MEDIUM6.5Go
GHSA-4m88-wxj4-9qj6· CVE-2026-40251, GO-2026-5127Incus Vulnerable to Panic via Snapshot Bounds Check
Modified: 6/25/2026
package
Go/github.com/lxc/incus/v6/cmd/incusd
pkg:go/github.com/lxc/incus/v6/cmd/incusd
MEDIUM5.0Go
GHSA-67wx-r9xr-x75x· CVE-2026-41648, GO-2026-5168Incus has Unbounded YAML Metadata Decode via Parsing
Modified: 6/25/2026
HIGH8.7Go
GHSA-7f67-crqm-jgh7· CVE-2026-23954, GO-2026-4357Incus container image templating arbitrary host file read and write
Modified: 3/27/2026
MEDIUM4.3Go
GHSA-8gw4-p4wq-4hcv· CVE-2026-35527, GO-2026-5254Incus has Blind SSRF via Image Import Preflight HEAD
Modified: 6/25/2026
MEDIUM4.3Go
GHSA-98vh-x9cx-9cfp· CVE-2026-41685, GO-2026-5280Incus is affected by unbounded binary import disk exhaustion
Modified: 6/25/2026
LOW2.3Go
GHSA-c839-4qxr-j4x3· CVE-2026-40243, GO-2026-5319Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots
Modified: 6/25/2026
MEDIUM6.5Go
GHSA-fwj8-62r8-8p8m· CVE-2026-41647, GO-2026-5384Incus has Nil-Pointer Dereference via S3 Bucket Import
Modified: 6/25/2026
MEDIUM6.5Go
GHSA-gc7j-g665-rxr9· CVE-2026-40195, GO-2026-5397Incus has a Nil-Pointer Dereference Panic via Bucket Metadata
Modified: 6/25/2026
MEDIUM6.5Go
GHSA-r7w7-mmxr-47r9· CVE-2026-40197, GO-2026-5612Incus has a Nil-Pointer Dereference via Custom Volume Import
Modified: 6/25/2026
MEDIUM6.5Go
GHSA-x5r6-jr56-89pv· CVE-2026-41684, GO-2026-5742Incus has Nil Dereferences on Restore via Malformed YAML
Modified: 6/25/2026