Canonical vulnerabilities

Products

• Ubuntu Linux 4,121
• Lxd 46
• Apport 45
• Juju 21
• Snapd 17
• Ubuntu Linux 13
• Cloud-init 9
• Ubuntu 22.04 Lts 8
• Ubuntu 24.04 Lts 8
• Ubuntu 20.04 Lts 7
• Ubuntu 26.04 Lts 7
• Accountsservice 6
• Ubuntu 16.04 Lts 6
• Ubuntu 18.04 Lts 6
• Authd 5
• Maas 5
• Metal As A Service 5
• Multipass 5
• Ubuntu 5
• Python-apt 4
• Ubuntu Core 4
• Ubuntu Touch 4
• Aptdaemon 3
• Landscape 3
• Pulseaudio 3
• Subiquity 3
• Ubuntu-pro-client (ubuntu-advantage-tools) 3
• Whoopsie 3
• Acpi-support 2
• Lxcfs 2
• Software-properties 2
• Ubantu Kernel 2
• Ubuntu 14.04 Lts 2
• Ubuntu Desktop Provision 2
• Ubuntu Kernel 2
• Ubuntu Server 2
• Unity-firefox-extension 2
• Update-manager 2

Newest

• canonical lxd Improper certificate validation in the HTTPS listener in LXD CVE-2026-112816 Public exploit 10.0 CriticalOctober 30, 2026
• canonical juju Missing authorization in the unit resources download route in Juju controllers CVE-2026-93336 7.1 HighOctober 22, 2026
• canonical authd authd: Account takeover via username fallback in identity matching after IdP email reassignment CVE-2026-102631 Fix available 5.9 MediumOctober 15, 2026
• canonical postgresql-operator Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm CVE-2026-104055 5.3 MediumOctober 2, 2026
• canonical maas RPC secret disclosure via vendor data endpoint in Canonical MAAS CVE-2026-12392 5.3 MediumOctober 2, 2026
• canonical ubuntu pro for wsl wsl-pro-service: Ubuntu Pro token exposed via process command-line arguments CVE-2026-102371 Fix available 5.7 MediumSeptember 29, 2026
• canonical lxd LXD client recursive file pull allows directory escape via malicious VM agent CVE-2026-87798 5.8 MediumSeptember 28, 2026
• canonical lxd Arbitrary file write on LXD host via symlink in migration stream CVE-2026-87799 9.9 CriticalSeptember 28, 2026
• canonical lxd Incorrect authorization in LXD storage volume API allows reading volumes from other projects CVE-2026-97335 7.7 HighSeptember 28, 2026
• canonical lxd Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root CVE-2026-85185 Fix available 9.6 CriticalSeptember 28, 2026
• canonical lxd Path traversal via Btrfs optimized-backup subvolumes[].path enables root file/dir manipulation in LXD CVE-2026-85526 Fix available 9.9 CriticalSeptember 28, 2026
• canonical lxd LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse CVE-2026-86335 6.3 MediumSeptember 28, 2026
• canonical lxd CLI Path Traversal via Content-Disposition in LXD Image Export/Copy CVE-2026-86334 4.2 MediumSeptember 28, 2026
• canonical lxd Instance template path traversal allows arbitrary host file write as root CVE-2026-66897 9.9 CriticalAugust 24, 2026
• canonical apport Path Traversal Vulnerability in apport-unpack CVE-2026-77113 Public exploitFix available 6.7 MediumAugust 20, 2026
• canonical lxd Arbitrary file read+write on host via templates/ symlink in malicious image CVE-2026-16033 8.5 HighAugust 12, 2026
• canonical lxd Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE CVE-2026-66898 9.9 CriticalAugust 12, 2026
• canonical lxd Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root CVE-2026-63293 9.9 CriticalAugust 12, 2026
• canonical lxd Root RCE via image backup.yaml symlink CVE-2026-63294 9.9 CriticalAugust 12, 2026
• canonical lxd Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated` CVE-2026-63295 4.3 MediumAugust 12, 2026
• canonical lxd Project restriction bypass via instance migration config override CVE-2026-63296 9.9 CriticalAugust 12, 2026
• canonical lxd Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge CVE-2026-63297 9.9 CriticalAugust 12, 2026
• canonical lxd LXD arbitrary lxc.conf directive injection via NVIDIA instance configuration CVE-2026-63298 8.7 HighAugust 12, 2026
• canonical lxd Storage volume cross-project move and snapshot restore bypass project disk limits CVE-2026-63299 8.5 HighAugust 12, 2026
• canonical lxd Cross-project cluster migration bypasses project restrictions via cluster notification flag CVE-2026-62420 9.9 CriticalAugust 12, 2026
• canonical lxd Cross-project instance move bypasses all project restrictions allowing host command execution CVE-2026-63300 9.9 CriticalAugust 12, 2026
• canonical accountsservice accountsservice: shell injection via attacker-controlled ~/.pam_environment in Ubuntu language helper scripts CVE-2026-61898 Fix available 7.8 HighJuly 21, 2026
• canonical accountsservice accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scripts CVE-2026-61897 Fix available 7.8 HighJuly 21, 2026
• canonical ubuntu 22.04 lts, ubuntu 24.04 lts, ubuntu 26.04 lts +2 more snap-confine Local Privilege Escalation via Capabilities Misconfiguration or Flaw in Execution Environment Setup CVE-2026-8933 Public exploitFix available 7.8 HighJuly 21, 2026
• canonical ubuntu 16.04 lts, ubuntu 18.04 lts, ubuntu 20.04 lts +3 more +5 more snapd snap-confine Sandbox Confinement Bypass via Omission of setuid Restriction in Seccomp Templates CVE-2026-15226 Fix available 8.4 HighJuly 21, 2026
• canonical ubuntu 16.04 lts, ubuntu 18.04 lts, ubuntu 20.04 lts +3 more +5 more AppArmor Base Profile Misconfiguration in snapd Permits Confined Snaps Unauthorized Access to Hashed Passwords via systemd-userdbd CVE-2024-5300 Fix available 5.6 MediumJuly 21, 2026
• canonical ubuntu 16.04 lts, ubuntu 18.04 lts, ubuntu 20.04 lts +4 more +6 more ubuntu-pro-client Local Privilege Escalation and Information Disclosure via Symlink Arbitrary File Read in collect-logs CVE-2026-12391 Fix available 5.0 MediumJuly 16, 2026
• canonical ubuntu 14.04 lts, ubuntu 16.04 lts, ubuntu 18.04 lts +5 more +7 more ubuntu-pro-client Input Validation Vulnerability Leading to Arbitrary APT Directive Injection and Remote Code Execution CVE-2026-11386 Fix available 9.0 CriticalJuly 16, 2026
• canonical ubuntu 14.04 lts, ubuntu 16.04 lts, ubuntu 18.04 lts +5 more +7 more ubuntu-pro-client Information Disclosure via Cleartext Bearer Token Exposure in Process Command Line CVE-2026-9494 Fix available 5.5 MediumJuly 16, 2026
• canonical ubuntu Sandbox Escape in Ubuntu OpenJDK Packages via xdg-desktop-portal CVE-2026-10037 Fix available 8.8 HighJuly 8, 2026
• lxc incus, canonical lxd +1 more Incus has arbitrary file read+write on host via templates/ symlink in malicious image CVE-2026-48752 Fix available 9.9 CriticalJune 26, 2026
• lxc incus, canonical lxd +1 more Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image CVE-2026-48749 Fix available 9.9 CriticalJune 26, 2026
• canonical lxd SSRF via image import from URL allows internal network probing by authenticated users CVE-2026-28385 Fix available 5.0 MediumJune 26, 2026
• canonical lxd LXD Snapshot Import Privilege Escalation Vulnerability CVE-2026-9640 Fix available 7.2 HighJune 26, 2026
• canonical lxd Authenticated Denial of Service via Malicious Backup Tarball in LXD CVE-2026-9639 Fix available 6.5 MediumJune 26, 2026
• canonical lxd Broken Access Control in Canonical LXD DevLXD API CVE-2026-12411 Fix available 8.4 HighJune 26, 2026
• canonical ubuntu 20.04 lts, ubuntu 22.04 lts, ubuntu 24.04 lts +2 more +4 more Canonical ADSys Trust Store Poisoning via Plaintext HTTP Certificate Auto-Enrollment CVE-2026-12249 Fix available 9.0 CriticalJune 22, 2026
• canonical microceph MicroCeph path traversal issue in the remote-import API CVE-2026-10720 Fix available 5.1 MediumJune 19, 2026
• canonical multipass Local Privilege Escalation in Canonical Multipass CVE-2026-49237 7.8 HighMay 28, 2026
• canonical multipass SFTP Server VM Escape in Canonical Multipass CVE-2026-49238 8.4 HighMay 28, 2026
• canonical ubuntu linux NULL pointer dereference in Ubuntu Linux AppArmor IPv4/IPv6 socket mediation CVE-2026-47337 Fix available 3.3 LowMay 28, 2026
• canonical ubuntu linux Use of uninitialized value in Ubuntu Linux AppArmor IPv4/IPv6 socket mediation rules CVE-2026-47336 Fix available 3.3 LowMay 28, 2026
• canonical ubuntu linux NULL pointer dereference in Ubuntu Linux AppArmor notification handling CVE-2026-47335 Fix available 5.5 MediumMay 28, 2026
• canonical ubuntu linux Deadlock or kernel panic in Ubuntu Linux AppArmor notification handling CVE-2026-47334 Fix available 5.5 MediumMay 28, 2026
• canonical ubuntu linux Out-of-bounds read in Ubuntu Linux AppArmor notification handling CVE-2026-47333 Fix available 7.8 HighMay 28, 2026
• Show olderLoading…