CVE-2026-85185 Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root

Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is...

CVE-2026-85185

Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8, and 6.10) on Linux are vulnerable to a path traversal flaw in the btrfs storage driver . An authenticated client with instance creation permissions can use crafted subvolume paths containing ../ sequences to delete arbitrary...

CVE-2026-85185 Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root

Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is...

EUVD-2026-88258

Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is...

CVE-2026-85526

A path traversal vulnerability exists in the Btrfs storage driver (specifically the unpackVolume function) within Canonical LXD on Linux. An authenticated user with instance creation privileges can manipulate the host filesystem as root by providing a crafted subvolumes[].path entry in backup/opt...

CVE-2026-85526

Path traversal in the Btrfs storage driver unpackVolume in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes.path entry in backup/optimizedheader.yaml...

EUVD-2026-88257

Path traversal in the Btrfs storage driver unpackVolume in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes.path entry in backup/optimizedheader.yaml...

Security Bulletin: IBM Storage Protect Server is vulnerable to unauthenticated attacker with network access via multiple protocols and TLS due to IBM SDK, Java (CVE-2025-50106, CVE-2025-30749, CVE-2025-30761, CVE-2025-30754)

Summary IBM SDK, Java is vulnerable to unauthenticated attacker with network access via multiple protocols and TLS, IBM Storage Protect Server uses IBM SDK, Java and may be affected by this vulnerability. Vulnerability Details CVEID:CVE-2025-50106 DESCRIPTION: Vulnerability in the Oracle Java SE,...

EUVD-2026-88048

A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is the function Storage::download of the file packages/Webkul/Admin/src/Config/acl.php of the component attachment-download Endpoint. The manipulation of the argument ID leads to improper control of resource...

CVE-2026-97335: Incorrect Authorization

Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later fixed in 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated client with permission to create custom volumes in a project to copy, and so read, any custom storage volume from any...

PT-2026-99911

Name of the Vulnerable Software and Affected Versions Dell Boot Optimized Server Storage BOSS versions prior to 2.2.13.2038 Description The SMCU on 17G BOSS-N1 controllers contains an On-Chip Debug and Test Interface with improper access control. An unauthenticated attacker with physical access t...

PT-2026-99901

Dell Boot Optimized Server Storage BOSS, versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability,...

PT-2026-99902

Dell Boot Optimized Server Storage BOSS, versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability,...

PT-2026-99899

Name of the Vulnerable Software and Affected Versions Canonical LXD versions 5.0.0 through 5.0.9 Canonical LXD versions 5.1.0 through 5.21.7 Canonical LXD versions 6.0.0 through 6.9.9 Description Incorrect authorization in the custom storage volume creation endpoint allows an authenticated client...

CVE-2026-80358: On-Chip Debug and Test Interface With Improper Access Control

Dell Boot Optimized Server Storage BOSS, versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability,...

The vulnerability of the CreateInstanceFromBackup() function in the `internal/server/storage/backend.go` file of the container management system and the virtual machine manager Incus allows a attacker to trigger a service failure.

The vulnerability of the CreateInstanceFromBackup function in the internal/server/storage/backend.go file of the container management system and the virtual machine manager Incus is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause service interruptio...

CVE-2026-80357: On-Chip Debug and Test Interface With Improper Access Control

Dell Boot Optimized Server Storage BOSS, versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability,...

PT-2026-99890

Name of the Vulnerable Software and Affected Versions Canonical LXD affected versions not specified Description A path traversal issue exists in the Btrfs storage driver within the unpackVolume function. An authenticated user with instance creation privileges can delete or replace arbitrary files...

The vulnerability of the CreateCustomVolumeFromBackup() function in the `internal/server/storage/backend.go` file of the container management system and the virtual machine manager Incus allows a attacker to trigger a service failure.

The vulnerability of the CreateCustomVolumeFromBackup function in the internal/server/storage/backend.go file of the container management system and the virtual machine manager software Incus is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a...

The vulnerability of the MinIO object storage server, related to the unlimited distribution of resources, allows a attacker to cause a service failure.

The vulnerability of the MinIO object storage server is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a remote attacker to cause service failures...