https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-41685.htmlhttps://patchthecve.com/cve/CVE-2026-41685.htmlMon, 26 Oct 2026 20:10:00 +0000MEDIUM 4.3: Incus is a system container and virtual machine manager. Prior to version 7.0.0, uploads of large amount of data by authenticated users can run the Incus server out of disk space, potentially taking down the host system. The impact here is limited for anyone using storage.images_volume and storage.bhttps://patchthecve.com/cve/CVE-2026-41684.htmlhttps://patchthecve.com/cve/CVE-2026-41684.htmlMon, 26 Oct 2026 20:10:00 +0000MEDIUM 6.5: Incus is a system container and virtual machine manager. Prior to version 7.0.0, backup.GetInfo() trusts the inline backup/index.yaml config when present and only falls back to parsing the legacy backup/container/backup.yaml file if result.Config == nil. As a result, an archive can carry a valid inlhttps://patchthecve.com/cve/CVE-2026-41648.htmlhttps://patchthecve.com/cve/CVE-2026-41648.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 5.0: Incus is a system container and virtual machine manager. Prior to version 7.0.0, user provided image and backup tarballs would be unpacked and YAML files parsed without any size restrictions. This was making it easy for an authenticated user to provide a crafted image or backup tarball that when parhttps://patchthecve.com/cve/CVE-2026-41647.htmlhttps://patchthecve.com/cve/CVE-2026-41647.htmlMon, 26 Oct 2026 21:10:00 +0000MEDIUM 6.5: Incus is a system container and virtual machine manager. Prior to version 7.0.0, a missing error handling could lead an authenticated Incus user to cause a daemon crash through the import of a truncated storage bucket backup file. This issue has been patched in version 7.0.0.https://patchthecve.com/cve/CVE-2026-40251.htmlhttps://patchthecve.com/cve/CVE-2026-40251.htmlMon, 26 Oct 2026 19:10:00 +0000MEDIUM 6.5: Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authenticated user with access to the storage volume feature to cause the Incus daemon to crash. The backup restore subsystem contains an out-of-bohttps://patchthecve.com/cve/CVE-2026-40243.htmlhttps://patchthecve.com/cve/CVE-2026-40243.htmlMon, 26 Oct 2026 19:10:00 +0000MEDIUM 4.8: Incus is a system container and virtual machine manager. In versions before 7.0.0, broken TLS validation logic in the OVN database connection logic can allow connections to an attacker's OVN database. The OVN client implementations disable Go standard TLS server verification and replace it with custhttps://patchthecve.com/cve/CVE-2026-40197.htmlhttps://patchthecve.com/cve/CVE-2026-40197.htmlMon, 26 Oct 2026 19:10:00 +0000MEDIUM 6.5: Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authenticated user with access to the storage volume feature to cause the Incus daemon to crash. The custom volume backup import subsystem containshttps://patchthecve.com/cve/CVE-2026-40195.htmlhttps://patchthecve.com/cve/CVE-2026-40195.htmlMon, 26 Oct 2026 19:10:00 +0000MEDIUM 6.5: Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage bucket import logic allows an authenticated user with access to the storage bucket feature to cause the Incus daemon to crash. The vulnerability is present in the backup metadat