Linuxcontainers Incus vulnerabilities

• linuxcontainers incus Incus: Unbounded binary import disk exhaustion CVE-2026-41685 Fix available 4.3 MediumMay 4, 2026
• linuxcontainers incus Incus: Nil Dereferences on Restore via Malformed YAML CVE-2026-41684 Fix available 6.5 MediumMay 4, 2026
• linuxcontainers incus Incus: Unbounded YAML Metadata Decode via Parsing CVE-2026-41648 Fix available 5.3 MediumMay 4, 2026
• linuxcontainers incus Incus: Nil-Pointer Dereference via S3 Bucket Import CVE-2026-41647 Fix available 6.5 MediumMay 4, 2026
• linuxcontainers incus Incus out-of-bounds panic in snapshot metadata handling allows denial of service CVE-2026-40251 Fix available 7.1 HighMay 4, 2026
• linuxcontainers incus Incus OVN TLS verification accepts peer-supplied roots and permits endpoint impersonation CVE-2026-40243 Fix available 2.3 LowMay 4, 2026
• linuxcontainers incus Incus nil-pointer dereference in custom volume import allows denial of service CVE-2026-40197 Fix available 7.1 HighMay 4, 2026
• linuxcontainers incus Incus nil-pointer dereference in storage bucket import allows denial of service CVE-2026-40195 Fix available 7.1 HighMay 4, 2026
• linuxcontainers incus Incus blind SSRF via image import preflight HEAD request CVE-2026-35527 Fix available 5.3 MediumMay 4, 2026
• linuxcontainers incus Abitrary file write through systemd-creds option CVE-2026-33945 Fix available 10.0 CriticalMarch 26, 2026
• linuxcontainers incus Local Incus UI web server vulnerable to nuthentication bypass CVE-2026-33898 Fix available 8.8 HighMarch 26, 2026
• linuxcontainers incus Incus vulnerable to arbitrary file read and write through pongo templates CVE-2026-33897 Fix available 10.0 CriticalMarch 26, 2026
• linuxcontainers incus Incus vulnerable to denial of source through crafted bucket backup file CVE-2026-33743 Fix available 6.5 MediumMarch 26, 2026
• linuxcontainers incus Incus vulnerable to local privilege escalation through VM screenshot path CVE-2026-33711 Fix available 4.7 MediumMarch 26, 2026
• linuxcontainers incus Incus does not verify combined fingerprint when downloading images from simplestreams servers CVE-2026-33542 Fix available 5.7 MediumMarch 26, 2026
• linuxcontainers incus Incus container image templating arbitrary host file read and write CVE-2026-23954 Fix available 8.7 HighJanuary 22, 2026
• linuxcontainers incus Incus container environment configuration newline injection CVE-2026-23953 Fix available 8.7 HighJanuary 22, 2026
• linuxcontainers incus Incus vulnerable to local privilege escalation through custom storage volumes CVE-2025-64507 Fix available 8.6 HighNovember 10, 2025