canonical

Latest CVEs · RSS

• CVE-2026-102631 2026-10-15 · CVSS 5.9
  In authd before 0.7.1, the user identity matching in UpdateUser (internal/users/manager.go) resolves an incoming login by the broker-scoped provider ID, but fal
• CVE-2026-104055 2026-10-02 · CVSS 5.3
  The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connec
• CVE-2026-12392 2026-10-02 · CVSS 5.3
  An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve
• CVE-2026-97876 2026-10-02 · CVSS 6.4
  A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while G
• CVE-2026-102371 2026-09-29 · CVSS 5.7
  In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the
• CVE-2024-42002 2026-09-28 · CVSS 8.6
  A code injection vulnerability has been discovered in the Robot Operating System 2 (ROS 2) 'ros2topic' command-line tool, affecting all ROS 2 distributions from
• CVE-2026-87798 2026-09-28 · CVSS 5.8
  Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 (fixed in 4.0.14, 5.0.10 and 5.21.8)
• CVE-2026-87799 2026-09-28 · CVSS 9.9
  Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an aut
• CVE-2026-97335 2026-09-28 · CVSS 7.7
  Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 and 6.10) on Linux all
• CVE-2026-85185 2026-09-28 · CVSS 9.6
  Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated
• CVE-2026-85526 2026-09-28 · CVSS 9.9
  Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or
• CVE-2026-86335 2026-09-28 · CVSS 6.3
  Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images fro
• CVE-2026-86334 2026-09-28 · CVSS 4.2
  Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows
• CVE-2026-79619 2026-08-26 · CVSS 7.3
  On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host priv
• CVE-2026-66897 2026-08-24 · CVSS 9.9
  A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image,
• CVE-2026-77113 2026-08-20 · CVSS 6.7
  Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with th
• CVE-2026-61898 2026-08-20 · CVSS 7.8
  The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LA
• CVE-2026-61897 2026-08-20 · CVSS 7.8
  An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the eff
• CVE-2026-16033 2026-08-12 · CVSS 8.5
  A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata temp
• CVE-2026-66898 2026-08-12 · CVSS 9.9
  A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restorin
• CVE-2026-63293 2026-08-12 · CVSS 9.9
  A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an
• CVE-2026-63294 2026-08-12 · CVSS 9.9
  A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image o
• CVE-2026-63295 2026-08-12 · CVSS 4.3
  An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is config
• CVE-2026-63296 2026-08-12 · CVSS 9.9
  An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an
• CVE-2026-63297 2026-08-12 · CVSS 9.9
  An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restric