Canonical vulnerabilities

CVEs per yearBy the year they were published

1. 20181
2. 202020
3. 202014
4. 20201
5. 20202
6. 20201
7. 202118
8. 20213
9. 20233
10. 20248
11. 202522
12. 202670

Newest CVEs

• CVE-2026-112816

  Improper certificate validation in the HTTPS listener in LXD

  Canonical · LXD

  Critical10.0
• CVE-2026-93336

  Missing authorization in the unit resources download route in Juju controllers

  Canonical · Juju

  High7.1
• CVE-2026-102631

  authd: Account takeover via username fallback in identity matching after IdP email reassignment

  Canonical · authd

  Medium5.9
• CVE-2026-104055

  Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm

  Canonical · postgresql-operator

  Medium5.3
• CVE-2026-12392

  RPC secret disclosure via vendor data endpoint in Canonical MAAS

  Canonical · MAAS

  Medium5.3
• CVE-2026-102371

  wsl-pro-service: Ubuntu Pro token exposed via process command-line arguments

  Canonical · Ubuntu Pro for WSL

  Medium5.7
• CVE-2026-87798

  LXD client recursive file pull allows directory escape via malicious VM agent

  Canonical · LXD

  Medium5.8
• CVE-2026-87799

  Arbitrary file write on LXD host via symlink in migration stream

  Canonical · LXD

  Critical9.9
• CVE-2026-97335

  Incorrect authorization in LXD storage volume API allows reading volumes from other projects

  Canonical · LXD

  High7.7
• CVE-2026-85185

  Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root

  Canonical · LXD

  Critical9.6