Approved changes feed: RSS · Atom
cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Linuxcontainers (006f7d4f-fe5b-55a6-92a3-15dcb41d3a32) |
|---|---|
| Product | Incus (f3d6bc2a-6306-58d3-87d9-93775b211d86) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-115374 |
vulnerable | 2026-11-03 10:15:37.785070 |
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Unsigned Header Bypass in Presigned S3 Upload URLs
HIGH (7.1)
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz-* headers. Attackers can add an unsigned X-Amz-Copy-Source header to a presigned upload URL to copy other bucket objects onto the granted key, disclosing their contents and ETags.
Published: 2026-10-22T19:13:43.999Z
Updated: 2026-10-23T15:01:34.195Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-115370 |
vulnerable | 2026-11-03 10:15:37.755971 |
Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refresh
MEDIUM (4.3)
Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance creation rights can send a refresh migration request for an existing instance to make the server open outbound TLS websocket connections and probe reachable services.
Published: 2026-10-22T19:13:41.181Z
Updated: 2026-10-23T15:01:52.150Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-115378 |
vulnerable | 2026-11-03 10:15:37.671955 |
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pull
MEDIUM (5.8)
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious incus-agent to escape the target directory during incus file pull -r. Attackers with root in a virtual machine can return duplicate entries reported first as symlinks then as files or directories, writing attacker-controlled files such as /etc/shadow on the operator's host.
Published: 2026-10-22T19:13:47.035Z
Updated: 2026-10-23T15:01:16.157Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-115375 |
vulnerable | 2026-11-03 10:15:37.573165 |
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes
CRITICAL (9.9)
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw stems from unvalidated dependent custom volume names in instance backup index.yaml files. Attackers can import a crafted instance backup with ../ sequences in dependent volume names to create root-owned directories with controlled content, leading to full host compromise.
Published: 2026-10-22T19:13:44.760Z
Updated: 2026-11-05T16:00:25.704Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-115371 |
vulnerable | 2026-11-03 10:15:37.540834 |
LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential Disclosure via Storage Bucket Keys Endpoints
HIGH (7.1)
Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read, modify or delete objects in those buckets.
Published: 2026-10-22T19:13:41.898Z
Updated: 2026-11-05T16:18:09.038Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-115377 |
vulnerable | 2026-11-03 10:15:37.416736 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-115373 |
vulnerable | 2026-11-03 10:15:37.391264 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-115376 |
vulnerable | 2026-11-03 10:15:37.362410 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-115372 |
vulnerable | 2026-11-03 10:15:37.324554 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41685 |
vulnerable | 2026-06-08 08:03:15.692043 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41684 |
vulnerable | 2026-06-08 08:03:15.691619 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41648 |
vulnerable | 2026-06-08 08:03:15.645150 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41647 |
vulnerable | 2026-06-08 08:03:15.644768 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40251 |
vulnerable | 2026-06-08 08:01:20.078632 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40243 |
vulnerable | 2026-06-08 08:01:20.073649 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40197 |
vulnerable | 2026-06-08 08:01:20.040314 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40195 |
vulnerable | 2026-06-08 08:01:20.038554 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-35527 |
vulnerable | 2026-06-08 07:59:14.084083 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33945 |
vulnerable | 2026-06-08 07:59:11.619668 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33898 |
vulnerable | 2026-06-08 07:59:11.582649 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33897 |
vulnerable | 2026-06-08 07:59:11.582375 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33743 |
vulnerable | 2026-06-08 07:59:10.683859 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33711 |
vulnerable | 2026-06-08 07:59:10.629145 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33542 |
vulnerable | 2026-06-08 07:59:10.357120 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23954 |
vulnerable | 2026-06-08 07:51:16.456948 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23953 |
vulnerable | 2026-06-08 07:51:16.456533 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64507 |
vulnerable | 2026-06-08 07:39:19.869616 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.