileges No interaction EPSS 0.00781 Published 2026-01-22 No fix listed CWE-22

TI-2026-19295 CVE-2026-23953 · GHSA-x6jc-phwx-hp32

Incus container environment configuration newline injection

HIGH 73

Incus is a system container and virtual machine manager.

CVSS 3.1HIGH 8.7 Adjacent network Low privileges No interaction EPSS 0.0049 Published 2026-01-22 Fixed in 6.21.0 CWE-93

TI-2025-39899 CVE-2025-64507 · GHSA-56mx-8g9f-5crf

Incus vulnerable to local privilege escalation through custom storage volumes

HIGH 72

Incus is a system container and virtual machine manager.

CVSS 4.0HIGH 8.6 Local No auth No interaction EPSS 0.00178 Published 2025-11-10 Fixed in 6.0.6, 6.19.0 CWE-269

Vulnerabilities

Filters