Start for Free
go

github.com/lxc/incus

View on go registry
36 Total advisories
36 Vulnerabilities
0 Malware

Dependency scanning

Check whether github.com/lxc/incus is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

Explore dependency scanning Explore AI SAST →

Vulnerabilities

HIGH 7.7
Go

CVE-2026-55622

Incus has a project restriction bypass in instance copy across projects
UNKNOWN
Go

CVE-2026-55622

Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus
HIGH 7.7
Go

CVE-2026-55621

Incus has a project restriction bypass for custom volume copy across projects
UNKNOWN
Go

CVE-2026-55621

Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-48769

Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-48756

Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-48753

Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-48752

Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-48754

Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-48755

Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-48750

Incus has an arbitrary file write on host via `exec-output` symlink in crafted image in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-48749

Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-48751

Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-41684

Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-40197

Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-41647

Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-41685

Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-40195

Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-40243

Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-47753

Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-35527

Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-40251

Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-41648

Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus
CRITICAL 9.9
Go

CVE-2026-33897

Incus vulnerable to arbitrary file read and write through pongo templates
MEDIUM 6.5
Go

CVE-2026-33743

Incus vulnerable to denial of source through crafted bucket backup file
UNKNOWN
Go

CVE-2026-33945

Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-33897

Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-33711

Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-33898

Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-33743

Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-33542

Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus
UNKNOWN
Go

CVE-2025-64507

Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus
UNKNOWN
Go

CVE-2025-52889

Incus Allocation of Resources Without Limits allows firewall rule bypass on managed bridge networks in github.com/lxc/incus
UNKNOWN
Go

CVE-2025-52890

Incus creates nftables rules that partially bypass security options in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-23954

Incus container image templating arbitrary host file read and write in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-23953

Incus container environment configuration newline injection in github.com/lxc/incus

Browse more Go advisories

Learn What is SAST?

Static Application Security Testing finds vulnerabilities like this one in source code before it ships. Read the guide →

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes