CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

13307 matches found

ATTACKERKB•added 2026/04/09 9:15 a.m.•5 views

CVE-2026-34177

Canonical LXD versions 4.12 through 6.7 contain an incomplete denylist in isVMLowLevelOptionForbidden lxd/project/limits/permissions.go, which omits raw.apparmor and raw.qemu.conf from the set of keys blocked under the restricted.virtual-machines.lowlevel=block project restriction. A remote...

9.1CVSS6AI score0.00363EPSS

SaveExploits0References3Affected Software1

Vulnrichment•added 2026/04/09 9:15 a.m.•3 views

CVE-2026-34177 VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf

9.1CVSS6AI score0.00363EPSS

SaveExploits0References2

Cvelist•added 2026/04/09 9:15 a.m.•26 views

CVE-2026-34177 VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf

9.1CVSS0.00363EPSS

SaveExploits0References2

OSV•added 2026/04/09 9:15 a.m.•4 views

CVE-2026-34177 VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf

9.1CVSS7.3AI score0.00363EPSS

SaveExploits0References6

Positive Technologies•added 2026/04/09 12:0 a.m.•6 views

PT-2026-31595

Name of the Vulnerable Software and Affected Versions Canonical LXD versions 4.12 through 6.7 Description Canonical LXD versions 4.12 through 6.7 contain an incomplete denylist in the isVMLowLevelOptionForbidden function lxd/project/limits/permissions.go. This denylist omits raw.apparmor and...

9.1CVSS5.8AI score0.00363EPSS

SaveExploits0References20

Tenable Nessus•added 2026/04/08 12:0 a.m.•3 views

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-006676)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006676 advisory. In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Don't dereference ACPI root object handle Since the commit referenced in the...

5.5CVSS6.4AI score0.00184EPSS

SaveExploits0References4

Github Security Blog•added 2026/03/27 5:9 p.m.•8 views

Incus vulnerable to local privilege escalation through VM screenshot path

Summary Incus provides an API to retrieve VM screenshots, that API relies on the use of a temporary file for QEMU to write the screenshot to which is then picked up and sent to the user prior to deletion. As Incus uses predictable paths under /tmp for this, an attacker with local access to the...

7.8CVSS5.8AI score0.0035EPSS

SaveExploits1References5Affected Software1

Github Security Blog•added 2026/03/26 7:49 p.m.•11 views

Contrast BadAML injection allows arbitrary code execution

BadAML BadAML is an AML injection attack that exploits the ACPI interface and allows arbitrary code execution in a confidential VM. The attack was first published in 2024: - - Impact An attacker with control over the host which is assumed in the attacker model of Contrast can execute malicious AM...

6.5AI score

SaveExploits0References4Affected Software1