CVE-2026-63300 Cross-project instance move bypasses all project restrictions allowing host command execution

An improper validation vulnerability in the instancePostMigration function in lxd/instancepost.go of LXD allows an authenticated attacker with cancreateinstances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance between projects, LXD fai...

CVE-2026-63300

An improper validation vulnerability in the instancePostMigration function in lxd/instancepost.go of LXD allows an authenticated attacker with cancreateinstances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance between projects, LXD fai...

CVE-2026-73298

The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-agent, AI-driven migration solution for moving container service configurations to Azure Kubernetes Service. In version 2.1.2 and earlier, a security vulnerability was identified in the...

EUVD-2026-57371

The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-agent, AI-driven migration solution for moving container service configurations to Azure Kubernetes Service. In version 2.1.2 and earlier, a security vulnerability was identified in the...

CVE-2026-73298 Microsoft Container Migration Solution Accelerator: Authenticated IDOR allowing read/write/delete processes

The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-agent, AI-driven migration solution for moving container service configurations to Azure Kubernetes Service. In version 2.1.2 and earlier, a security vulnerability was identified in the...

CVE-2026-73298

The CVE-2026-73298 entry concerns the Microsoft Container Migration Solution Accelerator (multi-service AI-driven migration tool) with vulnerability in version 2.1.2 and earlier. The issue is an authenticated IDOR (Insecure Direct Object Reference) that permits reading, writing, and deleting proc...

CVE-2026-73298 Microsoft Container Migration Solution Accelerator: Authenticated IDOR allowing read/write/delete processes

The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-agent, AI-driven migration solution for moving container service configurations to Azure Kubernetes Service. In version 2.1.2 and earlier, a security vulnerability was identified in the...

CVE-2026-73298 Microsoft Container Migration Solution Accelerator: Authenticated IDOR allowing read/write/delete processes

The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-agent, AI-driven migration solution for moving container service configurations to Azure Kubernetes Service. In version 2.1.2 and earlier, a security vulnerability was identified in the...

SUSE CVE-2026-68384

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves xebomove attaches VF CCS read/write batch buffers BBs to a BO after it transitions NULL/SYSTEM - TT, and detaches them after it transitions TT - SYSTEM. Both...

CVE-2026-11325

The CVE-2026-11325 entry concerns Cloudflare’s cloudflare/pages-action, an archived repository deprecated since 2024. A remote code execution vulnerability was reported in src/index.ts that could be reachable via certain GitHub Actions workflow configurations, potentially exposing workflow secret...

CVE-2026-11325 cloudflare/pages-action is deprecated — migration required by September 18th, 2026

Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in src/index.ts reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as...

PT-2026-71284

Name of the Vulnerable Software and Affected Versions LXD affected versions not specified Description An authorization bypass allows an authenticated attacker to circumvent target project restrictions during instance migration. The issue occurs because LXD accepts configuration overrides without...

Linux Distros Unpatched Vulnerability : CVE-2026-68384

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves xebomove attaches VF CCS...

CVE-2026-63296: Incorrect Authorization

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new configuration against the target project's...

CVE-2026-62420: Incorrect Authorization

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/name with migration: true, project: ,...

CVE-2026-73298: Authorization Bypass Through User-Controlled Key

The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-agent, AI-driven migration solution for moving container service configurations to Azure Kubernetes Service. In version 2.1.2 and earlier, a security vulnerability was identified in the...

CVE-2026-13622: Improper Limitation of a Pathname to a Restricted Directory

A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/ /root/ paths using net.Dial without symlink protection. These socket paths reside in qemu-owned directories...

PT-2026-71196

Name of the Vulnerable Software and Affected Versions Microsoft Container Migration Solution Accelerator versions prior to 2.1.3 Description An authenticated Insecure Direct Object Reference IDOR—a flaw where an application provides direct access to objects based on user-supplied input—exists in...

PT-2026-71226

Name of the Vulnerable Software and Affected Versions LXD affected versions not specified Description An improper validation issue in the instancePostMigration function within lxd/instance post.go allows an authenticated attacker with can create instances permissions on a restricted project to...

PT-2026-71326

Name of the Vulnerable Software and Affected Versions KubeVirt affected versions not specified Description A symlink following issue exists in the KubeVirt virt-handler migration proxy. During live migration, virt-handler uses net.Dial to connect to Unix sockets within the target virt-launcher po...