Canonical vulnerabilities
224 CVEs and advisories name Canonical as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-63294Root RCE via image backup.yaml symlink
- CVE-2026-63295Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated`
- CVE-2026-63296Project restriction bypass via instance migration config override
- CVE-2026-63297Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge
- CVE-2026-63298LXD arbitrary lxc.conf directive injection via NVIDIA instance configuration
- CVE-2026-63299Storage volume cross-project move and snapshot restore bypass project disk limits
- CVE-2026-62420Cross-project cluster migration bypasses project restrictions via cluster notification flag
- CVE-2026-63300Cross-project instance move bypasses all project restrictions allowing host command execution
- CVE-2026-8933snap-confine Local Privilege Escalation via Capabilities Misconfiguration or Flaw in Execution Environment Setup
- CVE-2026-15226snapd snap-confine Sandbox Confinement Bypass via Omission of setuid Restriction in Seccomp Templates
- CVE-2024-5300AppArmor Base Profile Misconfiguration in snapd Permits Confined Snaps Unauthorized Access to Hashed Passwords via systemd-userdbd
- CVE-2026-12391ubuntu-pro-client Local Privilege Escalation and Information Disclosure via Symlink Arbitrary File Read in collect-logs
- CVE-2026-11386ubuntu-pro-client Input Validation Vulnerability Leading to Arbitrary APT Directive Injection and Remote Code Execution
- CVE-2026-9494ubuntu-pro-client Information Disclosure via Cleartext Bearer Token Exposure in Process Command Line
- CVE-2026-10037Sandbox Escape in Ubuntu OpenJDK Packages via xdg-desktop-portal
- CVE-2026-28385SSRF via image import from URL allows internal network probing by authenticated users
- CVE-2026-9640LXD Snapshot Import Privilege Escalation Vulnerability
- CVE-2026-9639Authenticated Denial of Service via Malicious Backup Tarball in LXD
- CVE-2026-12411Broken Access Control in Canonical LXD DevLXD API
- CVE-2026-12249Canonical ADSys Trust Store Poisoning via Plaintext HTTP Certificate Auto-Enrollment
- CVE-2026-10720MicroCeph path traversal issue in the remote-import API
- CVE-2026-47337NULL pointer dereference in Ubuntu Linux AppArmor IPv4/IPv6 socket mediation
- CVE-2026-47336Use of uninitialized value in Ubuntu Linux AppArmor IPv4/IPv6 socket mediation rules
- CVE-2026-47335NULL pointer dereference in Ubuntu Linux AppArmor notification handling
- CVE-2026-47334Deadlock or kernel panic in Ubuntu Linux AppArmor notification handling
- CVE-2026-47333Out-of-bounds read in Ubuntu Linux AppArmor notification handling
- CVE-2026-47332Out-of-bounds read in Ubuntu Linux AppArmor notification handling
- CVE-2026-47331Use-after-free in Ubuntu Linux AppArmor notification handling
- CVE-2026-47330Use of uninitialized value in Ubuntu Linux AppArmor notification handling
- CVE-2026-47329Incorrect validation of field size in Ubuntu Linux AppArmor notification responses