LXD has restricted project bypass leading to arbitrary command execution
Go github.com/canonical/lxd · Upgrade to 0.0.0-20260630083100-c5184be310b1 (pre-release) or later · < 0.0.0-20260630083100-c5184be310b1 · GHSA-47w9-6r3f-938g · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
Go github.com/canonical/lxd · Upgrade to 0.0.0-20260630083100-c5184be310b1 (pre-release) or later · < 0.0.0-20260630083100-c5184be310b1 · GHSA-47w9-6r3f-938g · amended
Go github.com/canonical/lxd · Upgrade to 0.0.0-20260630083100-c5184be310b1 (pre-release) or later · < 0.0.0-20260630083100-c5184be310b1 · GHSA-7mr3-28h5-m5vx · amended
Go github.com/canonical/lxd · Upgrade to 0.0.0-20260630083100-c5184be310b1 (pre-release) or later · < 0.0.0-20260630083100-c5184be310b1 · GHSA-qx75-2p3r-pwm5 · amended
PyPI geonode · Upgrade to 5.1.0 or later · < 5.1.0 · CVE-2026-33050 · GHSA-9fpx-fr6j-2vh6 · amended
Go github.com/canonical/lxd · Upgrade to 0.0.0-20260630083100-c5184be310b1 (pre-release) or later · < 0.0.0-20260630083100-c5184be310b1 · GHSA-pjff-c2wc-f6jm · amended
Go github.com/canonical/lxd · Upgrade to 0.0.0-20260630083100-c5184be310b1 (pre-release) or later · < 0.0.0-20260630083100-c5184be310b1 · GHSA-fmc8-p6q7-75cc · amended
Go github.com/canonical/lxd · Upgrade to 0.0.0-20260630083100-c5184be310b1 (pre-release) or later · < 0.0.0-20260630083100-c5184be310b1 · GHSA-vghh-5rfx-xhq8 · amended
Go github.com/canonical/lxd · Upgrade to 0.0.0-20260203144152-d1c8ba15d160 (pre-release) or later · < 0.0.0-20260203144152-d1c8ba15d160 · GHSA-jpf8-86f3-wp38 · amended
exec-output symlink in crafted imageGo github.com/canonical/lxd · Upgrade to 0.0.0-20260626085134-124f90100640 (pre-release) or later · < 0.0.0-20260626085134-124f90100640 · GHSA-9j25-mm2h-2f76 · amended
Go github.com/osac-project/osac-operator · Upgrade to 0.0.4 or later · < 0.0.4 · CVE-2026-62284 · GHSA-5w5g-j6hw-6p8f · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.