Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 09:05 UTC

Critical in the last 24 hours

1601 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

185-69% vs 7-day avg of 598

2 critical, 69 high, 71 medium, 33 low

Expand	Severity	Score	Advisory	Title	Source	Published
	High	7.1	CVE-2026-93336	Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a user with only... CanonicalCanonical Juju	NVD	Oct 22 18:17 UTC
CVE-2026-93336Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a user with only... Executive summary A missing authorization check in the unit resources download route of Canonical Juju 4.0 through 4.0.15 lets any user who can log in to the controller, or a unit agent acting for another unit, download a unit's resource. The advisory does not state a severity score. The advisory does not state a vendor recommendation or a fixed version; the attached change restricts the route to unit and application agents and checks that the unit in the URL matches the caller. Technical summary The flaw is a missing authorization check, classed in the advisory as CWE-style missing authorization, in the GET /model/:modeluuid/units/:unit/resources/:resource route. The route was registered with an always-allow authorizer and its opener getter dropped the tag kinds, so any authenticated controller principal, including a user with only login access, could stream a resource and have SetUnitResource recorded against the named unit. Exploitation needs only valid controller credentials and knowledge of a unit name in the model. The discussion describes a fix that limits the route to unit and application agents and binds the URL unit to the authenticated agent, but the fixed Juju version is not stated in the advisory. No workaround is stated, no CVSS score is stated, and no exploitation in the wild is stated. Detection guidance is not stated as such, although the discussion includes curl test requests that return 403 after the fix. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/juju/juju/pull/23360 Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Canonical Canonical Juju NIST National Vulnerability DatabasePublished Oct 22, 2026 18:17 UTC Read the advisory
	Medium	5.9	CVE-2026-102631	In authd before 0.7.1, the user identity matching in UpdateUser (internal/users/manager.go) resolves an incoming login by the broker-scoped provider ID, but falls back to... CanonicalCanonical authd	NVD	Oct 15 17:17 UTC
CVE-2026-102631In authd before 0.7.1, the user identity matching in UpdateUser (internal/users/manager.go) resolves an incoming login by the broker-scoped provider ID, but falls back to... From the advisory In authd before 0.7.1, the user identity matching in UpdateUser (internal/users/manager.go) resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when the provider ID does not belong to any known user, and does not reject a conflicting non-empty provider ID. If an identity provider reassigns an email address, which authd uses as the username, to a new account, the new account inherits the previous user's local UID and home directory on its next login. This allows the new user to access and modify files belonging to the previous user, including credentials such as SSH keys and cloud API tokens, and silently rebinds the local account record to the new identity. As a mitigation, administrators should lock or delete the previous user's local authd account when the corresponding IdP account is removed. Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Local Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Canonical Canonical authd NIST National Vulnerability DatabasePublished Oct 15, 2026 17:17 UTC Read the advisory
	Medium	5.3	CVE-2026-104055	The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated "monitoring" PostgreSQL user CanonicalCanonical postgresql-operator	NVD	Oct 2 21:16 UTC
CVE-2026-104055The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated "monitoring" PostgreSQL user From the advisory The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover the password, which grants read-only pg_monitor access to PostgreSQL. This is fixed in the dev track (14/edge) in revisions 1189 (arm64) and 1190 (amd64), and in the stable track (14/stable) in revisions 1216 (arm64) and 1217 (amd64). Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Canonical Canonical postgresql-operator NIST National Vulnerability DatabasePublished Oct 2, 2026 21:16 UTC Read the advisory
	Medium	5.3	CVE-2026-12392	An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret... CanonicalCanonical MAAS	NVD	Oct 2 20:17 UTC
CVE-2026-12392An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret... From the advisory An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option enabled, an attacker who obtains or infers the machine's system ID can query the preseed/metadata server to leak the secret. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affects Canonical Canonical MAAS NIST National Vulnerability DatabasePublished Oct 2, 2026 20:17 UTC Read the advisory
	Medium	5.7	CVE-2026-102371	In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with... CanonicalCanonical Ubuntu Pro for WSL	NVD	Sep 29 15:17 UTC
CVE-2026-102371In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with... From the advisory In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument (pro attach <token>). On systems where /proc is mounted without process-hiding mitigations (such as hidepid), which is the default in WSL, an unprivileged local user or process in the same WSL instance can read the token from /proc/<pid>/cmdline while the attach process is running. The leaked token could then be used to attach other machines to the victim's Ubuntu Pro subscription and gain unauthorized access to Ubuntu Pro services. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Canonical Canonical Ubuntu Pro for WSL NIST National Vulnerability DatabasePublished Sep 29, 2026 15:17 UTC Read the advisory
	High	7.7	CVE-2026-97335	Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 and 6.10) on Linux allows an... CanonicalCanonical LXD	NVD	Sep 28 14:17 UTC
CVE-2026-97335Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 and 6.10) on Linux allows an... From the advisory Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create custom volumes in a project to copy, and so read, any custom storage volume from any other project on the server, including its snapshots and configuration. The client does this with a crafted request that sets a source volume and source.project but omits source.type. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Affects Canonical Canonical LXD NIST National Vulnerability DatabasePublished Sep 28, 2026 14:17 UTC Read the advisory
	Critical	9.9	CVE-2026-87799	Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated... CanonicalCanonical LXD	NVD	Sep 28 14:17 UTC
CVE-2026-87799Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated... From the advisory Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client that can create instances or custom storage volumes in a project, or a malicious migration source server, to write attacker-controlled files to arbitrary paths on the target host as root, leading to full host compromise. The attacker does this with a crafted rsync or btrfs send stream that plants a symlink in the transferred volume, such as rootfs or root.img, and then writes through it. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Affects Canonical Canonical LXD NIST National Vulnerability DatabasePublished Sep 28, 2026 14:17 UTC Read the advisory
	Medium	5.8	CVE-2026-87798	Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 (fixed in 4.0.14, 5.0.10 and 5.21.8) on Linux allows... CanonicalCanonical LXD	NVD	Sep 28 14:17 UTC
CVE-2026-87798Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 (fixed in 4.0.14, 5.0.10 and 5.21.8) on Linux allows... From the advisory Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 (fixed in 4.0.14, 5.0.10 and 5.21.8) on Linux allows an attacker with root access inside a virtual machine to write attacker-controlled files or directory trees to arbitrary paths on the client host, with the operator's privileges. The attacker does this by using a modified lxd-agent that returns inconsistent SFTP directory listings and Lstat results. Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required Low User interaction Required Scope Changed CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N Affects Canonical Canonical LXD NIST National Vulnerability DatabasePublished Sep 28, 2026 14:17 UTC Read the advisory
	Medium	6.3	CVE-2026-86335	Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects... CanonicalCanonical LXD	NVD	Sep 28 14:17 UTC
CVE-2026-86335Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects... From the advisory Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Affects Canonical Canonical LXD NIST National Vulnerability DatabasePublished Sep 28, 2026 14:17 UTC Read the advisory
	Medium	4.2	CVE-2026-86334	Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote... CanonicalCanonical LXD	NVD	Sep 28 14:17 UTC
CVE-2026-86334Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote... From the advisory Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle image server to overwrite arbitrary local files and execute code on the client system via a crafted Content-Disposition header filename parameter during unified image export or copy operations into a local directory target. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L Affects Canonical Canonical LXD NIST National Vulnerability DatabasePublished Sep 28, 2026 14:17 UTC Read the advisory
	Critical	9.9	CVE-2026-85526	Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace... CanonicalCanonical LXD	NVD	Sep 28 14:17 UTC
CVE-2026-85526Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace... From the advisory Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes[].path entry in backup/optimized_header.yaml during a btrfs optimized backup import. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Affects Canonical Canonical LXD NIST National Vulnerability DatabasePublished Sep 28, 2026 14:17 UTC Read the advisory
	Critical	9.6	CVE-2026-85185	Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with... CanonicalCanonical LXD	NVD	Sep 28 14:17 UTC
CVE-2026-85185Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with... From the advisory Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is btrfs, the client can also place attacker-controlled content at arbitrary host paths, leading to full host compromise. The client does this with a crafted subvolume path containing ../ sequences, sent in either of two ways: in the optimized_header.yaml of an optimized btrfs backup, or in the btrfs migration header sent by a malicious migration source. Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H Affects Canonical Canonical LXD NIST National Vulnerability DatabasePublished Sep 28, 2026 14:17 UTC Read the advisory
	High	7.4	USN-8954-1	zlib vulnerability Canonical, zlibCanonical Ubuntu Linux, zlib, Canonical Ubuntu	Ubuntu Security Notices	Oct 22 19:54 UTC
USN-8954-1CVE-2026-85091zlib vulnerability Executive summary A flaw in zlib, a widely used data-compression library in Ubuntu, could let an attacker crash programs or possibly run code if they supply specially crafted input. The advisory does not give a severity rating, but it describes the impact as denial of service or arbitrary code execution. Canonical recommends applying the standard system update, which contains fixed zlib package versions for Ubuntu 26.10, 26.04 LTS, and 24.04 LTS. Technical summary The advisory describes a heap buffer overflow in zlib triggered through certain non-blocking write operations, reported by Ali Firas. An attacker could possibly exploit it to cause denial of service or arbitrary code execution, and the advisory does not state the required attack preconditions. The fixed packages are 1:1.3.dfsg+really1.3.2-3ubuntu1.1 for 26.10, 1:1.3.dfsg+really1.3.1-1ubuntu3.2 for 26.04 LTS, and 1:1.3.dfsg-3.1ubuntu2.3 for 24.04 LTS, covering zlib1g, zlib1g-dev, and related lib32z1, lib64z1, and libx32z1 packages. The advisory references CVE-2026-85091. No workaround, CVSS score, or exploitation-in-the-wild information is stated, and no detection guidance is provided. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from ubuntu.com/security/notices/USN-8954-1 Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H Affects Canonical zlib Canonical Ubuntu Linux zlib Canonical Ubuntu Canonical Ubuntu Security TeamPublished Oct 22, 2026 19:54 UTC Read the advisory
	Medium	n/a	USN-8953-1	OpenVPN vulnerability Canonical, OpenVPNCanonical Ubuntu Linux, OpenVPN, Canonical Ubuntu	Ubuntu Security Notices	Oct 22 15:38 UTC
USN-8953-1CVE-2026-84790OpenVPN vulnerability Executive summary Canonical's Ubuntu Security Team published notice USN-8953-1 about a flaw in OpenVPN, the virtual private network software, which could allow unintended access to network services. The notice says a remote authenticated user could possibly use the issue to impersonate other users. The recommended fix is to update the openvpn package to the fixed version for your Ubuntu release and then restart OpenVPN. Technical summary The flaw is described as OpenVPN incorrectly handling certificate subject fields, which the advisory presents as an impersonation issue exploitable by a remote authenticated user. The advisory does not state a CVSS score, and the attack preconditions beyond remote authentication are not stated. Fixed package versions are listed as openvpn 2.7.7-1ubuntu1.1 for 26.10 (stonking), 2.7.0-1ubuntu1.4 for 26.04 LTS (resolute), 2.6.19-0ubuntu0.24.04.5 for 24.04 LTS (noble), and 2.5.11-0ubuntu0.22.04.6 for 22.04 LTS (jammy). The advisory identifies CVE-2026-84790 and says that a restart of OpenVPN is needed after the update. No workarounds, affected version ranges, or detection guidance are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from ubuntu.com/security/notices/USN-8953-1 Score No CVSS score published. Affects Canonical OpenVPN Canonical Ubuntu Linux OpenVPN Canonical Ubuntu Canonical Ubuntu Security TeamPublished Oct 22, 2026 15:38 UTC Read the advisory
	High	7.5	USN-8952-1	Tornado vulnerabilities Canonical, TornadoCanonical Ubuntu Linux, Canonical python-tornado, Tornado	Ubuntu Security Notices	Oct 22 12:07 UTC
USN-8952-1CVE-2023-54397CVE-2024-14029CVE-2026-103262CVE-2026-1032631 moreTornado vulnerabilities Executive summary Canonical's Ubuntu Security Team published notice USN-8952-1 covering the Tornado Python web framework package (python-tornado) on supported Ubuntu releases. The advisory says the flaws could let an attacker crash the service or expose sensitive information when it receives specially crafted network traffic, and it recommends a standard system update to the fixed package versions. Technical summary The advisory describes flaws in how Tornado handles certain HTTP requests and network inputs, which can lead to denial of service, information exposure, or bypass of access controls. The advisory does not state the specific vulnerability classes, the attack vector details beyond specially crafted network traffic, or whether authentication is required. Fixed package versions are listed per release: python3-tornado 6.5.5-5ubuntu1.1 on 26.10, 6.5.4-0.1ubuntu0.2 on 26.04 LTS, 6.4.0-1ubuntu0.6 on 24.04 LTS, 6.1.0-3ubuntu0.1~esm6 on 22.04 LTS, 6.0.3+really5.1.1-3ubuntu0.1~esm7 on 20.04 LTS, 4.5.3-1ubuntu0.2+esm4 on 18.04 LTS, and 4.2.1-1ubuntu3.1+esm4 on 16.04 LTS. For 22.04, 20.04, 18.04, and 16.04, fixes are available through Ubuntu Pro ESM Apps or the Legacy Support add-on, and a community fix might appear later. No workarounds or detection guidance are stated, and the advisory does not state CVSS scores or exploitation in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from ubuntu.com/security/notices/USN-8952-1 Impact if exploited ConfidentialityLow IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Changed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N Affects Canonical Tornado Canonical Ubuntu Linux Canonical python-tornado Tornado Canonical Ubuntu Security TeamPublished Oct 22, 2026 12:07 UTC Read the advisory
	High	7.6	USN-8890-2	libsoup vulnerabilities Canonical, libsoupCanonical Ubuntu Linux, Canonical Ubuntu, Canonical libsoup3, libsoup	Ubuntu Security Notices	Oct 21 21:36 UTC
USN-8890-2CVE-2026-4271CVE-2026-5119CVE-2026-6324CVE-2026-663393 morelibsoup vulnerabilities Executive summary Several security flaws were fixed in libsoup3, a networking library used by applications on Ubuntu 26.10. The advisory says the issues could allow denial of service, disclosure of sensitive information, security control bypass, or possibly code execution, but it does not give an overall severity rating. Ubuntu recommends updating libsoup3 to the fixed version delivered for Ubuntu 26.10. Technical summary The advisory describes several flaws in libsoup's handling of HTTP/2 requests and transfers, HTTPS proxy connections, chunked HTTP requests, proxy authentication credentials, and HTTP Range headers. Attackers are described as remote, and the advisory says the impacts range from denial of service to information disclosure, security control bypass, and possibly arbitrary code execution for one HTTP/2 connection issue (CVE-2026-85197). The advisory does not state the exact vulnerability classes, CVSS scores, or the specific package version numbers that fix the issues. It also does not state workarounds or detection guidance. The advisory says the fixes apply to libsoup3 on Ubuntu 26.10, and it notes that several issues only affected Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H Affects Canonical libsoup Canonical Ubuntu Linux Canonical Ubuntu Canonical libsoup3 libsoup Canonical Ubuntu Security TeamPublished Oct 21, 2026 21:36 UTC Read the advisory
	High	8.6	USN-8951-1	c-ares vulnerabilities Canonical, c-aresCanonical Ubuntu Linux, c-ares, Canonical Ubuntu	Ubuntu Security Notices	Oct 21 18:20 UTC
USN-8951-1CVE-2020-22217CVE-2022-4904CVE-2026-69184CVE-2026-69186c-ares vulnerabilities Executive summary Canonical's notice USN-8951-1 covers several security flaws in c-ares, a library that performs asynchronous DNS name resolution, on supported Ubuntu releases from 16.04 LTS through 26.04 LTS. The advisory describes the issues as causing denial of service, and some as possibly allowing code execution on older releases. The vendor recommends updating to the fixed c-ares package versions listed in the notice, usually through a standard system update. Technical summary The flaws include incorrect parsing of certain SOA replies (CVE-2020-22217, affecting Ubuntu 16.04 and 18.04 only), mishandling of sortlist strings (CVE-2022-4904, affecting Ubuntu 16.04 only, with the advisory saying it could possibly lead to arbitrary code execution), improper limits on DNS compression pointer hops and assembled name lengths (CVE-2026-69184), and failure to validate record count fields before memory allocation (CVE-2026-69186, affecting Ubuntu 24.04 and 26.04 only). A remote attacker could possibly trigger these issues by sending crafted DNS responses, leading to crashes or excessive resource use. Fixed package versions are stated as libcares2 1.34.6-1ubuntu0.2 for 26.04, libcares2 1.27.0-1.0ubuntu1.1 for 24.04, libc-ares2 1.18.1-1ubuntu0.22.04.4 for 22.04, libc-ares2 1.15.0-1ubuntu0.5+esm1 for 20.04, libc-ares2 1.14.0-1ubuntu0.2+esm3 for 18.04, and libc-ares2 1.10.0-3ubuntu0.2+esm4 for 16.04. No workarounds are stated, and no CVSS scores, exploitation status, or detection guidance are stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from ubuntu.com/security/notices/USN-8951-1 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H Affects Canonical c-ares Canonical Ubuntu Linux c-ares Canonical Ubuntu Canonical Ubuntu Security TeamPublished Oct 21, 2026 18:20 UTC Read the advisory
	Unknown	n/a	USN-8947-1	NSS update CanonicalCanonical Ubuntu Linux	Ubuntu Security Notices	Oct 21 17:40 UTC
USN-8947-1NSS update Executive summary Canonical has released an update to the NSS library on Ubuntu that removes two certificate authority certificates, Technical summary This is a trust store update rather than a memory or code flaw, and the advisory does not name a vulnerability class. The update removes the Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from ubuntu.com/security/notices/USN-8947-1 Score No CVSS score published. Affects Canonical Canonical Ubuntu Linux Canonical Ubuntu Security TeamPublished Oct 21, 2026 17:40 UTC Read the advisory
	Medium	6.5	USN-8950-1	poppler vulnerability Canonical, UbuntuCanonical Ubuntu Linux, Canonical poppler, Ubuntu poppler	Ubuntu Security Notices	Oct 21 16:53 UTC
USN-8950-1CVE-2026-107705poppler vulnerability Executive summary A flaw in poppler, a PDF rendering library used on Ubuntu systems, can cause a crash when a specially crafted or encrypted PDF is opened, which could lead to a denial of service. Ubuntu Security Notice USN-8950-1 covers releases 26.10, 26.04 LTS, 24.04 LTS, and 22.04 LTS. The vendor recommends applying the standard system update that contains the fixed poppler package versions. Technical summary The advisory describes a flaw where poppler incorrectly handled the password length limit when decrypting certain encrypted PDF files, which can cause a crash, classed by the advisory as a denial of service. An attacker would need to get a user or process to open a crafted PDF file; the advisory does not state any further preconditions. Fixed package versions are listed per release: libpoppler162 26.07.0-2ubuntu1.1 for 26.10, libpoppler156 26.01.0-2ubuntu0.3 for 26.04 LTS, libpoppler134 24.02.0-1ubuntu9.11 for 24.04 LTS, and libpoppler118 22.02.0-2ubuntu0.15 for 22.04 LTS. The advisory references CVE-2026-107705. A CVSS score, workaround, and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from ubuntu.com/security/notices/USN-8950-1 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H Affects Canonical Ubuntu Canonical Ubuntu Linux Canonical poppler Ubuntu poppler Canonical Ubuntu Security TeamPublished Oct 21, 2026 16:53 UTC Read the advisory
	High	8.2	USN-8930-2	U-Boot vulnerabilities CanonicalCanonical Ubuntu Linux, Canonical U-Boot	Ubuntu Security Notices	Oct 21 15:57 UTC
USN-8930-2CVE-2026-74220CVE-2026-74221CVE-2026-74222CVE-2026-74225U-Boot vulnerabilities Executive summary Canonical's USN-8930-2 covers several security flaws in U-Boot, the boot loader used on embedded systems, for Ubuntu 26.10. The advisory says the flaws could allow denial of service and, in one case, possibly arbitrary code execution, and it recommends updating to the fixed package versions listed. The advisory does not state a severity rating. Technical summary The advisory describes improper handling of NFS READ and NFS READLINK responses that could cause a buffer overflow (CVE-2026-74220, CVE-2026-74221), which may lead to denial of service or arbitrary code execution. It also describes a use-after-free in the lwIP implementation triggered by HTTP data storage failures (CVE-2026-74222), and out-of-bounds memory access from improperly validated DHCPv6 option lengths during network boot (CVE-2026-74225). The advisory states the fixed package version as 2025.10-0ubuntu6 for u-boot-imx, u-boot-qemu, and u-boot-tools on 26.10. Attack preconditions, workarounds, and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Das U-Boot u-boot-imx Dropped extracted product not named in the source: Das U-Boot u-boot-qemu Dropped extracted product not named in the source: Das U-Boot u-boot-tools Summarized from ubuntu.com/security/notices/USN-8930-2 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H Affects Canonical Canonical Ubuntu Linux Canonical U-Boot Canonical Ubuntu Security TeamPublished Oct 21, 2026 15:57 UTC Read the advisory
	High	7.8	USN-8949-1	Ghostscript vulnerabilities Canonical, GhostscriptCanonical Ubuntu Linux, Canonical Ubuntu, Ghostscript	Ubuntu Security Notices	Oct 21 15:39 UTC
USN-8949-1CVE-2026-101258CVE-2026-103226Ghostscript vulnerabilities Executive summary Several security flaws were fixed in Ghostscript, a widely used tool for reading PostScript and PDF files, and Ubuntu has released updated packages for multiple Ubuntu versions. The advisory says an attacker could exploit these flaws if a user or automated system were tricked into processing a specially crafted file or document, and one flaw could potentially allow code execution after escaping the sandbox. The recommended action is to apply a standard system update that includes the fixed package versions listed in the advisory. Technical summary The advisory describes memory handling errors in Ghostscript when processing PostScript documents and converting certain fonts, plus improper validation of operands when loading fonts. One issue (CVE-2026-101258) could possibly let an attacker bypass the sandbox and execute arbitrary code, another (CVE-2026-103226) could cause a crash or possibly code execution, and a third has no CVE number listed. Exploitation requires that a user or automated system be tricked into processing a specially crafted file or document. Fixed package versions are given for libgs10 and libgs10-common on 26.10 and 26.04 LTS, libgs10 on 24.04 LTS, libgs9 and libgs9-common on 22.04, 20.04, 18.04 and 16.04 LTS, with the exact version strings as written in the advisory. The advisory does not state any workarounds, detection guidance, CVSS scores, or whether the issues are being exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from ubuntu.com/security/notices/USN-8949-1 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Canonical Ghostscript Canonical Ubuntu Linux Canonical Ubuntu Ghostscript Canonical Ubuntu Security TeamPublished Oct 21, 2026 15:39 UTC Read the advisory
	Critical	n/a	USN-8948-2	PHP vulnerabilities Canonical, PHPCanonical Ubuntu Linux, PHP, Canonical Ubuntu	Ubuntu Security Notices	Oct 21 15:33 UTC
USN-8948-2CVE-2026-109618CVE-2026-109619PHP vulnerabilities Executive summary Ubuntu has released updates for PHP on older supported Ubuntu releases (14.04, 16.04, 18.04 and 20.04 LTS). The advisory says the flaws could let a remote attacker crash PHP or run programs through specially crafted network traffic, and it recommends updating PHP to the package versions listed. Technical summary The advisory describes two flaws: CVE-2026-109618, where PHP incorrectly handled out-of-memory conditions while processing requests, and CVE-2026-109619, where PHP incorrectly managed internal request state across worker reuse. Both are described as allowing a remote attacker to execute arbitrary code, and the overview also mentions crashes. The advisory does not state any attack preconditions beyond specially crafted network traffic, nor any workarounds or detection guidance. Fixed package versions are given per release: php7.4 7.4.3-4ubuntu2.29+esm5 on 20.04 LTS, php7.2 7.2.24-0ubuntu0.18.04.17+esm14 on 18.04 LTS, php7.0 7.0.33-0ubuntu0.16.04.16+esm22 on 16.04 LTS, and php5 5.5.9+dfsg-1ubuntu4.29+esm18 on 14.04 LTS. Ubuntu Pro is required for these fixes. The advisory does not state CVSS scores or whether exploitation has been observed. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from ubuntu.com/security/notices/USN-8948-2 Score No CVSS score published. Affects Canonical PHP Canonical Ubuntu Linux PHP Canonical Ubuntu Canonical Ubuntu Security TeamPublished Oct 21, 2026 15:33 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Score

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Score

Affects

Executive summary

Technical summary