# cve.now: Canonical

The newest entries naming Canonical as an affected vendor (up to 200), of 224 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-84410](https://cve.now/CVE-2026-84410.md): apport: Local privilege escalation to root via ldd execution on an attacker-controlled ExecutablePath in automatic crash report processing (CVSS 7.3)
- [CVE-2026-86692](https://cve.now/CVE-2026-86692.md): apport: Arbitrary file creation or overwrite via path traversal in base64-encoded problem report keys (CVSS 5.7)
- [CVE-2026-112816](https://cve.now/CVE-2026-112816.md): Improper certificate validation in the HTTPS listener in LXD (CVSS 10.0)
- [CVE-2026-93336](https://cve.now/CVE-2026-93336.md): Missing authorization in the unit resources download route in Juju controllers (CVSS 7.1)
- [CVE-2026-102631](https://cve.now/CVE-2026-102631.md): authd: Account takeover via username fallback in identity matching after IdP email reassignment (CVSS 5.9)
- [CVE-2026-104055](https://cve.now/CVE-2026-104055.md): Monitoring-user password logged in cleartext by postgres\_exporter in postgresql VM charm (CVSS 5.3)
- [CVE-2026-12392](https://cve.now/CVE-2026-12392.md): RPC secret disclosure via vendor data endpoint in Canonical MAAS (CVSS 5.3)
- [CVE-2026-102371](https://cve.now/CVE-2026-102371.md): wsl-pro-service: Ubuntu Pro token exposed via process command-line arguments (CVSS 5.7)
- [CVE-2026-87798](https://cve.now/CVE-2026-87798.md): LXD client recursive file pull allows directory escape via malicious VM agent (CVSS 5.8)
- [CVE-2026-87799](https://cve.now/CVE-2026-87799.md): Arbitrary file write on LXD host via symlink in migration stream (CVSS 9.9)
- [CVE-2026-97335](https://cve.now/CVE-2026-97335.md): Incorrect authorization in LXD storage volume API allows reading volumes from other projects (CVSS 7.7)
- [CVE-2026-85185](https://cve.now/CVE-2026-85185.md): Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root (CVSS 9.6)
- [CVE-2026-85526](https://cve.now/CVE-2026-85526.md): Path traversal via Btrfs optimized-backup subvolumes\[\].path enables root file/dir manipulation in LXD (CVSS 9.9)
- [CVE-2026-86335](https://cve.now/CVE-2026-86335.md): LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse (CVSS 6.3)
- [CVE-2026-86334](https://cve.now/CVE-2026-86334.md): CLI Path Traversal via Content-Disposition in LXD Image Export/Copy (CVSS 4.2)
- [CVE-2026-66897](https://cve.now/CVE-2026-66897.md): Instance template path traversal allows arbitrary host file write as root (CVSS 9.9)
- [CVE-2026-55622](https://cve.now/CVE-2026-55622.md): Incus has a project restriction bypass in instance copy across projects (CVSS 7.7)
- [CVE-2026-55621](https://cve.now/CVE-2026-55621.md): Incus has a project restriction bypass for custom volume copy across projects (CVSS 7.7)
- [CVE-2026-48769](https://cve.now/CVE-2026-48769.md): Incus has an arbitrary file write on its client due to trusted image hash (CVSS 9.9)
- [CVE-2026-48755](https://cve.now/CVE-2026-48755.md): Incus has an argument injection in backup compression algorithm leading to AFW and ACE (CVSS 9.9)
- [CVE-2026-48752](https://cve.now/CVE-2026-48752.md): Incus has arbitrary file read+write on host via templates/ symlink in malicious image (CVSS 9.9)
- [CVE-2026-48751](https://cve.now/CVE-2026-48751.md): Incus has a restricted project bypass leading to arbitrary command execution (CVSS 9.9)
- [CVE-2026-48750](https://cve.now/CVE-2026-48750.md): Incus has an arbitrary file write on host via \`exec-output\` symlink in crafted image (CVSS 9.9)
- [CVE-2026-48749](https://cve.now/CVE-2026-48749.md): Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image (CVSS 9.9)
- [CVE-2026-77113](https://cve.now/CVE-2026-77113.md): Path Traversal Vulnerability in apport-unpack (CVSS 6.7)
- [CVE-2026-61898](https://cve.now/CVE-2026-61898.md): accountsservice: shell injection via attacker-controlled ~/.pam\_environment in Ubuntu language helper scripts (CVSS 7.8)
- [CVE-2026-61897](https://cve.now/CVE-2026-61897.md): accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scripts (CVSS 7.8)
- [CVE-2026-16033](https://cve.now/CVE-2026-16033.md): Arbitrary file read+write on host via templates/ symlink in malicious image (CVSS 8.5)
- [CVE-2026-66898](https://cve.now/CVE-2026-66898.md): Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE (CVSS 9.9)
- [CVE-2026-63293](https://cve.now/CVE-2026-63293.md): Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root (CVSS 9.9)
- [CVE-2026-63294](https://cve.now/CVE-2026-63294.md): Root RCE via image backup.yaml symlink (CVSS 9.9)
- [CVE-2026-63295](https://cve.now/CVE-2026-63295.md): Project restriction \`restricted.containers.privilege=isolated\` bypassable by omitting \`security.idmap.isolated\` (CVSS 4.3)
- [CVE-2026-63296](https://cve.now/CVE-2026-63296.md): Project restriction bypass via instance migration config override (CVSS 9.9)
- [CVE-2026-63297](https://cve.now/CVE-2026-63297.md): Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge (CVSS 9.9)
- [CVE-2026-63298](https://cve.now/CVE-2026-63298.md): LXD arbitrary lxc.conf directive injection via NVIDIA instance configuration (CVSS 8.7)
- [CVE-2026-63299](https://cve.now/CVE-2026-63299.md): Storage volume cross-project move and snapshot restore bypass project disk limits (CVSS 8.5)
- [CVE-2026-62420](https://cve.now/CVE-2026-62420.md): Cross-project cluster migration bypasses project restrictions via cluster notification flag (CVSS 9.9)
- [CVE-2026-63300](https://cve.now/CVE-2026-63300.md): Cross-project instance move bypasses all project restrictions allowing host command execution (CVSS 9.9)
- [CVE-2026-8933](https://cve.now/CVE-2026-8933.md): snap-confine Local Privilege Escalation via Capabilities Misconfiguration or Flaw in Execution Environment Setup (CVSS 7.8)
- [CVE-2026-15226](https://cve.now/CVE-2026-15226.md): snapd snap-confine Sandbox Confinement Bypass via Omission of setuid Restriction in Seccomp Templates (CVSS 8.4)
- [CVE-2024-5300](https://cve.now/CVE-2024-5300.md): AppArmor Base Profile Misconfiguration in snapd Permits Confined Snaps Unauthorized Access to Hashed Passwords via systemd-userdbd (CVSS 5.6)
- [CVE-2026-12391](https://cve.now/CVE-2026-12391.md): ubuntu-pro-client Local Privilege Escalation and Information Disclosure via Symlink Arbitrary File Read in collect-logs (CVSS 5.0)
- [CVE-2026-11386](https://cve.now/CVE-2026-11386.md): ubuntu-pro-client Input Validation Vulnerability Leading to Arbitrary APT Directive Injection and Remote Code Execution (CVSS 9.0)
- [CVE-2026-9494](https://cve.now/CVE-2026-9494.md): ubuntu-pro-client Information Disclosure via Cleartext Bearer Token Exposure in Process Command Line (CVSS 5.5)
- [CVE-2026-10037](https://cve.now/CVE-2026-10037.md): Sandbox Escape in Ubuntu OpenJDK Packages via xdg-desktop-portal (CVSS 8.8)
- [CVE-2026-28385](https://cve.now/CVE-2026-28385.md): SSRF via image import from URL allows internal network probing by authenticated users (CVSS 5.0)
- [CVE-2026-9640](https://cve.now/CVE-2026-9640.md): LXD Snapshot Import Privilege Escalation Vulnerability (CVSS 7.2)
- [CVE-2026-9639](https://cve.now/CVE-2026-9639.md): Authenticated Denial of Service via Malicious Backup Tarball in LXD (CVSS 6.5)
- [CVE-2026-12411](https://cve.now/CVE-2026-12411.md): Broken Access Control in Canonical LXD DevLXD API (CVSS 8.4)
- [CVE-2026-12249](https://cve.now/CVE-2026-12249.md): Canonical ADSys Trust Store Poisoning via Plaintext HTTP Certificate Auto-Enrollment (CVSS 8.3)
- [CVE-2026-10720](https://cve.now/CVE-2026-10720.md): MicroCeph path traversal issue in the remote-import API (CVSS 5.1)
- [CVE-2026-47337](https://cve.now/CVE-2026-47337.md): NULL pointer dereference in Ubuntu Linux AppArmor IPv4/IPv6 socket mediation (CVSS 3.3)
- [CVE-2026-47336](https://cve.now/CVE-2026-47336.md): Use of uninitialized value in Ubuntu Linux AppArmor IPv4/IPv6 socket mediation rules (CVSS 3.3)
- [CVE-2026-47335](https://cve.now/CVE-2026-47335.md): NULL pointer dereference in Ubuntu Linux AppArmor notification handling (CVSS 5.5)
- [CVE-2026-47334](https://cve.now/CVE-2026-47334.md): Deadlock or kernel panic in Ubuntu Linux AppArmor notification handling (CVSS 5.5)
- [CVE-2026-47333](https://cve.now/CVE-2026-47333.md): Out-of-bounds read in Ubuntu Linux AppArmor notification handling (CVSS 7.8)
- [CVE-2026-47332](https://cve.now/CVE-2026-47332.md): Out-of-bounds read in Ubuntu Linux AppArmor notification handling (CVSS 5.5)
- [CVE-2026-47331](https://cve.now/CVE-2026-47331.md): Use-after-free in Ubuntu Linux AppArmor notification handling (CVSS 7.8)
- [CVE-2026-47330](https://cve.now/CVE-2026-47330.md): Use of uninitialized value in Ubuntu Linux AppArmor notification handling (CVSS 3.3)
- [CVE-2026-47329](https://cve.now/CVE-2026-47329.md): Incorrect validation of field size in Ubuntu Linux AppArmor notification responses (CVSS 3.3)
- [CVE-2026-47328](https://cve.now/CVE-2026-47328.md): Invalid pointer deallocation in Ubuntu Linux AppArmor notification handling (CVSS 6.1)
- [CVE-2026-47327](https://cve.now/CVE-2026-47327.md): NULL pointer dereference in Ubuntu Linux AppArmor notification handling (CVSS 3.3)
- [CVE-2026-47326](https://cve.now/CVE-2026-47326.md): Memory leak in Ubuntu Linux AppArmor large notification response allocation (CVSS 5.5)
- [CVE-2026-49237](https://cve.now/CVE-2026-49237.md): Local Privilege Escalation in Canonical Multipass (CVSS 7.8)
- [CVE-2026-49238](https://cve.now/CVE-2026-49238.md): SFTP Server VM Escape in Canonical Multipass (CVSS 8.4)
- [CVE-2026-6970](https://cve.now/CVE-2026-6970.md): authd Denial of Service and Local Privilege Escalation (CVSS 7.3)
- [CVE-2026-6369](https://cve.now/CVE-2026-6369.md): Exposed Session Token in canonical-livepatch client snap (CVSS 5.7)
- [CVE-2026-5412](https://cve.now/CVE-2026-5412.md): Juju CloudSpec API could leak senstive information (CVSS 9.9)
- [CVE-2026-5774](https://cve.now/CVE-2026-5774.md): Juju API Server Denial of Service and Authentication Replay via Unsynchronized Token Map (CVSS 6.1)
- [CVE-2025-14551](https://cve.now/CVE-2025-14551.md): Senstive information disclosure was affecting subiquity (CVSS 2.7)
- [CVE-2025-15480](https://cve.now/CVE-2025-15480.md): Senstive information disclosure was affecting ubuntu-desktop-provision (CVSS 2.7)
- [CVE-2026-34179](https://cve.now/CVE-2026-34179.md): Update of type field in restricted TLS certificate allows privilege escalation to cluster admin (CVSS 9.1)
- [CVE-2026-34178](https://cve.now/CVE-2026-34178.md): Importing a crafted backup leads to project restriction bypass (CVSS 9.1)
- [CVE-2026-34177](https://cve.now/CVE-2026-34177.md): VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf (CVSS 9.1)
- [CVE-2026-4370](https://cve.now/CVE-2026-4370.md): Improper TLS Client/Server authentication and certificate verification on Database Cluster (CVSS 10.0)
- [CVE-2026-32694](https://cve.now/CVE-2026-32694.md): Insecure Direct Object Reference attack via predictable secret ID in Juju (CVSS 6.6)
- [CVE-2026-32693](https://cve.now/CVE-2026-32693.md): Unauthorized access to Kubernetes secrets in Juju (CVSS 8.8)
- [CVE-2026-32692](https://cve.now/CVE-2026-32692.md): Unauthorized update of out-of-scope Vault secrets (CVSS 7.6)
- [CVE-2026-32691](https://cve.now/CVE-2026-32691.md): Timing ownership claim attack on new external back-end secrets (CVSS 5.3)
- [CVE-2026-3888](https://cve.now/CVE-2026-3888.md): Local Privilege Escalation in snapd (CVSS 7.8)
- [CVE-2026-28384](https://cve.now/CVE-2026-28384.md): Authenticated RCE via unsanitized compression\_algorithm (CVSS 9.4)
- [CVE-2025-13350](https://cve.now/CVE-2025-13350.md): Use-after-free of orphaned AF\_UNIX in Ubuntu builds of Linux kernel (CVSS 7.1)
- [CVE-2026-3351](https://cve.now/CVE-2026-3351.md): Authorization Bypass in LXD GET /1.0/certificates Endpoint (CVSS 2.1)
- [CVE-2026-1237](https://cve.now/CVE-2026-1237.md): Vulnerable cross-model authorization in juju. (CVSS 2.1)
- [CVE-2025-5467](https://cve.now/CVE-2025-5467.md): Ubuntu Apport Insecure File Permissions Vulnerability (CVSS 1.9)
- [CVE-2025-6966](https://cve.now/CVE-2025-6966.md): Null-pointer dereference in python-apt TagSection.keys() (CVSS 6.9)
- [CVE-2025-54293](https://cve.now/CVE-2025-54293.md): Path Traversal in LXD Instance Log File Retrieval (CVSS 7.1)
- [CVE-2025-54292](https://cve.now/CVE-2025-54292.md): Client-Side Path Traversal in LXD-UI (CVSS 4.8)
- [CVE-2025-54291](https://cve.now/CVE-2025-54291.md): Project existence disclosure in LXD images API (CVSS 6.9)
- [CVE-2025-54290](https://cve.now/CVE-2025-54290.md): Project Existence Disclosure via Error Handling in LXD Image Export (CVSS 6.9)
- [CVE-2025-54289](https://cve.now/CVE-2025-54289.md): Privilege Escalation via WebSocket Connection Hijacking in LXD Operations API (CVSS 7.4)
- [CVE-2025-54288](https://cve.now/CVE-2025-54288.md): Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server (CVSS 5.1)
- [CVE-2025-54287](https://cve.now/CVE-2025-54287.md): Arbitrary File Read via Template Injection in Snapshot Patterns (CVSS 7.1)
- [CVE-2025-54286](https://cve.now/CVE-2025-54286.md): CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI (CVSS 7.5)
- [CVE-2024-6107](https://cve.now/CVE-2024-6107.md): Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region. (CVSS 9.6)
- [CVE-2025-5199](https://cve.now/CVE-2025-5199.md): LPE on Multipass for macOS (CVSS 7.3)
- [CVE-2025-0928](https://cve.now/CVE-2025-0928.md): Arbitrary executable upload via authenticated endpoint (CVSS 8.8)
- [CVE-2025-53513](https://cve.now/CVE-2025-53513.md): Zip slip vulnerability in Juju (CVSS 8.8)
- [CVE-2025-53512](https://cve.now/CVE-2025-53512.md): Sensitive log retrieval in Juju (CVSS 6.5)
- [CVE-2025-6224](https://cve.now/CVE-2025-6224.md): Key leakage in juju/utils certificates (CVSS 6.5)
- [CVE-2024-11584](https://cve.now/CVE-2024-11584.md): cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, (CVSS 5.9)
- [CVE-2024-6174](https://cve.now/CVE-2024-6174.md): When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. (CVSS 8.8)
- [CVE-2025-5689](https://cve.now/CVE-2025-5689.md): Improper Permission Management in SSH Session Handling (CVSS 8.5)
- [CVE-2025-5054](https://cve.now/CVE-2025-5054.md): Race Condition in Canonical Apport (CVSS 4.7)
- [CVE-2023-5616](https://cve.now/CVE-2023-5616.md): In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activa (CVSS 4.9)
- [CVE-2025-24375](https://cve.now/CVE-2025-24375.md): MySQL K8s charm could leak credentials for root-level user \`serverconfig\` (CVSS 5.0)
- [CVE-2025-31479](https://cve.now/CVE-2025-31479.md): canonical/get-workflow-version-action can leak a partial GITHUB\_TOKEN in exception output (CVSS 8.2)
- [CVE-2023-0092](https://cve.now/CVE-2023-0092.md): An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from th (CVSS 4.9)
- [CVE-2022-1736](https://cve.now/CVE-2022-1736.md): Ubuntu's configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default. (CVSS 9.8)
- [CVE-2020-11936](https://cve.now/CVE-2020-11936.md): gdbus setgid privilege escalation (CVSS 3.1)
- [CVE-2022-28653](https://cve.now/CVE-2022-28653.md): Users can consume unlimited disk space in /var/crash (CVSS 7.5)
- [CVE-2024-6219](https://cve.now/CVE-2024-6219.md): Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its rest (CVSS 3.8)
- [CVE-2024-6156](https://cve.now/CVE-2024-6156.md): Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust stor (CVSS 3.8)
- [CVE-2024-11586](https://cve.now/CVE-2024-11586.md): Ubuntu's implementation of pulseaudio can be crashed by a malicious program if a bluetooth headset is connected. (CVSS 4.0)
- [CVE-2024-9312](https://cve.now/CVE-2024-9312.md): Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. (CVSS 7.5)
- [CVE-2024-9313](https://cve.now/CVE-2024-9313.md): Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same broker and perform an (CVSS 8.8)
- [CVE-2024-8038](https://cve.now/CVE-2024-8038.md): Vulnerable juju introspection abstract UNIX domain socket. (CVSS 7.9)
- [CVE-2024-8037](https://cve.now/CVE-2024-8037.md): Vulnerable juju hook tool abstract UNIX domain socket. (CVSS 6.5)
- [CVE-2024-7558](https://cve.now/CVE-2024-7558.md): JUJU\_CONTEXT\_ID is a predictable authentication secret. (CVSS 8.7)
- [CVE-2024-8287](https://cve.now/CVE-2024-8287.md): Anbox Management Service, in versions 1.17.0 through 1.23.0, does not validate the TLS certificate provided to it by the Anbox Stream Agent. (CVSS 7.5)
- [CVE-2024-5290](https://cve.now/CVE-2024-5290.md): An issue was discovered in Ubuntu wpa\_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged att (CVSS 8.8)
- [CVE-2024-6984](https://cve.now/CVE-2024-6984.md): An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access (CVSS 8.8)
- [CVE-2024-29069](https://cve.now/CVE-2024-29069.md): snapd will follow archived symlinks when unpacking a filesystem (CVSS 4.8)
- [CVE-2024-29068](https://cve.now/CVE-2024-29068.md): snapd non-regular file indefinite blocking read (CVSS 5.8)
- [CVE-2024-1724](https://cve.now/CVE-2024-1724.md): snapd allows $HOME/bin symlink (CVSS 6.3)
- [CVE-2024-6714](https://cve.now/CVE-2024-6714.md): An issue was discovered in provd before version 0.1.5 with a setuid binary, which allows a local attacker to escalate their privilege. (CVSS 8.8)
- [CVE-2024-41129](https://cve.now/CVE-2024-41129.md): The ops library leaks secrets if \`subprocess.CalledProcessError\` happens with a \`secret-\*\` CLI command (CVSS 4.4)
- [CVE-2024-6388](https://cve.now/CVE-2024-6388.md): Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passin (CVSS 5.9)
- [CVE-2020-27352](https://cve.now/CVE-2020-27352.md): When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result s (CVSS 9.3)
- [CVE-2022-4968](https://cve.now/CVE-2022-4968.md): netplan leaks the private key of wireguard to local users. (CVSS 6.5)
- [CVE-2022-28658](https://cve.now/CVE-2022-28658.md): Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofing (CVSS 5.5)
- [CVE-2022-28657](https://cve.now/CVE-2022-28657.md): Apport does not disable python crash handler before entering chroot (CVSS 7.8)
- [CVE-2022-28656](https://cve.now/CVE-2022-28656.md): is\_closing\_session() allows users to consume RAM in the Apport process (CVSS 5.5)
- [CVE-2022-28655](https://cve.now/CVE-2022-28655.md): is\_closing\_session() allows users to create arbitrary tcp dbus connections (CVSS 7.1)
- [CVE-2022-28654](https://cve.now/CVE-2022-28654.md): is\_closing\_session() allows users to fill up apport.log (CVSS 5.5)
- [CVE-2022-28652](https://cve.now/CVE-2022-28652.md): ~/.config/apport/settings parsing is vulnerable to "billion laughs" attack (CVSS 5.5)
- [CVE-2022-1242](https://cve.now/CVE-2022-1242.md): Apport can be tricked into connecting to arbitrary sockets as the root user (CVSS 7.8)
- [CVE-2021-3899](https://cve.now/CVE-2021-3899.md): There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an attacker to execute ar (CVSS 7.8)
- [CVE-2022-0555](https://cve.now/CVE-2022-0555.md): Subiquity Shows Guided Storage Passphrase in Plaintext with Read-all Permissions (CVSS 8.4)
- [CVE-2024-5138](https://cve.now/CVE-2024-5138.md): The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of (CVSS 8.1)
- [CVE-2024-3250](https://cve.now/CVE-2024-3250.md): It was discovered that Canonical's Pebble service manager read-file API and the associated pebble pull command, before v1.10.2, allowed unpr (CVSS 6.5)
- [CVE-2023-49721](https://cve.now/CVE-2023-49721.md): An insecure default to allow UEFI Shell in EDK2 was left enabled in LXD. (CVSS 6.7)
- [CVE-2023-48733](https://cve.now/CVE-2023-48733.md): An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. (CVSS 6.7)
- [CVE-2022-4964](https://cve.now/CVE-2022-4964.md): Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set. (CVSS 5.5)
- [CVE-2022-3328](https://cve.now/CVE-2022-3328.md): Race condition in snap-confine's must\_mkdir\_and\_open\_with\_perms() (CVSS 7.8)
- [CVE-2023-5536](https://cve.now/CVE-2023-5536.md): A feature in LXD (LP#1829071), affects the default configuration of Ubuntu Server which allows privileged users in the lxd group to escalate (CVSS 5.0)
- [CVE-2023-5182](https://cve.now/CVE-2023-5182.md): Sensitive data could be exposed in logs of subiquity version 23.09.1 and earlier. (CVSS 5.5)
- [CVE-2023-3297](https://cve.now/CVE-2023-3297.md): In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus (CVSS 8.1)
- [CVE-2023-1523](https://cve.now/CVE-2023-1523.md): Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to (CVSS 10.0)
- [CVE-2023-32629](https://cve.now/CVE-2023-32629.md): Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl\_copy\_up\_meta\_inode\_data skip permission checks when calling ovl\_do\_ (CVSS 7.8)
- [CVE-2023-2640](https://cve.now/CVE-2023-2640.md): On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.\* xattrs", an unp (CVSS 7.8)
- [CVE-2023-32551](https://cve.now/CVE-2023-32551.md): Landscape Open Redirect (CVSS 6.1)
- [CVE-2023-32550](https://cve.now/CVE-2023-32550.md): Landscape's Apache server-status is accessible by default (CVSS 9.3)
- [CVE-2023-32549](https://cve.now/CVE-2023-32549.md): Landscape insecure token generation (CVSS 6.8)
- [CVE-2023-2612](https://cve.now/CVE-2023-2612.md): shiftfs lock unbalance in Ubuntu-specific kernels (CVSS 4.4)
- [CVE-2023-1786](https://cve.now/CVE-2023-1786.md): sensitive data exposure in cloud-init logs (CVSS 5.5)
- [CVE-2022-2084](https://cve.now/CVE-2022-2084.md): sensitive data exposure in cloud-init logs (CVSS 5.5)
- [CVE-2021-3429](https://cve.now/CVE-2021-3429.md): sensitive data exposure in cloud-init logs (CVSS 5.5)
- [CVE-2023-1326](https://cve.now/CVE-2023-1326.md): local privilege escalation in apport-cli (CVSS 7.7)
- [CVE-2021-4120](https://cve.now/CVE-2021-4120.md): snapd could be made to bypass intended access restrictions through snap content interfaces and layout paths (CVSS 8.2)
- [CVE-2021-44730](https://cve.now/CVE-2021-44730.md): snapd could be made to escalate privileges and run programs as administrator (CVSS 7.8)
- [CVE-2021-3155](https://cve.now/CVE-2021-3155.md): snapd created ~/snap with too-wide permissions (CVSS 3.8)
- [CVE-2021-44731](https://cve.now/CVE-2021-44731.md): snapd could be made to escalate privileges and run programs as administrator (CVSS 7.8)
- [CVE-2021-3747](https://cve.now/CVE-2021-3747.md): MacOS version of Multipass incorrect owner for application directory (CVSS 8.8)
- [CVE-2021-3710](https://cve.now/CVE-2021-3710.md): Apport info disclosure via path traversal bug in read\_file (CVSS 6.5)
- [CVE-2021-3709](https://cve.now/CVE-2021-3709.md): Apport file permission bypass through emacs byte compilation errors (CVSS 6.5)
- [CVE-2021-3626](https://cve.now/CVE-2021-3626.md): Windows version of Multipass unauthenticated localhost tcp control socket can perform mounts (CVSS 8.8)
- [CVE-2021-32557](https://cve.now/CVE-2021-32557.md): apport process\_report() arbitrary file write (CVSS 5.2)
- [CVE-2021-32556](https://cve.now/CVE-2021-32556.md): apport get\_modified\_conffiles() function command injection (CVSS 3.8)
- [CVE-2021-32555](https://cve.now/CVE-2021-32555.md): apport read\_file() function could follow maliciously constructed symbolic links (CVSS 7.3)
- [CVE-2021-32554](https://cve.now/CVE-2021-32554.md): apport read\_file() function could follow maliciously constructed symbolic links (CVSS 7.3)
- [CVE-2021-32553](https://cve.now/CVE-2021-32553.md): apport read\_file() function could follow maliciously constructed symbolic links (CVSS 7.3)
- [CVE-2021-32552](https://cve.now/CVE-2021-32552.md): apport read\_file() function could follow maliciously constructed symbolic links (CVSS 7.3)
- [CVE-2021-32551](https://cve.now/CVE-2021-32551.md): apport read\_file() function could follow maliciously constructed symbolic links (CVSS 7.3)
- [CVE-2021-32550](https://cve.now/CVE-2021-32550.md): apport read\_file() function could follow maliciously constructed symbolic links (CVSS 7.3)
- [CVE-2021-32549](https://cve.now/CVE-2021-32549.md): apport read\_file() function could follow maliciously constructed symbolic links (CVSS 7.3)
- [CVE-2021-32548](https://cve.now/CVE-2021-32548.md): apport read\_file() function could follow maliciously constructed symbolic links (CVSS 7.3)
- [CVE-2021-32547](https://cve.now/CVE-2021-32547.md): apport read\_file() function could follow maliciously constructed symbolic links (CVSS 7.3)
- [CVE-2021-25684](https://cve.now/CVE-2021-25684.md): apport can be stalled by reading a FIFO (CVSS 8.8)
- [CVE-2021-25683](https://cve.now/CVE-2021-25683.md): apport improperly parses /proc/pid/stat (CVSS 8.8)
- [CVE-2021-25682](https://cve.now/CVE-2021-25682.md): apport improperly parses /proc/pid/status (CVSS 8.8)
- [CVE-2013-1055](https://cve.now/CVE-2013-1055.md): Potential DoS through abuse of rate limit in libunity-webapps for Firefox (CVSS 4.3)
- [CVE-2013-1054](https://cve.now/CVE-2013-1054.md): Possible remote DOS in WebApps (CVSS 4.3)
- [CVE-2020-16119](https://cve.now/CVE-2020-16119.md): DCCP CCID structure use-after-free (CVSS 6.3)
- [CVE-2013-1053](https://cve.now/CVE-2013-1053.md): Insecure crypto for storing passwords (CVSS 5.5)
- [CVE-2020-27351](https://cve.now/CVE-2020-27351.md): Various memory and file descriptor leaks in apt-python (CVSS 2.0)
- [CVE-2020-27350](https://cve.now/CVE-2020-27350.md): apt integer wraparound (CVSS 5.7)
- [CVE-2020-27349](https://cve.now/CVE-2020-27349.md): aptdaemon performed policykit permissions checks too late (no CVSS)
- [CVE-2020-16128](https://cve.now/CVE-2020-16128.md): Aptdaemon error messages disclosed file existence to unprivileged users via dbus properties (CVSS 3.8)
- [CVE-2020-27348](https://cve.now/CVE-2020-27348.md): snapcraft may build snaps with incorrect LD\_LIBRARY\_PATH (CVSS 6.8)
- [CVE-2020-16123](https://cve.now/CVE-2020-16123.md): Bypass of snapd pulseaudio restrictions (CVSS 4.4)
- [CVE-2012-0955](https://cve.now/CVE-2012-0955.md): software-properties incorrectly validated TLS certificates (CVSS 6.8)
- [CVE-2020-15710](https://cve.now/CVE-2020-15710.md): Potential double-free in pulseaudio (CVSS 5.3)
- [CVE-2020-15703](https://cve.now/CVE-2020-15703.md): aptdaemon allows unprivileged users to test for the presence of local files via the transaction Locale property (CVSS 4.0)
- [CVE-2014-1420](https://cve.now/CVE-2014-1420.md): Insecure temp file usage in Ubuntu UI toolkit (CVSS 3.8)
- [CVE-2020-15709](https://cve.now/CVE-2020-15709.md): add-apt-repository print ASNI terminal codes (no CVSS)
- [CVE-2020-15704](https://cve.now/CVE-2020-15704.md): pppd arbitrary file read information disclosure vulnerability (CVSS 5.5)
- [CVE-2020-15702](https://cve.now/CVE-2020-15702.md): TOCTOU in apport (CVSS 7.0)
- [CVE-2020-15701](https://cve.now/CVE-2020-15701.md): Unhandled exception in apport (CVSS 5.5)
- [CVE-2020-11937](https://cve.now/CVE-2020-11937.md): Resource exhaustion vulnerability in whoopsie (CVSS 5.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/canonical
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.