| CVE-2026-63299 |
An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits
|
8.5
Élevée
|
12 août 2026 |
| CVE-2026-62420 |
An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security…
|
9.9
Critique
|
12 août 2026 |
| CVE-2026-63300 |
An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an…
|
9.9
Critique
|
12 août 2026 |
| CVE-2026-28385 |
In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import…
|
5.0
Moyenne
|
26 juin 2026 |
| CVE-2026-9640 |
A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7…
|
7.2
Élevée
|
26 juin 2026 |
| CVE-2026-9639 |
Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an…
|
6.5
Moyenne
|
26 juin 2026 |
| CVE-2026-12411 |
Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount,…
|
8.4
Élevée
|
26 juin 2026 |
| CVE-2026-34179 |
In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate…
|
9.1
Critique
|
9 avr. 2026 |
| CVE-2026-34178 |
In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the…
|
9.1
Critique
|
9 avr. 2026 |
| CVE-2026-34177 |
Canonical LXD versions 4.12 through 6.7 contain an incomplete denylist in isVMLowLevelOptionForbidden…
|
9.1
Critique
|
9 avr. 2026 |
| CVE-2026-28384 |
An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged…
|
9.4
Critique
|
12 mars 2026 |
| CVE-2026-3351 |
Improper authorization in the API endpoint GET /1.0/certificates in Canonical LXD 6.6 on Linux allows an…
|
2.1
Faible
|
3 mars 2026 |
| CVE-2025-54293 |
Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote…
|
7.1
Élevée
|
2 oct. 2025 |
| CVE-2025-54292 |
Path traversal in Canonical LXD LXD-UI versions before 6.5 and 5.21.4 on all platforms allows remote authenticated…
|
4.8
Moyenne
|
2 oct. 2025 |
| CVE-2025-54291 |
Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated…
|
6.9
Moyenne
|
2 oct. 2025 |
| CVE-2025-54290 |
Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to…
|
6.9
Moyenne
|
2 oct. 2025 |
| CVE-2025-54289 |
Privilege Escalation in operations API in Canonical…
|
7.4
Élevée
|
2 oct. 2025 |
| CVE-2025-54288 |
Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows…
|
5.1
Moyenne
|
2 oct. 2025 |
| CVE-2025-54287 |
Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance…
|
7.1
Élevée
|
2 oct. 2025 |
| CVE-2025-54286 |
Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and…
|
7.5
Élevée
|
2 oct. 2025 |
| CVE-2024-6156 |
Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was…
|
3.8
Faible
|
5 déc. 2024 |
| CVE-2023-49721 |
An insecure default to allow UEFI Shell in EDK2 was left enabled in LXD
|
6.7
Moyenne
|
14 févr. 2024 |