{"action":"Upgrade incus to 6.0.4-2+deb13u5 or later.","affected":[{"fixed":"6.0.4-2+deb13u5","introduced":"0"}],"component":"incus","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["6.0.4-2+deb13u5"],"id":"tcs_01M5NRRD2V5G0K8K4HNBJN78QB","modified_at":"2026-10-01T03:03:22.206202594Z","published_at":"2026-03-26T23:16:20.743Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-33897","https://security-tracker.debian.org/tracker/CVE-2026-33897"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-33897","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-33897"}],"summary":"Incus is a system container and virtual machine manager. Prior to version 6.23.0, instance template files can be used to cause arbitrary read or writes as root on the host server. Incus allows for pon"}