Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High8.4An issue was discovered in Canonical Multipass before version 1.16.3.EPSS 0.4%May 28, 2026
- High7.8An issue was discovered in Canonical Multipass for macOS before version 1.16.3 due to an incomplete fix for CVE-2025-5199.EPSS 0.2%May 28, 2026
- Medium6.9PDFunite 0.41.0 contains a buffer overflow vulnerability that allows local attackers to crash the application by processing malformed PDF files during merge operations.Apr 29, 2026
- Medium5.5A flaw was found in libefiboot, a component of efivar.Apr 22, 2026
- Medium5.7An improper access control vulnerability in the canonical-livepatch snap client prior to version 10.15.0 allows a local unprivileged user to obtain a sensitive, root-l…Apr 20, 2026
- Medium6.0Improper synchronization of the userTokens map in the API server in Canonical Juju 4.0.5, 3.6.20, and 2.9.56 may allow an authenticated user to possibly cause a denial…Apr 10, 2026
- Medium6.5In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade.Apr 10, 2026
- Low2.7In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user credentials during crash reporting.Apr 9, 2026
- Low2.7In Ubuntu, Subiquity version 24.04.4 could leak sensitive user credentials during crash reporting.Apr 9, 2026
- Critical9.1In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH requests t…Apr 9, 2026
- Critical9.1In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the supplied tar archive but creates the instance from…Apr 9, 2026
- Critical9.1Canonical LXD versions 4.12 through 6.7 contain an incomplete denylist in isVMLowLevelOptionForbidden (lxd/project/limits/permissions.go), which omits raw.apparmor and…Apr 9, 2026
- High7.1Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’.Apr 3, 2026
- Medium6.9Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’.Apr 3, 2026
- Unknownlinux-raspi, linux-raspi-realtime vulnerabilitiesApr 1, 2026
- Critical10.0A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the internal Dqlite database cluster fails to perform pr…Apr 1, 2026
- High7.5If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU.Mar 25, 2026
- Unknownlinux-aws-6.8 vulnerabilitiesMar 23, 2026
- Medium6.6In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusively on a predictable XID of…Mar 18, 2026
- High8.8In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which allows a grantee to update the secret content,…Mar 18, 2026
- Medium6.5An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 through 3.6.18 allows an authenticated unit agent to perform…Mar 18, 2026
- Medium5.3A race condition in the secrets management subsystem of Juju versions 3.0.0 through 3.6.18 allows an authenticated unit agent to claim ownership of a newly initialized secret.Mar 18, 2026
- High7.8Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configu…Mar 17, 2026
- Unknownlinux, linux-aws, linux-gcp, linux-gcp-6.8, linux-gke, linux-gkeop, linux-hwe-6.8, linux-ibm, linux-ibm-6.8, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-oracle, linux-oracle-Mar 16, 2026
- Medium6.9Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions.EPSS 1.3%Mar 12, 2026