CVE Tools
Track your stack

Canonical

8,526 CVEs tracked since 2004. Since Jul 2021, 18 of them reached CISA KEV.

Canonical CVEs per month

Jul 2021 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Canonical CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2021-07220
2021-08151
2021-0942
2021-10170
2021-11110
2021-1290
2022-01192
2022-02181
2022-03452
2022-04150
2022-05170
2022-06120
2022-07150
2022-08290
2022-09260
2022-10220
2022-11280
2022-12540
2023-0170
2023-02130
2023-03no snapshot
2023-04120
2023-05290
2023-06400
2023-07330
2023-08251
2023-09281
2023-10292
2023-11120
2023-1290
2024-01151
2024-02760
2024-03900
2024-041130
2024-054980
2024-06941
2024-071790
2024-081460
2024-091300
2024-102340
2024-111652
2024-122060
2025-011340
2025-023230
2025-03800
2025-04950
2025-052170
2025-061451
2025-071180
2025-08720
2025-091980
2025-102010
2025-11340
2025-121420
2026-01770
2026-025 or fewer
2026-03160
2026-04181
2026-05340
2026-0690
2026-0770
2026-08150
2026-099 or fewer
2026-1011 or fewer
2026-110

Products

The products that kept showing up in Canonical's monthly top three, with their CVEs summed over those months.

  1. Ubuntu4,33158 months
  2. Ubuntu Linux8626 months
  3. Lxd316 months
  4. Juju165 months
  5. Apport156 months
  6. Snapd94 months
  7. Ubuntu 22.04 Lts61 month
  8. Ubuntu 24.04 Lts61 month
  9. Ubuntu 26.04 Lts61 month
  10. Accountsservice54 months

Latest CVEs

The 15 most recently published vulnerabilities affecting Canonical.

  1. CVE-2026-112816Improper certificate validation in the HTTPS listener in LXD—
  2. CVE-2026-93336Missing authorization in the unit resources download route in Juju controllers—
  3. CVE-2026-102631authd: Account takeover via username fallback in identity matching after IdP email reassignment—
  4. CVE-2026-104055Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm—
  5. CVE-2026-12392RPC secret disclosure via vendor data endpoint in Canonical MAAS5.3
  6. CVE-2026-102371wsl-pro-service: Ubuntu Pro token exposed via process command-line arguments—
  7. CVE-2026-87798LXD client recursive file pull allows directory escape via malicious VM agent5.8
  8. CVE-2026-87799Arbitrary file write on LXD host via symlink in migration stream9.9
  9. CVE-2026-97335Incorrect authorization in LXD storage volume API allows reading volumes from other projects7.7
  10. CVE-2026-85185Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root9.6
  11. CVE-2026-85526Path traversal via Btrfs optimized-backup subvolumes[].path enables root file/dir manipulation in LXD9.9
  12. CVE-2026-86335LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse6.3
  13. CVE-2026-86334CLI Path Traversal via Content-Disposition in LXD Image Export/Copy4.2
  14. CVE-2026-66897Instance template path traversal allows arbitrary host file write as root9.9
  15. CVE-2026-55622Incus has a project restriction bypass in instance copy across projects7.7

The record

Peak rank
#1 in Sep 2010
Busiest month shown
May 2024, 498 CVEs
Months with a KEV entry
13 since Jul 2021
Monthly snapshots
231 since 2004
Canonical's full record, month by month