Canonical vulnerabilities
224 CVEs and advisories name Canonical as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-84410apport: Local privilege escalation to root via ldd execution on an attacker-controlled ExecutablePath in automatic crash report processing
- CVE-2026-86692apport: Arbitrary file creation or overwrite via path traversal in base64-encoded problem report keys
- CVE-2026-112816Improper certificate validation in the HTTPS listener in LXD
- CVE-2026-93336Missing authorization in the unit resources download route in Juju controllers
- CVE-2026-102631authd: Account takeover via username fallback in identity matching after IdP email reassignment
- CVE-2026-104055Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm
- CVE-2026-12392RPC secret disclosure via vendor data endpoint in Canonical MAAS
- CVE-2026-102371wsl-pro-service: Ubuntu Pro token exposed via process command-line arguments
- CVE-2026-87798LXD client recursive file pull allows directory escape via malicious VM agent
- CVE-2026-87799Arbitrary file write on LXD host via symlink in migration stream
- CVE-2026-97335Incorrect authorization in LXD storage volume API allows reading volumes from other projects
- CVE-2026-85185Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root
- CVE-2026-85526Path traversal via Btrfs optimized-backup subvolumes[].path enables root file/dir manipulation in LXD
- CVE-2026-86335LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse
- CVE-2026-86334CLI Path Traversal via Content-Disposition in LXD Image Export/Copy
- CVE-2026-66897Instance template path traversal allows arbitrary host file write as root
- CVE-2026-55622Incus has a project restriction bypass in instance copy across projects
- CVE-2026-55621Incus has a project restriction bypass for custom volume copy across projects
- CVE-2026-48769Incus has an arbitrary file write on its client due to trusted image hash
- CVE-2026-48755Incus has an argument injection in backup compression algorithm leading to AFW and ACE
- CVE-2026-48752Incus has arbitrary file read+write on host via templates/ symlink in malicious image
- CVE-2026-48751Incus has a restricted project bypass leading to arbitrary command execution
- CVE-2026-48750Incus has an arbitrary file write on host via `exec-output` symlink in crafted image
- CVE-2026-48749Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image
- CVE-2026-77113Path Traversal Vulnerability in apport-unpack
- CVE-2026-61898accountsservice: shell injection via attacker-controlled ~/.pam_environment in Ubuntu language helper scripts
- CVE-2026-61897accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scripts
- CVE-2026-16033Arbitrary file read+write on host via templates/ symlink in malicious image
- CVE-2026-66898Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE
- CVE-2026-63293Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root