Canonical
Number 84 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Combines these spellings from source records: Canonical, canonical
Total vulnerabilities
216
Critical
24
High
77
Known Exploited
0
Exploit available
0
Network, no login needed
11.7%
Of 213 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 76 | 19 | 23 | 25 | 9 | 0 |
| 2025 | 27 | 2 | 11 | 12 | 2 | 0 |
| 2024 | 34 | 1 | 15 | 16 | 2 | 0 |
| 2023 | 14 | 2 | 4 | 8 | 0 | 0 |
| 2022 | 4 | 0 | 3 | 0 | 1 | 0 |
| 2021 | 22 | 0 | 14 | 7 | 1 | 0 |
| 2020 | 35 | 0 | 6 | 19 | 8 | 2 |
| 2019 | 2 | 0 | 1 | 1 | 0 | 0 |
| 2018 | 2 | 0 | 0 | 1 | 0 | 1 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| LXD | 33 | 21 |
| apport | 25 | 15 |
| Apport | 16 | 6 |
| Juju | 16 | 10 |
| snapd | 14 | 9 |
| Ubuntu Linux | 13 | 3 |
| lxd | 7 | 5 |
| cloud-init | 6 | 1 |
| Multipass | 5 | 5 |
| Landscape | 3 | 1 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Information Disclosure | 15 | 2 |
| Improper Link Resolution Before File Access ('Link Following') | 14 | 12 |
| Memory Corruption | 14 | 4 |
| Path Traversal | 12 | 7 |
| Improper Input Validation | 11 | 9 |
| Race Condition | 9 | 5 |
| Incorrect Authorization | 8 | 7 |
| Authentication Issues | 6 | 3 |
| Incorrect Permissions | 6 | 2 |
| Missing Authorization | 5 | 2 |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-86692 | apport: Arbitrary file creation or overwrite via path traversal in base64-encoded problem report keys | Medium | 0.2% | |
| CVE-2026-84410 | apport: Local privilege escalation to root via ldd execution on an attacker-controlled ExecutablePath in automatic crash report processing | High | 0.1% | |
| CVE-2026-112816 | Improper certificate validation in the HTTPS listener in LXD | Critical | 0.3% | |
| CVE-2026-93336 | Missing authorization in the unit resources download route in Juju controllers | High | 0.2% | |
| CVE-2026-102631 | authd: Account takeover via username fallback in identity matching after IdP email reassignment | Medium | 0.1% | |
| CVE-2026-12392 | RPC secret disclosure via vendor data endpoint in Canonical MAAS | Medium | 0.3% | |
| CVE-2026-104055 | Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm | Medium | 0.3% | |
| CVE-2026-102371 | wsl-pro-service: Ubuntu Pro token exposed via process command-line arguments | Medium | 0.1% | |
| CVE-2026-97335 | Incorrect authorization in LXD storage volume API allows reading volumes from other projects | High | 0.2% | |
| CVE-2026-87799 | Arbitrary file write on LXD host via symlink in migration stream | Critical | 0.4% |