Product by Lxc
Incus
47 known vulnerabilities in Incus (Lxc), 0 of them actively exploited (CISA KEV).
Key figures
47
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
17
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-48752 | Incus has arbitrary file read+write on host via templates/ symlink in malicious image | 9.9 | |
| Critical | CVE-2026-48750 | Incus has an arbitrary file write on host via `exec-output` symlink in crafted image | 9.9 | |
| Critical | CVE-2026-48769 | Incus has an arbitrary file write on its client due to trusted image hash | 9.9 | |
| Critical | CVE-2026-48755 | Incus has an argument injection in backup compression algorithm leading to AFW and ACE | 9.9 | |
| Critical | CVE-2026-48753 | Incus has an arbitrary file write via path traversal in S3 multipart upload | 9.9 | |
| Critical | CVE-2026-48749 | Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image | 9.9 | |
| Critical | CVE-2026-63125 | Incus vulnerable to root RCE via image backup.yaml symlink | 9.9 | |
| Critical | CVE-2026-48751 | Incus has a restricted project bypass leading to arbitrary command execution | 9.9 | |
| Critical | CVE-2026-115377 | Lxc Incus: Link Following | 9.9 | |
| Critical | CVE-2026-115375 | Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes | 9.9 | |
| Critical | CVE-2026-62867 | Lxc Incus: Argument Injection | 9.9 | |
| Critical | CVE-2026-63343 | Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root | 9.9 | |
| Critical | CVE-2026-62941 | Incus: Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge | 9.9 | |
| Critical | CVE-2026-62940 | Incus has a project restriction bypass via instance migration config override | 9.9 | |
| Critical | CVE-2026-115372 | Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options | 8.5 | |
| High | CVE-2026-23954 | Incus container image templating arbitrary host file read and write | 8.7 | |
| Critical | CVE-2026-33897 | Incus vulnerable to arbitrary file read and write through pongo templates | 10.0 | |
| Critical | CVE-2026-33945 | Abitrary file write through systemd-creds option | 10.0 | |
| High | CVE-2026-115376 | Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 Project Restriction Bypass via Custom Volume Copy | 7.7 | |
| High | CVE-2026-23953 | Incus container environment configuration newline injection | 8.7 | |
| High | CVE-2026-55622 | Incus has a project restriction bypass in instance copy across projects | 7.7 | |
| High | CVE-2026-55621 | Incus has a project restriction bypass for custom volume copy across projects | 7.7 | |
| Medium | CVE-2026-115378 | Lxc Incus: Link Following | 5.8 | |
| High | CVE-2026-115371 | Lxc Incus: Insufficiently Protected Credentials | 7.1 | |
| High | CVE-2026-33898 | Local Incus UI web server vulnerable to nuthentication bypass | 8.8 |