### Summary

Instance snapshots ignore the `restricted.containers.lowlevel=block` setting;
allowing for arbitrary command execution on the Incus server by abusing
lowlevel hooks such as `raw.lxc` and `raw.qemu`.

##…

### Summary

An arbitrary file write exists in the Incus client when a malicious image
server returns a crafted `Incus-Image-Hash` header. This can lead to
arbitrary command execution as root on the server.

### Det…

### Summary

Improper validation of user-provided backup compression algorithm leads to
argument injection in the constructed command line. This leads to an
arbitrary file write on the host, possibly leading to arbi…

### Summary

A specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution.

### Details

Incus validates an image as soon as it sees a no…

### Summary

A specially crafted image can be used to read or create/write arbitrary
files on the host; possibly leading to arbitrary command execution.

### Details

For container images, `internal/server/storage/u…

### Summary

The `record-output` parameter of the `/instances/$name/exec` endpoint
stores the output of the command in the `exec-output` directory of the
instance. If `exec-output` is a symlink, file named `exec_UUID…

An unauthenticated attacker who controls a string passed to any Elo JavaScript-emission path — `defaultFormats.elo.parse()`, the `bin/elo` CLI, or the live browser playground at `elo-lang.org/try` — can execute arbitrary code in the host JavaScript runtime. A payload built from the …

Elo's Ruby backend emits attacker-controlled text into Ruby double-quoted strings without escaping the `#` character. Because `#` begins Ruby's interpolation sequences — `#{expr}`, `#@ivar`, `#@@cvar`, `#$gvar` — and any expression wrapped in `#{…}` may use backticks for shell exe…

An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a JUEL expression is imported and started, the expression…

kaniko before v1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to a registry host an attacker controls. A Dockerfile that references an image on a lookalike host, such as `FROM x.azurecr.io.attacker.com/img`, is enough. The build needs no `RUN` i…

A guest can mount another guest's custom storage volume over `/dev/lxd` and read or write its contents without owning it. The DevLXD storage API blocks access to volumes you don't own, but the instance device-update path that attaches a volume to a container without checks ownership. An…

A remote Telegram user can write files to arbitrary paths inside an agent's persistent workspace volume (`praktor-wk-<workspace>`, mounted at `/workspace/agent`), escaping the documented `uploads/` directory.

The attacker controls the Telegram document filename, which was concatenated i…

A buffer overflow vulnerability exists in the Brotli decompression library used by .NET. This vulnerability may allow an unauthenticated attacker to read or corrupt process memory. This could lead to information disclosure, denial of service, or elevation of privilege.

ASP.NET…

tcp: Fix potential UAF in reqsk_timer_handler().

When TCP socket migration fails at inet_ehash_insert() in
reqsk_timer_handler(), we jump to the no_ownership: label
and free the new reqsk immediately with __reqsk_free().

Thus, we…

tipc: protect node reset trace dump with node lock

The tipc_node_reset_links trace event asks tipc_node_dump() to walk the
node's link entries. Unlike the other node events that request link data,
this event runs without the node …

Loading an attacker-supplied lemma `.pt` runs arbitrary code as the loading user. Since 1.14.0 the lemmatizer stores `pos_dict` as a gzip-compressed pickle in the checkpoint's `dicts` field (a `bytes` value). `torch.load(weights_only=True)` treats `bytes` as a primitive and passes it throu…

sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs

A task can be found on a non-local DSQ while the CPU which dispatched it
is still running ops.dequeue() and hasn't cleared SCX_OPSS_DISPATCHING.
The DSQ consume…

Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn

l2cap_chan may be linked to l2cap_conn at most once. This is assumed in
several places, eg l2cap_chan_del cleanup.

There is a TOCTOU race where the invariant is v…

tracing: Hold trace_types_lock when updating modules in persistent instances

trace_module_record() walks ftrace_trace_arrays from the module notifier
without trace_types_lock. A concurrent rmdir of an instance removes it
from the …

tracing: Hold trace_types_lock when resetting last boot data from readers

update_last_data_if_empty() is called from tracing_open() with O_TRUNC,
tracing_read_pipe() and tracing_buffers_read() without trace_types_lock.
Two readers…

tracing: Reject incomplete event filter expressions

A non-empty expression normally finishes in predicate_parse()'s inner
loop, which resolves the pending logical operators before jumping to
finalization. If the input ends after a…

tracing: Save the event file instead of the compatible histogram

create_field_var_hist() creates a histogram on the matched event to
supply a field variable, and records it on the target so it can be torn
down later:

hist_data =…

tracing/histograms: Verify event_call identity when updating synth_event refcount

In event_hist_trigger_parse() and hist_unreg_all(), the histogram
registration and unregistration paths look up find_synth_event() using
trace_event…

io_uring/waitid: own the request before clearing ->head

io_waitid_remove_wq() only takes the wait queue lock if ->head is set.
io_waitid_wait() clears ->head first thing, before it tries to become the
owner of the request by bumpi…

io_uring/waitid: prevent cancel reference wrap

io_waitid packs the cancellation state into bit 31 of ->refs and uses
bits 30:0 as a 31-bit reference counter:

#define IO_WAITID_CANCEL_FLAG BIT(31)
#define IO_WAITID_REF_MASK …

### Summary

Missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the cu…

### Summary
Missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to …

`banks` parses `Tool` JSON objects from the rendered body of `{% completion %}` blocks and later resolves their
`import_path` field through `importlib.import_module(…)` + `getattr(…)` to obtain the callable that handles a tool
call. There is no allowlist or sanitization on `im…

The template `keycloak-init-config.yaml` rendered `keycloak.initi…

Elo's programmatic AST API accepts arbitrary values in many node fields without runtime type or syntax validation. Each backend's emit stage interpolates those values straight into the generated source with no escape pass. An integrator that populates the AST from JSON-deserialised inpu…

Metalama uses a local named-pipe channel to communicate between its Visual Studio processes — the Visual Studio UI process (`devenv`), the out-of-process Roslyn code-analysis process, and the CodeLens process. This channel deserialized messages from the pipe **without restricting which…

keys: Protect the type name while describing a key

keyctl_describe_key() must keep the key type's name alive until
kasprintf() has consumed it. The retained key reference keeps the key
and its description alive, but does not pin t…

coredump: hold RCU while releasing parked threads

coredump_finish() releases the parked threads by clearing ->task in
their core_thread entry and calling wake_up_process() on each of them.
It does that without holding a reference …

The console-proxy's RemoteConfigResolver parses kubeconfig data from Kubernetes Secrets using clientcmd.RESTConfigFromKubeConfig without sanitizing the resulting rest.Config. A kubeconfig containing an exec
plugin stanza (under users[].user.exec) is faithfully preserved. When rest.Tra…

When one Disclosure in an SD-JWT presentation is tampered so its digest no longer matches the Issuer-signed `_sd` array, `@sd-jwt/decode` 0.19.0 does **not** reject the presentation. It silently drops the unmatched Disclosure and returns a **reduced claim set**, reporting success. The Is…

(sibling-field variant of CVE-2026-40197 fix 05bc272)

`(*lxdBackend).CreateCustomVolumeFromBackup` in [`lxd/storage/backend_lxd.go`](https://github.com/canonical/lxd/blob/05bc272/lxd/storage/backend_lxd.go) contains an unguarded `*time.Time` dereference on the `ExpiresAt` field of every…

The IPFS Pinning Service API implementation accepts a caller-controlled CID through `POST /pins`, queues background processing, and then recursively fetches the full DAG with `helia.pins.add(cid)`. The route and background pinning path do not enforce a request rate limit, per-user quota,…

The fix for CVE-2026-47735 (released 2026.06.1) is incomplete. It added a DuckDB sandbox (`SET GLOBAL allowed_directories=[<storage root>]; SET GLOBAL enable_external_access=false`) and an Arc SQL-layer denylist of the **literal** functions `read_parquet(` and `arc_partition_agg(`. The …

ODF style attribute values are interpolated into `style="…"` attributes without HTML-escaping in **both** of odf-kit's to-HTML renderers (`odtToHtml` and `odsToHtml`). A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HT…

A SQL injection vulnerability in `GET /api/subscribers/export` allows an authenticated user with the `subscribers:sql_query` permission to bypass the table access control that exists on the regular query endpoint (`GET /api/subscribers`) and read arbitrary tables from the database — i…

This issue affects OpenText Directory Services (OTDS): from 25.1 through 26.2.

A malicious actor could leverage this vulnerabili…

This vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assi…

This issue affects OpenText Directory Services (OTDS): from 10.5 through 26.2.

You are affected if:
– You use client uploads with `@payloadcms/storage-vercel-blob`.
– Authenticated users can access the client-upload route.

Applicati…

An attacker can exploit this by crafting a link that appears legitimate but redirects users to an attacke…

Root caus…