agentprime: canonical-lxdEvery new CVE for canonical-lxd.https://agentprime.io/CVE-2026-112816: Improper certificate validation in the HTTPS listener in LXDhttps://agentprime.io/advisories/CVE-2026-112816/https://agentprime.io/advisories/CVE-2026-112816/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 16:42:06 GMTCVEcriticalCVE-2026-87798: LXD client recursive file pull allows directory escape via malicious VM agenthttps://agentprime.io/advisories/CVE-2026-87798/https://agentprime.io/advisories/CVE-2026-87798/CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 28 Sep 2026 13:22:36 GMTCVECVE-2026-87799: Arbitrary file write on LXD host via symlink in migration streamhttps://agentprime.io/advisories/CVE-2026-87799/https://agentprime.io/advisories/CVE-2026-87799/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 28 Sep 2026 13:22:29 GMTCVEcriticalCVE-2026-97335: Incorrect authorization in LXD storage volume API allows reading volumes from other projectshttps://agentprime.io/advisories/CVE-2026-97335/https://agentprime.io/advisories/CVE-2026-97335/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 28 Sep 2026 13:22:19 GMTCVECVE-2026-85185: Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as roothttps://agentprime.io/advisories/CVE-2026-85185/https://agentprime.io/advisories/CVE-2026-85185/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 28 Sep 2026 13:21:51 GMTCVEcriticalCVE-2026-85526: Path traversal via Btrfs optimized-backup subvolumes[].path enables root file/dir manipulation in LXDhttps://agentprime.io/advisories/CVE-2026-85526/https://agentprime.io/advisories/CVE-2026-85526/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 28 Sep 2026 13:21:40 GMTCVEcriticalCVE-2026-86335: LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reusehttps://agentprime.io/advisories/CVE-2026-86335/https://agentprime.io/advisories/CVE-2026-86335/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 28 Sep 2026 13:21:29 GMTCVECVE-2026-86334: CLI Path Traversal via Content-Disposition in LXD Image Export/Copyhttps://agentprime.io/advisories/CVE-2026-86334/https://agentprime.io/advisories/CVE-2026-86334/CVSS 4.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 28 Sep 2026 13:21:15 GMTCVECVE-2026-66897: Instance template path traversal allows arbitrary host file write as roothttps://agentprime.io/advisories/CVE-2026-66897/https://agentprime.io/advisories/CVE-2026-66897/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 24 Aug 2026 09:08:04 GMTCVEcriticalCVE-2026-16033: Arbitrary file read+write on host via templates/ symlink in malicious imagehttps://agentprime.io/advisories/CVE-2026-16033/https://agentprime.io/advisories/CVE-2026-16033/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 20:11:08 GMTCVECVE-2026-66898: Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCEhttps://agentprime.io/advisories/CVE-2026-66898/https://agentprime.io/advisories/CVE-2026-66898/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 20:07:32 GMTCVEcriticalCVE-2026-63293: Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as roothttps://agentprime.io/advisories/CVE-2026-63293/https://agentprime.io/advisories/CVE-2026-63293/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 20:00:09 GMTCVEcriticalCVE-2026-63294: Root RCE via image backup.yaml symlinkhttps://agentprime.io/advisories/CVE-2026-63294/https://agentprime.io/advisories/CVE-2026-63294/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 19:57:07 GMTCVEcriticalCVE-2026-63295: Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated`https://agentprime.io/advisories/CVE-2026-63295/https://agentprime.io/advisories/CVE-2026-63295/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 19:31:32 GMTCVECVE-2026-63296: Project restriction bypass via instance migration config overridehttps://agentprime.io/advisories/CVE-2026-63296/https://agentprime.io/advisories/CVE-2026-63296/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 19:27:45 GMTCVEcriticalCVE-2026-63297: Cross-project instance copy bypasses target project restrictions via TOCTOU in config mergehttps://agentprime.io/advisories/CVE-2026-63297/https://agentprime.io/advisories/CVE-2026-63297/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 19:25:24 GMTCVEcriticalCVE-2026-63298: LXD arbitrary lxc.conf directive injection via NVIDIA instance configurationhttps://agentprime.io/advisories/CVE-2026-63298/https://agentprime.io/advisories/CVE-2026-63298/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 19:22:07 GMTCVECVE-2026-63299: Storage volume cross-project move and snapshot restore bypass project disk limitshttps://agentprime.io/advisories/CVE-2026-63299/https://agentprime.io/advisories/CVE-2026-63299/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 19:17:07 GMTCVECVE-2026-62420: Cross-project cluster migration bypasses project restrictions via cluster notification flaghttps://agentprime.io/advisories/CVE-2026-62420/https://agentprime.io/advisories/CVE-2026-62420/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 19:12:28 GMTCVEcriticalCVE-2026-63300: Cross-project instance move bypasses all project restrictions allowing host command executionhttps://agentprime.io/advisories/CVE-2026-63300/https://agentprime.io/advisories/CVE-2026-63300/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 19:09:04 GMTCVEcriticalCVE-2026-9640: LXD Snapshot Import Privilege Escalation Vulnerabilityhttps://agentprime.io/advisories/CVE-2026-9640/https://agentprime.io/advisories/CVE-2026-9640/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 15:50:38 GMTCVECVE-2026-28384: Authenticated RCE via unsanitized compression_algorithmhttps://agentprime.io/advisories/CVE-2026-28384/https://agentprime.io/advisories/CVE-2026-28384/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 12 Mar 2026 14:51:29 GMTCVEcriticalCVE-2025-54292: Client-Side Path Traversal in LXD-UIhttps://agentprime.io/advisories/CVE-2025-54292/https://agentprime.io/advisories/CVE-2025-54292/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 02 Oct 2025 09:26:39 GMTCVE