Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 02:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

144-76% vs 7-day avg of 597

2 critical, 38 high, 59 medium, 25 low

Expand	Severity	Score	Advisory	Title	Source	Published
	Medium	6.9	CVE-2026-115378	Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious incus-agent to... lxc, Incuslxc incus, Incus, incus CLI	NVD	Oct 22 19:17 UTC
CVE-2026-115378Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious incus-agent to... Executive summary A flaw in the Incus command-line tool lets a compromised virtual machine write arbitrary files onto the machine running the Incus CLI when an operator performs a recursive file pull from that VM. The advisory rates it Moderate with a CVSS 3.1 base score of 5.8, and the fix is to upgrade to Incus version 7.5.0 or later, since the affected versions are listed as less than v7.5.0. Technical summary This is a link-following weakness (CWE-59) in sftpRecursivePullFile in the incus file pull -r code path. A malicious incus-agent inside a guest VM can return the same directory entry twice, first as a symlink and then as a directory or regular file, causing the client to write through the symlink outside the target directory. The attacker needs root inside the VM, and the operator must run a recursive pull from that VM, which is the required user interaction; the CVSS vector is AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N. Affected versions are stated as Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0, and the Go module advisory lists affected versions as less than v7.5.0 with patched versions at v7.5.0 or later. Containers are stated as not affected. The advisory's only workaround is to avoid incus file pull -r from untrusted VMs or to run it as an unprivileged user into a dedicated directory. No detection guidance is stated, and no CVE ID is assigned in the advisory text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/lxc/incus/security/advisories/GHSA-wfvq-qh87-gm4j Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction Passive CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects lxc Incus lxc incus Incus incus CLI NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory
	Critical	9.4	CVE-2026-115377	Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by... lxc, Rsync, Incuslxc incus, Rsync, Incus, incusd, btrfs receive	NVD	Oct 22 19:17 UTC
CVE-2026-115377Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by... Executive summary A flaw in Incus, a system container and virtual machine manager, lets a malicious migration source or a client allowed to create instances write arbitrary files to the host as root, which can lead to full host compromise. The advisory rates it Critical with a CVSS 3.1 base score of 9.9. The fixed releases named are Incus 6.0.7, 7.0.2, and 7.5.0, depending on the branch. Technical summary The weakness is CWE-59, improper link resolution before file access, where symlinks in a migration stream are followed when Incus replays the stream with rsync or btrfs receive. Exploitation requires network-reachable access as a client allowed to create instances or custom volumes in a project, or a malicious source server the target copies or moves from, with low privileges and no user interaction. The advisory states that releases before 7.3.0 are additionally affected by a rootfs symlink surviving the transfer, which can allow host files to be read. Affected versions are listed as before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0, and the GitHub package entry lists patched versions as 7.5.0 or later. The advisory does not state workarounds beyond restricting instance creation and migration to trusted clients and servers, and it does not state detection guidance or whether the flaw is exploited in the wild. Optimized ZFS transfers are stated to be unaffected. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/lxc/incus/security/advisories/GHSA-579w-c4rw-c8q3 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects lxc Rsync Incus Btrfs lxc incus Rsync Incus incusd btrfs receive NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory
	High	8.3	CVE-2026-115376	Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type lxc, Incuslxc incus, Incus, incusd	NVD	Oct 22 19:17 UTC
CVE-2026-115376Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type Executive summary Incus, a container and virtual machine management platform, has an authorization flaw that lets a client restricted to one project copy storage volumes from other projects on the same server. The advisory rates it High, with a CVSS v3.1 base score of 7.7. The fix is to upgrade to version 7.5.0 or later. Technical summary This is an improper access control flaw (CWE-284). The source volume access check runs only when source.type is explicitly set to copy, so a crafted request to POST /1.0/storage-pools/{pool}/volumes/custom that omits source.type bypasses it and reaches the copy path with a caller-controlled source.project. The attack requires network access and low privileges, specifically permission to create custom volumes in a project, and no user interaction. The advisory says the official client always sets source.type to copy, so exploitation requires a crafted request. Affected versions are stated as 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0, with patched versions at 7.5.0 or later. No workaround is stated, and no detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/lxc/incus/security/advisories/GHSA-jh4v-j34r-2mgh Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects lxc Incus lxc incus Incus incusd NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory
	Critical	9.4	CVE-2026-115375	Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host lxc, Incuslxc incus, Incus	NVD	Oct 22 19:17 UTC
CVE-2026-115375Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host Executive summary Incus, an instance and container management system, has a path traversal flaw that lets a client who can create instances write files anywhere on the host. The advisory rates it Critical with a CVSS 3.1 base score of 9.9, and the fix is to upgrade to version 7.5.0 or later. Technical summary The flaw is a path traversal (CWE-22 and CWE-23) in instance backup import. Names of dependent custom volumes listed in a backup's index.yaml are not validated, so a traversal sequence is joined into a path and used to create root-owned directories and write attacker-controlled content on the host. An attacker needs a client role allowed to create instances in a project, with low privileges and no user interaction. The advisory states affected versions as less than v7.5.0 and patched versions as v7.5.0 or later, and lists Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 in the description. The advisory gives one workaround: allow only trusted clients to create instances. No CVE identifier is assigned in the advisory body (it reports 'No known CVE'), and whether the flaw is exploited in the wild is not stated. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/lxc/incus/security/advisories/GHSA-hpjh-q53p-f27r Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects lxc Incus lxc incus Incus NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory
	High	7.1	CVE-2026-115374	Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz-*... lxc, Incuslxc incus, Incus, incusd	NVD	Oct 22 19:17 UTC
CVE-2026-115374Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz-... Executive summary Incus, a container and virtual machine management platform, has a flaw in its built-in S3 storage server that lets someone holding a single presigned upload link read other objects in the same bucket. The advisory rates the issue High, with a CVSS v3.1 base score of 7.1, and the fix is to upgrade to version 7.5.0 or later, or to avoid handing out presigned URLs for sensitive buckets. Technical summary The flaw is an improper verification of cryptographic signatures (CWE-347) in the in-process S3 server used for storage buckets on local storage pools. SigV4 checks cover only the headers the client lists as signed, so unsigned x-amz- headers such as X-Amz-Copy-Source are accepted and can turn a write grant into a copy that reads another object in the bucket. The attack needs only a presigned URL for one object, with no bucket credentials, and the vector is network-based with low privileges required. The advisory states affected versions as Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0, with patched version v7.5.0 or later for the Go package. Ceph radosgw buckets are not affected, and the bucket listener is disabled by default. The advisory gives the workaround of not issuing presigned URLs for buckets holding sensitive objects or keeping the listener disabled. No detection guidance and no exploitation-in-the-wild information are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/lxc/incus/security/advisories/GHSA-mmj7-8rgf-mx2h Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects lxc Incus lxc incus Incus incusd NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory
	High	7.0	CVE-2026-115373	Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients... lxc, Incuslxc incus, Incus, incusd	NVD	Oct 22 19:17 UTC
CVE-2026-115373Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients... Executive summary The advisory says that Incus, a container and virtual machine manager, lets a client with a certificate restricted to one project read details of running operations in other projects, including command lines, environment variables and websocket secrets. The attacker must already know the operation's UUID, and the advisory rates the issue Moderate with a CVSS 3.1 base score of 6.3 Medium. The advisory describes a fix that adds an authorization check to the operation read handler, and it does not state a fixed version number for this single flaw beyond the affected-version ranges given. Technical summary This is a missing authorization flaw (CWE-862) in the GET /1.0/operations/{uuid} handler, which performs no project-level permission check while the delete and list handlers do. The attack requires a valid enrolled client certificate and the target operation's UUID, which the advisory says must be obtained out of band, and no victim interaction is needed after that. The advisory states affected versions as before 6.0.7, 6.1.0 through 7.0.2, and 7.1.0 through 7.5.0, with the patched version given as v7.5.0 and the package github.com/lxc/incus/v7/cmd/incusd. The advisory does not state a specific workaround, and it does not state any detection guidance or any exploitation in the wild. The suggested fix adds a CanViewOperations check on the operation's project to operationGet, and the advisory notes that operationWaitGet may need the same treatment but has not been tested. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/lxc/incus/security/advisories/GHSA-mfwv-x733-9446 Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects lxc Incus lxc incus Incus incusd NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory
	Critical	9.0	CVE-2026-115372	Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copy, and move... lxc, Incuslxc incus, Incus	NVD	Oct 22 19:17 UTC
CVE-2026-115372Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copy, and move... Executive summary Incus versions from 7.3.0 before 7.5.0 contain a flaw that lets users confined to a restricted project bypass that restriction and inject arguments into a command run as root. The advisory rates it Critical with a CVSS base score of 9.9. The vendor's fix is to upgrade to version 7.5.0 or later, and the advisory's listed workaround is to stop granting custom volume creation to restricted projects on pools that format on copy, or to set a pool default for volume.block.create_options. Technical summary This is an improper neutralization of argument delimiters (CWE-88, argument injection) flaw in the volume update, copy, and move paths. A restricted project user who can create or edit custom volumes can set block.create_options on a volume and then trigger a copy or move onto a pool that formats new volumes, causing the value to be appended to a mkfs command run as root. The advisory says only pools that format on copy, such as non-thin LVM, reach the mkfs call; on other drivers the forbidden option still lands on the volume. Affected versions are >= v7.3.0 and < v7.5.0, and the patched version is >= v7.5.0. The advisory does not state a CVE assignment (it says No known CVE), and it does not state detection guidance or whether the flaw is exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/lxc/incus/security/advisories/GHSA-4cph-ccqv-hm3c Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects lxc Incus lxc incus Incus NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory
	High	7.1	CVE-2026-115371	Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket... lxc, Incuslxc incus, Incus, incusd	NVD	Oct 22 19:17 UTC
CVE-2026-115371Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket... Executive summary A flaw in Incus, a container and virtual machine management system, lets a client with a restricted TLS certificate read the access and secret keys for storage buckets in the default project. The advisory rates it High with a CVSS score of 8.5, and the fix is to upgrade to a patched version or move affected buckets out of the default project. Technical summary The flaw is an improper authorization issue, classified as CWE-522 (insufficiently protected credentials). The bucket key endpoints under /1.0/storage-pools/{pool}/buckets/{bucket}/keys only required can_view permission, and the TLS authorizer grants restricted client certificates read-only access to buckets in the default project, which exposes S3 access and secret keys. Affected versions are stated as 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0, with the GHSA advisory giving Go package affected versions as less than v7.5.0 and patched versions as v7.5.0 or later. The attack requires a restricted TLS client certificate scoped to any project, and only the TLS authorizer is affected, not OpenFGA deployments. The fix requires can_edit on the bucket for key retrieval, and the advisory gives the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N with a score of 8.5. The workaround is to avoid keeping buckets in the default project on servers issuing restricted certificates, or to rotate the keys of any bucket a restricted client may have read. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/lxc/incus/security/advisories/GHSA-x8gj-2q73-qr6j Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects lxc Incus lxc incus Incus incusd NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory
	Medium	5.3	CVE-2026-115370	Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode... lxc, Incuslxc incus, Incus	NVD	Oct 22 19:17 UTC
CVE-2026-115370Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode... Executive summary A flaw in Incus, a container and virtual machine manager, lets a user in a restricted project on a clustered server make the server open outbound connections to a URL of their choosing. The advisory rates the severity as Moderate, with a CVSS score of 4.3, and the fix is to upgrade to a patched version (v7.5.0 or later for the affected 7.x line). Standalone servers are not affected. Technical summary This is an authorization bypass (CWE-863) combined with server-side request forgery (CWE-918). When a migration request with refresh set targets an instance that already exists locally on a clustered server, the request skips the instance creation check that normally blocks pull mode migration in restricted projects. An attacker with instance creation rights in a restricted project can then have the server open an outbound TLS websocket connection to a URL and certificate they supply, which can be used to probe reachable services. The advisory lists affected versions as 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0, and the patched version as 7.5.0 or later for the Go package github.com/lxc/incus/v7/cmd/incusd. The advisory states that the attack needs low privileges and no user interaction, and that the refresh does not give a configuration bypass. Workaround: do not grant instance creation in restricted projects on clustered servers to users who should not initiate outbound connections. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/lxc/incus/security/advisories/GHSA-443p-7392-h4v2 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects lxc Incus lxc incus Incus NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects