Canonical vulnerabilities

CVEs per yearBy the year they were published

1. 20181
2. 20192
3. 202035
4. 202122
5. 20233
6. 20244
7. 202522
8. 202682

Newest CVEs

• CVE-2026-112816

  Improper certificate validation in the HTTPS listener in LXD

  Canonical · LXD

  Critical10.0
• CVE-2026-93336

  Missing authorization in the unit resources download route in Juju controllers

  Canonical · Juju

  High7.1
• CVE-2026-102631

  authd: Account takeover via username fallback in identity matching after IdP email reassignment

  Canonical · authd

  Medium5.9
• CVE-2026-104055

  Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm

  Canonical · postgresql-operator

  Medium5.3
• CVE-2026-12392

  RPC secret disclosure via vendor data endpoint in Canonical MAAS

  Canonical · MAAS

  Medium5.3
• CVE-2026-102371

  wsl-pro-service: Ubuntu Pro token exposed via process command-line arguments

  Canonical · Ubuntu Pro for WSL

  Medium5.7
• CVE-2026-87798

  LXD client recursive file pull allows directory escape via malicious VM agent

  Canonical · LXD

  Medium5.8
• CVE-2026-87799

  Arbitrary file write on LXD host via symlink in migration stream

  Canonical · LXD

  Critical9.9
• CVE-2026-97335

  Incorrect authorization in LXD storage volume API allows reading volumes from other projects

  Canonical · LXD

  High7.7
• CVE-2026-85185

  Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root

  Canonical · LXD

  Critical9.6