CVE-2026-48751

Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore the restricted.containers.lowlevel=block setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as raw.lxc and raw.qemu. Version 7.2.0 patches t...

CVE-2026-48752

Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 patches the issue...

EUVD-2026-63991

Paperclip before 0.3.1 in default localtrusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses DNS rebinding to make authenticated A...

CVE-2026-77087

Paperclip before 0.3.1 running in its default local_trusted mode fails to validate Host headers , enabling DNS rebinding attacks. An attacker can craft a malicious webpage that, when visited by a developer with Paperclip running locally, makes authenticated API requests and executes arbitrary com...

EUVD-2026-63987

Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided block.createoptions in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject...

CVE-2026-62867 Incus has an argument injection in storage volume block.create_options that leads to arbitrary command execution

Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided block.createoptions in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject...

CVE-2026-62867 Incus has an argument injection in storage volume block.create_options that leads to arbitrary command execution

Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided block.createoptions in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject...

CVE-2026-48769 Incus has an arbitrary file write on its client due to trusted image hash

Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches th...

CVE-2026-48769

CVE-2026-48769 is a critical (CVSS 9.9) arbitrary file write vulnerability in Incus , a system container and virtual machine manager, affecting versions prior to 7.2.0 . The root cause is that the Incus client trusts a crafted Incus-Image-Hash header returned by a malicious image server, leading ...

EUVD-2026-63983

Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches th...

CVE-2026-48769 Incus has an arbitrary file write on its client due to trusted image hash

Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches th...

EUVD-2026-63982

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command...

CVE-2026-48755 Incus has an argument injection in backup compression algorithm leading to AFW and ACE

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command...

CVE-2026-48755

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command...

CVE-2026-48755

Incus , a system container and virtual machine manager, is affected by an argument injection vulnerability in its backup functionality. Prior to version 7.1.0 , improper validation of the user-provided backup compression algorithm allows injection into the constructed command line, leading to arb...

EUVD-2026-63980

Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue...

CVE-2026-48753

Incus (a system container and VM manager) prior to version 7.1.0 is vulnerable to path traversal in its S3 protocol multipart upload endpoint. The root cause is an unsanitized user-controlled uploadId parameter in internal/server/storage/s3/local/multipart.go, which allows an attacker to write ar...

CVE-2026-48753

Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue...

CVE-2026-48753 Incus has an arbitrary file write via path traversal in S3 multipart upload

Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue...

CVE-2026-48753 Incus has an arbitrary file write via path traversal in S3 multipart upload

Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue...