Filtered by vendor Canonical
Subscribe
Total
4303 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-32693 | 1 Canonical | 1 Juju | 2026-06-17 | N/A | 8.8 HIGH |
| In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which allows a grantee to update the secret content, and can lead to reading or updating other secrets. When the "secret-set" tool logs an error in an exploitation attempt, the secret is still updated contrary to expectations, and the new value is visible to both the owner and the grantee. | |||||
| CVE-2026-32692 | 1 Canonical | 1 Juju | 2026-06-17 | N/A | 7.6 HIGH |
| An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 through 3.6.18 allows an authenticated unit agent to perform unauthorized updates to secret revisions. With sufficient information, an attacker can poison any existing secret revision within the scope of that Vault secret back-end. | |||||
| CVE-2026-32691 | 1 Canonical | 1 Juju | 2026-06-17 | N/A | 5.3 MEDIUM |
| A race condition in the secrets management subsystem of Juju versions 3.0.0 through 3.6.18 allows an authenticated unit agent to claim ownership of a newly initialized secret. Between generating a Juju Secret ID and creating the secret's first revision, an attacker authenticated as another unit agent can claim ownership of a known secret. This leads to the attacking unit being able to read the content of the initial secret revision. | |||||
| CVE-2025-7044 | 1 Canonical | 1 Maas | 2026-06-17 | N/A | 7.7 HIGH |
| An Improper Input Validation vulnerability exists in the user websocket handler of MAAS. An authenticated, unprivileged attacker can intercept a user.update websocket request and inject the is_superuser property set to true. The server improperly validates this input, allowing the attacker to self-promote to an administrator role. This results in full administrative control over the MAAS deployment. | |||||
| CVE-2025-6966 | 3 Canonical, Debian, Ubuntu | 3 Ubuntu Linux, Debian Linux, Python-apt | 2026-06-17 | N/A | 5.5 MEDIUM |
| NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key. | |||||
| CVE-2025-6224 | 1 Canonical | 1 Juju\/utils | 2026-06-17 | N/A | 6.5 MEDIUM |
| Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it. | |||||
| CVE-2025-5689 | 1 Canonical | 1 Authd | 2026-06-17 | N/A | 8.5 HIGH |
| A flaw was found in the temporary user record that authd uses in the pre-auth NSS. As a result, a user login for the first time will be considered to be part of the root group in the context of that SSH session. | |||||
| CVE-2025-5467 | 1 Canonical | 1 Apport | 2026-06-17 | N/A | 3.3 LOW |
| It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups. | |||||
| CVE-2025-5199 | 2 Apple, Canonical | 2 Macos, Multipass | 2026-06-17 | N/A | 7.3 HIGH |
| In Canonical Multipass up to and including version 1.15.1 on macOS, incorrect default permissions allow a local attacker to escalate privileges by modifying files executed with administrative privileges by a Launch Daemon during system startup. | |||||
| CVE-2025-5054 | 1 Canonical | 2 Apport, Ubuntu Linux | 2026-06-17 | N/A | 4.7 MEDIUM |
| Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces. When handling a crash, the function `_check_global_pid_and_forward`, which detects if the crashing process resided in a container, was being called before `consistency_checks`, which attempts to detect if the crashing process had been replaced. Because of this, if a process crashed and was quickly replaced with a containerized one, apport could be made to forward the core dump to the container, potentially leaking sensitive information. `consistency_checks` is now being called before `_check_global_pid_and_forward`. Additionally, given that the PID-reuse race condition cannot be reliably detected from userspace alone, crashes are only forwarded to containers if the kernel provided a pidfd, or if the crashing process was unprivileged (i.e., if dump mode == 1). | |||||
| CVE-2025-54293 | 2 Canonical, Linux | 2 Lxd, Linux Kernel | 2026-06-17 | N/A | 6.5 MEDIUM |
| Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host system via crafted log file names or symbolic links. | |||||
| CVE-2025-54292 | 1 Canonical | 1 Lxd | 2026-06-17 | N/A | 4.6 MEDIUM |
| Path traversal in Canonical LXD LXD-UI versions before 6.5 and 5.21.4 on all platforms allows remote authenticated attackers to access or modify unintended resources via crafted resource names embedded in URL paths. | |||||
| CVE-2025-54291 | 1 Canonical | 1 Lxd | 2026-06-17 | N/A | 5.3 MEDIUM |
| Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses. | |||||
| CVE-2025-54290 | 2 Canonical, Linux | 2 Lxd, Linux Kernel | 2026-06-17 | N/A | 5.3 MEDIUM |
| Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints. | |||||
| CVE-2025-54289 | 1 Canonical | 1 Lxd | 2026-06-17 | N/A | 8.1 HIGH |
| Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format | |||||
| CVE-2025-54288 | 2 Canonical, Linux | 2 Lxd, Linux Kernel | 2026-06-17 | N/A | 6.8 MEDIUM |
| Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attackers with root privileges within any container to impersonate other containers and obtain their metadata, configuration, and device information via spoofed process names in the command line. | |||||
| CVE-2025-54287 | 2 Canonical, Linux | 2 Lxd, Linux Kernel | 2026-06-17 | N/A | 6.5 MEDIUM |
| Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration permissions to read arbitrary files on the host system via specially crafted snapshot pattern templates using the Pongo2 template engine. | |||||
| CVE-2025-54286 | 2 Canonical, Linux | 2 Lxd, Linux Kernel | 2026-06-17 | N/A | 8.8 HIGH |
| Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and start container instances without user consent via crafted HTML form submissions exploiting client certificate authentication. | |||||
| CVE-2025-53513 | 1 Canonical | 1 Juju | 2026-06-17 | N/A | 8.8 HIGH |
| The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upload a charm. Uploading a malicious charm that exploits a Zip Slip vulnerability could allow an attacker to gain access to a machine running a unit through the affected charm. | |||||
| CVE-2025-53512 | 1 Canonical | 1 Juju | 2026-06-17 | N/A | 6.5 MEDIUM |
| The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that could contain sensitive information. | |||||