CVE Intelligence

Qubes OS vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Qubes OS products: 1 record(s), with severity, exploitation and fixes.

Qubes OS 1

Exploited only (KEV) →

CVE-2026-82636 High · 7.9 CWE-78 Aug 30, 2026
OS Command Injection in Qubes OS
Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in core-admin-linux/file-copy-vm/qfile-dom0-agent.c.