Start for Free
go

github.com/lxc/incus/v7

View on go registry
20 Total advisories
20 Vulnerabilities
0 Malware

Dependency scanning

Check whether github.com/lxc/incus/v7 is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

Explore dependency scanning Explore AI SAST →

Vulnerabilities

HIGH 7.7
Go

CVE-2026-55622

Incus has a project restriction bypass in instance copy across projects
UNKNOWN
Go

CVE-2026-55622

Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus
HIGH 7.7
Go

CVE-2026-55621

Incus has a project restriction bypass for custom volume copy across projects
UNKNOWN
Go

CVE-2026-55621

Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-48769

Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-48756

Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-48753

Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-48752

Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-48754

Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-48755

Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-48750

Incus has an arbitrary file write on host via `exec-output` symlink in crafted image in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-48749

Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-48751

Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-40197

Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-47753

Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted)
UNKNOWN
Go

CVE-2026-40195

Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-40243

Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-47753

Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-35527

Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus
UNKNOWN
Go

CVE-2026-40251

Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus

Browse more Go advisories

Learn What is SAST?

Static Application Security Testing finds vulnerabilities like this one in source code before it ships. Read the guide →

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes