Vendor
Canonical vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 68 vulnerabilities in Canonical: 4 in the last 7 days and 22 in the last 90 days, 23 of them critical and 0 exploited in the wild. The most recent, CVE-2026-86692, was published on 9 November 2026. 8 vulnerabilities in the last four weeks, down 20% on the four before (10). 1 critical against 3. 8 technologies have a page of their own.
- Last 7 days
- 4
- Last 90 days
- 22
- Critical, all time
- 23
- Exploited in the wild
- 0
About Canonical
Canonical is the publisher of Ubuntu and a provider of open source software and services.
Canonical technologies
Latest Canonical vulnerabilities
- CVE-2026-86692: apport path traversal in extract_keys via base64-encoded keysinfoEPSS 0.2%
- CVE-2026-84410: apport improper privilege management via ldd DT_AUDIT code executioninfoEPSS 0.1%
- LXD project restriction bypass in instance copyhighCVSS 7.7
- Incus arbitrary file write via trusted image hashcriticalCVSS 9.9
- CVE-2026-109518: APT package manager hard link reuse remote code executionhigh
- CVE-2026-112816: Canonical LXD improper certificate validation in HTTPS listenerinfo
- CVE-2026-115376: Incus authorization bypass in custom volume copyhighCVSS 7.7
- CVE-2026-115374: Incus signature verification bypass in S3 serverhighCVSS 7.1
- CVE-2026-93336: Canonical Juju missing authorization in unit resources downloadinfo
- CVE-2026-102631: authd identity matching privilege escalationinfoEPSS 0.1%
- CVE-2026-104055: Canonical postgresql-operator charm password exposure in logsinfoEPSS 0.3%
- CVE-2026-12392: Canonical MAAS information exposure in metadata endpointmediumCVSS 5.3EPSS 0.3%
- CVE-2026-102371: wsl-pro-service command-line token disclosureinfo
- CVE-2026-97335: Canonical LXD custom storage volume authorization bypasshighCVSS 7.7
- CVE-2026-87799: Canonical LXD arbitrary file write via symlink in migration streamcriticalCVSS 9.9
- CVE-2026-87798: Canonical LXD improper symlink resolution in recursive file pullmediumCVSS 5.8
- CVE-2026-86335: Canonical LXD missing authorization in imageDownloadmediumCVSS 6.3
- CVE-2026-86334: Canonical LXD path traversal in image export and copymediumCVSS 4.2
- CVE-2026-85526: Canonical LXD path traversal in Btrfs storage drivercriticalCVSS 9.9
- CVE-2026-85185: Canonical LXD path traversal in btrfs storage drivercriticalCVSS 9.6
- CVE-2026-66897: Canonical LXD path traversal in instance template processingcriticalCVSS 9.9EPSS 0.7%
- CVE-2026-77113: Canonical Apport path traversal in apport-unpackinfoCVSS 0EPSS 0.2%
- CVE-2026-66898: LXD path traversal in backup restore enables arbitrary file writecriticalCVSS 9.9EPSS 0.6%
- CVE-2026-16033: LXD path traversal in QEMU template processinghighCVSS 8.5EPSS 0.4%
- CVE-2026-13476: IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary commands…highCVSS 7.3EPSS 0.4%
Most severe Canonical vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-4370: Juju has Improper TLS Client/Server authentication and certificate verification on Database ClustercriticalCVSS 10EPSS 0.4%
- CVE-2026-63294: A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During…criticalCVSS 9.9EPSS 0.9%
- CVE-2026-28384: Canonical LXD improper sanitization in compression_algorithm parametercriticalCVSS 9.9EPSS 0.9%
- CVE-2026-66897: Canonical LXD path traversal in instance template processingcriticalCVSS 9.9EPSS 0.7%
- CVE-2026-63298: An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an…criticalCVSS 9.9EPSS 0.7%
- CVE-2026-66898: LXD path traversal in backup restore enables arbitrary file writecriticalCVSS 9.9EPSS 0.6%
- CVE-2026-63299: An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume…criticalCVSS 9.9EPSS 0.6%
- CVE-2026-63293: A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the…criticalCVSS 9.9EPSS 0.6%
- CVE-2026-63300: An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an…criticalCVSS 9.9EPSS 0.5%
- CVE-2026-62420: An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security…criticalCVSS 9.9EPSS 0.5%
Vulnerabilities per week
8 vulnerabilities in the last four weeks, down 20% on the four before (10). 1 critical against 3. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 1 | 0 | |
| 24 Aug 2026 | 1 | 1 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 10 | 3 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 1 | 0 | |
| 19 Oct 2026 | 3 | 0 | |
| 26 Oct 2026 | 1 | 0 | |
| 2 Nov 2026 | 3 | 1 | |
| 9 Nov 2026 | 2 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Canonical vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/canonical)<a href="https://junglewise.ai/threats/vendors/canonical"><img src="https://junglewise.ai/threats/vendors/canonical/badge.svg" alt="Canonical vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/canonical.json, and this page as text at https://junglewise.ai/threats/vendors/canonical.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Canonical vulnerabilities", https://junglewise.ai/threats/vendors/canonical, 13 November 2026.