Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
58 results · page 1 of 2
Sep 28, 2026Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 and 6.10) on Linux allCVE-2026-97335 · Other software · Canonical · reported by security@ubuntu.comHigh 7.7
Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create custom volumes in a project to copy, and so read, any custom storage volume from any other project on the server, including its snapshots and configuration. The client does this with a crafted request that sets a source volume and source.project but omits source.type.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an autCVE-2026-87799 · Other software · Canonical · reported by security@ubuntu.comCritical 9.9
Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client that can create instances or custom storage volumes in a project, or a malicious migration source server, to write attacker-controlled files to arbitrary paths on the target host as root, leading to full host compromise. The attacker does this with a crafted rsync or btrfs send stream that plants a symlink in the transferred volume, such as rootfs or root.img, and then writes through it.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 (fixed in 4.0.14, 5.0.10 and 5.21.8)CVE-2026-87798 · Other software · Canonical · reported by security@ubuntu.comMedium 5.8
Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 (fixed in 4.0.14, 5.0.10 and 5.21.8) on Linux allows an attacker with root access inside a virtual machine to write attacker-controlled files or directory trees to arbitrary paths on the client host, with the operator's privileges. The attacker does this by using a modified lxd-agent that returns inconsistent SFTP directory listings and Lstat results.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images froCVE-2026-86335 · Other software · Canonical · reported by security@ubuntu.comMedium 6.3
Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allowsCVE-2026-86334 · Other software · Canonical · reported by security@ubuntu.comMedium 4.2
Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle image server to overwrite arbitrary local files and execute code on the client system via a crafted Content-Disposition header filename parameter during unified image export or copy operations into a local directory target.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or CVE-2026-85526 · Other software · Canonical · reported by security@ubuntu.comCritical 9.9
Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes[].path entry in backup/optimized_header.yaml during a btrfs optimized backup import.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticatedCVE-2026-85185 · Other software · Canonical · reported by security@ubuntu.comCritical 9.6
Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is btrfs, the client can also place attacker-controlled content at arbitrary host paths, leading to full host compromise. The client does this with a crafted subvolume path containing ../ sequences, sent in either of two ways: in the optimized_header.yaml of an optimized btrfs backup, or in the btrfs migration header sent by a malicious migration source.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2026A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, CVE-2026-66897 · Other software · Canonical · reported by security@ubuntu.comCritical 9.9
A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates the path against a confined os.Root directory handle but subsequently opens and creates the file using os.Create with an unconfined string path. This discrepancy between path resolution checks and file creation allows an attacker to escape directory confinement, overwrite root-owned host files, and achieve host root code execution.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations.CVE-2026-66898 · Other software · Canonical · reported by security@ubuntu.comCritical 9.9
A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploit this flaw by supplying a crafted backup archive with malicious instance or volume names containing path traversal sequences, potentially allowing file access or overwriting outside the designated restore directory.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation.CVE-2026-16033 · Other software · Canonical · reported by security@ubuntu.comHigh 8.5
A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory (specifically affecting virtual machine / QEMU driver execution paths). An attacker can exploit this flaw by providing a crafted image archive with malicious template directives containing path traversal sequences, causing LXD to access or write files outside the intended template directory on the host system.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker with can_create_instaCVE-2026-63300 · Other software · Canonical · reported by security@ubuntu.comCritical 9.9
An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker with can_create_instances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance between projects, LXD fails to validate the instance's configuration against the target project's enforced restrictions (such as restricted.containers.lowlevel, restricted.devices.*, and restricted.networks.access). An attacker can exploit this by creating a disallowed or high-privilege instance in an unrestricted project and subsequently moving it into the restricted project.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits.CVE-2026-63299 · Other software · Canonical · reported by security@ubuntu.comCritical 9.9
An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). An attacker can exploit these flaws to allocate storage resources that exceed the administrative limits configured for a project.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrarCVE-2026-63298 · Other software · Canonical · reported by security@ubuntu.comCritical 9.9
An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execute arbitrary code on the host system with the privileges of the LXD daemon.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restricCVE-2026-63297 · Other software · Canonical · reported by security@ubuntu.comCritical 9.9
An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction checks before configuration merging is complete, creating a time-of-check to time-of-use (TOCTOU) condition. An attacker can exploit this flaw to copy instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration.CVE-2026-63296 · Other software · Canonical · reported by security@ubuntu.comCritical 9.9
An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new configuration against the target project's enforced restrictions. An attacker can exploit this flaw to move instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions.CVE-2026-63295 · Other software · Canonical · reported by security@ubuntu.comMedium 4.3
An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges (such as enforcing restricted.containers.privilege=isolated), LXD fails to enforce the requirement if an instance configuration omits the security.idmap.isolated key. An attacker can exploit this flaw by creating or updating an instance without explicitly setting security.idmap.isolated, bypassing the target project's security constraints.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system.CVE-2026-63294 · Other software · Canonical · reported by security@ubuntu.comCritical 9.9
A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can exploit this flaw by providing a malicious archive with a symlinked backup.yaml file, causing LXD to process unconfined configuration metadata and execute arbitrary commands with root privileges.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system.CVE-2026-63293 · Other software · Canonical · reported by security@ubuntu.comCritical 9.9
A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a crafted image archive with a symlinked metadata.yaml file pointing to target file paths on the host system.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migraCVE-2026-62420 · Other software · Canonical · reported by security@ubuntu.comCritical 9.9
An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/{name} with migration: true, project: <target>, and target: <member>, the destination node skips all project restriction checks because the request arrives as an internal cluster notification. An attacker can exploit this to introduce disallowed instance configurations into a restricted project.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users withCVE-2026-28385 · Other software · Canonical · reported by security@ubuntu.comMedium 5
In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the can_create_images entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a URL source, the LXD daemon fails to validate or restrict outbound destination IP addresses, allowing connections to loopback, RFC1918 private ranges, and cloud metadata endpoints. This enables error-based port scanning and unauthorized interaction with internal HTTP services from the daemon's network position.
- Product
- lxd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restrictiCVE-2026-9640 · Other software · Canonical · reported by security@ubuntu.comHigh 7.2
A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy restrictions by importing a maliciously crafted instance backup containing restricted configuration keys within a snapshot. When the snapshot is restored, these restricted keys are applied to the live instance without policy validation. Starting the modified instance grants the operator unauthorized host root access.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes CVE-2026-9639 · Other software · Canonical · reported by security@ubuntu.comMedium 6.5
Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service via a specially crafted custom-volume backup tarball that omits the expires_at snapshot field.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custoCVE-2026-12411 · Other software · Canonical · reported by security@ubuntu.comHigh 8.4
Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.
- Product
- lxd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2026An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes().CVE-2026-50262 · Other software · Red Hat · reported by Red HatMedium 5.5
An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size validation check can read a client-controlled number of bytes, exceeding the request buffer, leading to information disclosure. A write path also exists but requires byte-swapped clients which is disabled by default.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Apr 9, 2026In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH reqCVE-2026-34179 · Other software · Canonical · reported by security@ubuntu.comCritical 9.1
In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH requests to /1.0/certificates/{fingerprint} for restricted TLS certificate users, allowing a remote authenticated attacker to escalate privileges to cluster admin.
- Product
- lxd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the supplied tar archive but creates the instancCVE-2026-34178 · Other software · Canonical · reported by security@ubuntu.comCritical 9.1
In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the supplied tar archive but creates the instance from backup/container/backup.yaml, a separate file in the same archive that is never checked against project restrictions. An authenticated remote attacker with instance-creation permission in a restricted project can craft a backup archive where backup.yaml carries restricted settings such as security.privileged=true or raw.lxc directives, bypassing all project restriction enforcement and allowing full host compromise.
- Product
- lxd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026Canonical LXD versions 4.12 through 6.7 contain an incomplete denylist in isVMLowLevelOptionForbidden (lxd/project/limits/permissions.go), which omits raw.apparCVE-2026-34177 · Other software · Canonical · reported by security@ubuntu.comCritical 9.1
Canonical LXD versions 4.12 through 6.7 contain an incomplete denylist in isVMLowLevelOptionForbidden (lxd/project/limits/permissions.go), which omits raw.apparmor and raw.qemu.conf from the set of keys blocked under the restricted.virtual-machines.lowlevel=block project restriction. A remote attacker with can_edit permission on a VM instance in a restricted project can inject an AppArmor rule and a QEMU chardev configuration that bridges the LXD Unix socket into the guest VM, enabling privilege escalation to LXD cluster administrator and subsequently to host root.
- Product
- lxd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemoCVE-2026-28384 · Other software · Canonical · reported by security@ubuntu.comCritical 9.4
An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the snap versions 5.0.6-e49d9f4 (channel 5.0/stable), 5.21.4-1374f39 (channel 5.21/stable), and 6.7-1f11451 (channel 6.0 stable). The channel 4.0/stable is not affected as it contains version 4.0.10.
- Product
- lxd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscourse.ubuntu.comgithub.com
Mar 3, 2026Improper authorization in the API endpoint GET /1.0/certificates in Canonical LXD 6.6 on Linux allows an authenticated, restricted user to enumerate all certifiCVE-2026-3351 · Other software · Canonical · reported by security@ubuntu.comLow 2.1
Improper authorization in the API endpoint GET /1.0/certificates in Canonical LXD 6.6 on Linux allows an authenticated, restricted user to enumerate all certificate fingerprints trusted by the lxd server.
- Product
- lxd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host syCVE-2025-54293 · Other software · Canonical · reported by security@ubuntu.comHigh 7.1
Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host system via crafted log file names or symbolic links.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025Path traversal in Canonical LXD LXD-UI versions before 6.5 and 5.21.4 on all platforms allows remote authenticated attackers to access or modify unintended resoCVE-2025-54292 · Other software · Canonical · reported by security@ubuntu.comMedium 4.8
Path traversal in Canonical LXD LXD-UI versions before 6.5 and 5.21.4 on all platforms allows remote authenticated attackers to access or modify unintended resources via crafted resource names embedded in URL paths.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existeCVE-2025-54291 · Other software · Canonical · reported by security@ubuntu.comMedium 6.9
Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without autheCVE-2025-54290 · Other software · Canonical · reported by security@ubuntu.comMedium 6.9
Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions CVE-2025-54289 · Other software · Canonical · reported by security@ubuntu.comHigh 7.4
Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attackers with root privileges within any contCVE-2025-54288 · Other software · Canonical · reported by security@ubuntu.comMedium 5.1
Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attackers with root privileges within any container to impersonate other containers and obtain their metadata, configuration, and device information via spoofed process names in the command line.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration permissions to read arbitraCVE-2025-54287 · Other software · Canonical · reported by security@ubuntu.comHigh 7.1
Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration permissions to read arbitrary files on the host system via specially crafted snapshot pattern templates using the Pongo2 template engine.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and start container instances without user coCVE-2025-54286 · Other software · Canonical · reported by security@ubuntu.comHigh 7.5
Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and start container instances without user consent via crafted HTML form submissions exploiting client certificate authentication.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2024Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoureCVE-2024-6219 · Other software · Canonical Ltd. · reported by security@ubuntu.comLow 3.8
Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2024Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store.CVE-2024-6156 · Other software · Canonical Ltd. · reported by security@ubuntu.comLow 3.8
Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2024Mesa v23.0.4 was discovered to contain a NULL pointer dereference via the function dri2GetGlxDrawableFromXDrawableId().CVE-2023-45913 · Other software · Mesa3d · reported by MITREMedium 6.2
Mesa v23.0.4 was discovered to contain a NULL pointer dereference via the function dri2GetGlxDrawableFromXDrawableId(). This vulnerability is triggered when the X11 server sends an DRI2_BufferSwapComplete event unexpectedly when the application is using DRI3. NOTE: this is disputed because there is no scenario in which the vulnerability was demonstrated.
- Product
- Mesa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orggitlab.freedesktop.org
Feb 14, 2024An insecure default to allow UEFI Shell in EDK2 was left enabled in LXD.CVE-2023-49721 · Other software · Canonical Ltd. · reported by security@ubuntu.comMedium 6.7
An insecure default to allow UEFI Shell in EDK2 was left enabled in LXD. This allows an OS-resident attacker to bypass Secure Boot.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netbugs.launchpad.net
Dec 11, 2023A feature in LXD (LP#1829071), affects the default configuration of Ubuntu Server which allows privileged users in the lxd group to escalate their privilege to CVE-2023-5536 · Other software · Canonical · reported by security@ubuntu.comMedium 5
A feature in LXD (LP#1829071), affects the default configuration of Ubuntu Server which allows privileged users in the lxd group to escalate their privilege to root without requiring a sudo password.
- Product
- Ubuntu Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netcve.mitre.org
Sep 2, 2021A Hardcoded JWT Secret Key in metadata.py in AdaptiveScale LXDUI through 2.1.3 allows attackers to gain admin access to the host system.CVE-2021-40494 · Other software · Adaptivescale · reported by MITRECritical 9.8
A Hardcoded JWT Secret Key in metadata.py in AdaptiveScale LXDUI through 2.1.3 allows attackers to gain admin access to the host system.
- Product
- Lxdui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2019LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function.CVE-2015-1340 · Other software · Ubuntu · reported by security@ubuntu.comHigh 7
LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2017LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connections.CVE-2015-8308 · Other software · Lxdm Project · reported by Red HatHigh 7.8
LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connections.
- Product
- Lxdm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugzilla.redhat.com
Apr 12, 2017OpenStack Nova-LXD before 13.1.1 uses the wrong name for the veth pairs when applying Neutron security group rules for instances, which allows remote attackers CVE-2017-5936 · Other software · Canonical · reported by MITREHigh 7.5
OpenStack Nova-LXD before 13.1.1 uses the wrong name for the veth pairs when applying Neutron security group rules for instances, which allows remote attackers to bypass intended security restrictions.
- Product
- Ubuntu Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Jan 27, 2017Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers toCVE-2016-9636 · Other software · Gstreamer · reported by MITRECritical 9.8
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by providing a 'write count' that goes beyond the initialized buffer.
- Product
- Gstreamer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrhn.redhat.comrhn.redhat.com
Jan 27, 2017Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers toCVE-2016-9635 · Other software · Gstreamer · reported by MITRECritical 9.8
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by providing a 'skip count' that goes beyond initialized buffer.
- Product
- Gstreamer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrhn.redhat.comrhn.redhat.com
Jan 27, 2017Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers toCVE-2016-9634 · Other software · Gstreamer · reported by MITRECritical 9.8
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via the start_line parameter.
- Product
- Gstreamer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrhn.redhat.comrhn.redhat.com
Jan 13, 2017The gst_decode_chain_free_internal function in the flxdex decoder in gst-plugins-good in GStreamer before 1.10.2 allows remote attackers to cause a denial of seCVE-2016-9810 · Other software · Gstreamer · reported by MITREMedium 5.5
The gst_decode_chain_free_internal function in the flxdex decoder in gst-plugins-good in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (invalid memory read and crash) via an invalid file, which triggers an incorrect unref call.
- Product
- Gstreamer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.