Canonical product
LXD
Tracked since 29 Sep · latest article 1 Nov · RSS · API
None open
of 0 in the full CISA catalogue · all time
EPSS top 5%, not in KEV
usual rate
Exploited, by due date
No LXD CVE is in the CISA KEV catalogue.
Patch cadence and exploit odds
How often CISA adds LXD CVEs, how many have a fix, and where their exploit odds sit.
Added to CISA KEV per quarter
CISA has not added a LXD CVE to KEV.
Fix listed
4 of 4 CVEs in coverage
Every CVE in coverage has a fix recorded.
EPSS percentile of each CVE
One dot per CVE; a red diamond marks those in CISA KEV.
Show as tableHide table
| CVE | EPSS percentile |
|---|---|
| CVE-2026-85526 | 44.7 |
| CVE-2026-87799 | 34.9 |
| CVE-2026-85185 | 30.7 |
| CVE-2026-112816 | 23.1 |
Coverage2 articles · all time
The latest 2 articles naming LXD, in the shared story grammar.
2 articles from 2 outlets since 29 Sep. Picked up again today after 5 weeks quiet.
- Tue 29 Sep, 02:28 UTC. SecurityOnline, first report. Critical LXD Flaws Let Users Write to Hosts as Root.
- Sun 1 Nov, 10:30 UTC. The Hacker News, its first report on the story. Canonical fixes critical LXD flaw that enables client impersonation.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 2 articles as a listHide the list
- Tue 29 SepDay 01
- Critical LXD Flaws Let Users Write to Hosts as Root02:28 · SecurityOnline · First report
Quiet for 5 weeks
Sun 1 NovDay 331- Canonical fixes critical LXD flaw that enables client impersonation10:30 · The Hacker News · Picked up again
All CVEs in coverage4
Exploited first, then by EPSS
Canonical LXD vulnerability
9.9Critical0.5% EPSS · 1 articleArbitrary file write on LXD host via symlink in migration stream
9.9Critical0.4% EPSS · 1 articlePath traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root
9.6Critical0.4% EPSS · 1 articleImproper certificate validation in the HTTPS listener in LXD
10.0Critical0.3% EPSS · 1 article