CVE Tools
Track your stack

Lxd

52 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Lxd, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Lxd CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Lxd CVEs per month
MonthCVEs
2024-122
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-108
2025-110
2025-120
2026-010
2026-020
2026-032
2026-043
2026-050
2026-064
2026-070
2026-0820
2026-097
2026-101
2026-110

Severity

How the 52 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical2346%
  • High918%
  • Medium1632%
  • Low24%

Latest CVEs

The 15 most recently published vulnerabilities affecting Lxd.

  1. CVE-2026-112816Improper certificate validation in the HTTPS listener in LXD—
  2. CVE-2026-87798LXD client recursive file pull allows directory escape via malicious VM agent5.8
  3. CVE-2026-87799Arbitrary file write on LXD host via symlink in migration stream9.9
  4. CVE-2026-97335Incorrect authorization in LXD storage volume API allows reading volumes from other projects7.7
  5. CVE-2026-85185Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root9.6
  6. CVE-2026-85526Path traversal via Btrfs optimized-backup subvolumes[].path enables root file/dir manipulation in LXD9.9
  7. CVE-2026-86335LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse6.3
  8. CVE-2026-86334CLI Path Traversal via Content-Disposition in LXD Image Export/Copy4.2
  9. CVE-2026-66897Instance template path traversal allows arbitrary host file write as root9.9
  10. CVE-2026-55622Incus has a project restriction bypass in instance copy across projects7.7
  11. CVE-2026-55621Incus has a project restriction bypass for custom volume copy across projects7.7
  12. CVE-2026-48769Incus has an arbitrary file write on its client due to trusted image hash9.9
  13. CVE-2026-48755Incus has an argument injection in backup compression algorithm leading to AFW and ACE9.9
  14. CVE-2026-48752Incus has arbitrary file read+write on host via templates/ symlink in malicious image9.9
  15. CVE-2026-48751Incus has a restricted project bypass leading to arbitrary command execution9.9

Product grouping is registry-driven, with AI assist and human review. How it works