CVE Tools
Track your stack

Incus

48 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Incus, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Incus CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Incus CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-062
2025-070
2025-080
2025-090
2025-100
2025-111
2025-120
2026-012
2026-020
2026-036
2026-041
2026-059
2026-060
2026-070
2026-0818
2026-090
2026-109
2026-110

Severity

How the 48 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical1738%
  • High1227%
  • Medium1533%
  • Low12%

Latest CVEs

The 15 most recently published vulnerabilities affecting Incus.

  1. CVE-2026-115378Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pull5.8
  2. CVE-2026-115377Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Stream9.9
  3. CVE-2026-115376Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 Project Restriction Bypass via Custom Volume Copy7.7
  4. CVE-2026-115375Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes9.9
  5. CVE-2026-115373Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid}6.3
  6. CVE-2026-115374Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Unsigned Header Bypass in Presigned S3 Upload URLs7.1
  7. CVE-2026-115372Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options8.5
  8. CVE-2026-115370Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refresh4.3
  9. CVE-2026-115371LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential Disclosure via Storage Bucket Keys Endpoints7.1
  10. CVE-2026-63343Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root9.9
  11. CVE-2026-63125Incus vulnerable to root RCE via image backup.yaml symlink9.9
  12. CVE-2026-62941Incus: Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge9.9
  13. CVE-2026-62940Incus has a project restriction bypass via instance migration config override9.9
  14. CVE-2026-62867Incus has an argument injection in storage volume block.create_options that leads to arbitrary command execution9.9
  15. CVE-2026-62313Incus: Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated`4.3

Product grouping is registry-driven, with AI assist and human review. How it works