Product

lxc github.com/lxc/incus/v6/client vulnerabilities

1 published CVE affecting lxc github.com/lxc/incus/v6/client, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total: 1
Critical: 0
High: 0
Medium: 1
Low: 0
Unscored: 0
CISA KEV: 0

Latest lxc github.com/lxc/incus/v6/client CVEs

Newest publication first

CVE-2026-33542 Incus does not verify combined fingerprint when downloading images from simplestreams servers
Published 2026-03-26

MediumCVSS 5.7 EPSS 0.19%

Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from simplestreams image servers opens the door to image cache poisoning and under very narrow circumstances exposes other tenants to r...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.

lxc github.com/lxc/incus/v6/client vulnerabilities

Latest lxc github.com/lxc/incus/v6/client CVEs

CVE-2026-33542 Incus does not verify combined fingerprint when downloading images from simplestreams servers