en
Ubuntu is an open-source Linux operating system produced and maintained by Canonical with community participation. It provides a Debian-based platform for general-purpose computing, servers, cloud workloads, containers, IoT, and enterprise infrastructure, with regular releases, long-term support options, security maintenance, and commercial support.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-6862Efivar: efivar: denial of service due to stack overflow in device path node parsing | Exploitation statusNot known exploited | FixNot confirmed | Affected productRed Hat Hardened Images | Published04/22/2026 | SeverityMedium |
CVE-2026-3497 | Exploitation statusNot known exploited | FixYes | Affected productopenssh | Published03/12/2026 | SeverityLow |
CVE-2025-6966Null-pointer dereference in python-apt TagSection.keys() | Exploitation statusNot known exploited | FixYes | Affected productpython-apt | Published12/05/2025 | SeverityMedium |
CVE-2025-7044Privilege Escalation in MAAS via Websocket Request Manipulation | Exploitation statusNot known exploited | FixYes | Affected productmaas | Published12/03/2025 | SeverityHigh |
CVE-2025-2486UEFI Shell accessible in AAVMF with Secure Boot enabled on Ubuntu | Exploitation statusNot known exploited | FixYes | Affected productedk2 | Published11/26/2025 | SeverityLow |
CVE-2023-0881DDoS in Ubuntu package linux-bluefield | Exploitation statusNot known exploited | FixYes | Affected productUbuntu package linux-bluefield | Published03/31/2025 | SeverityHigh |
CVE-2022-1804Accountsservice incorrectly drops privileges | Exploitation statusNot known exploited | FixYes | Affected productLinux | Published03/25/2025 | SeverityMedium |
CVE-2024-9312 | Exploitation statusNot known exploited | FixYes | Affected productAuthd | Published10/10/2024 | SeverityHigh |
CVE-2024-33263 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published04/26/2024 | SeverityMedium |
CVE-2020-11935aufs: improperly managed inode reference counts in the vfsub_dentry_open() method | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/07/2023 | SeverityMedium |
CVE-2021-3939Free of static data in accountsservice | Exploitation statusNot confirmed | FixYes | Affected productaccountsservice | Published11/17/2021 | SeverityHigh |
CVE-2021-3493 | Exploitation statusKEV | FixYes | Affected productLinux kernel | Published04/17/2021 | SeverityHigh |
CVE-2021-3492Ubuntu linux kernel shiftfs file system double free vulnerability | Exploitation statusNot confirmed | FixYes | Affected productLinux kernel | Published04/17/2021 | SeverityHigh |
CVE-2020-27347tmux stack buffer overflow in function input_csi_dispatch_sgr_colon | Exploitation statusNot confirmed | FixYes | Affected producttmux | Published11/06/2020 | SeverityHigh |
CVE-2020-15708Libvirt Service Arbitrary File Write Privilege Escalation Vulnerability | Exploitation statusNot confirmed | FixYes | Affected productlibvirt | Published11/06/2020 | SeverityCritical |
CVE-2020-15707GRUB2 contained integer overflows when handling the initrd command, leading to a heap-based buffer overflow. | Exploitation statusNot confirmed | FixYes | Affected productgrub2 in Ubuntu | Published07/29/2020 | SeverityMedium |
CVE-2020-15706GRUB2 contains a race condition leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing. | Exploitation statusNot confirmed | FixYes | Affected productgrub2 in Ubuntu | Published07/29/2020 | SeverityMedium |
CVE-2020-15705GRUB2: avoid loading unsigned kernels when GRUB is booted directly under secureboot without shim | Exploitation statusNot confirmed | FixYes | Affected productgrub2 in Ubuntu | Published07/29/2020 | SeverityMedium |
CVE-2014-1423Online Accounts Signon daemon gives out all oauth tokens to any app | Exploitation statusNot confirmed | FixYes | Affected productsignon | Published05/07/2020 | SeverityMedium |
CVE-2019-15794Reference counting error in overlayfs/shiftfs error path when used in conjuction with aufs | Exploitation statusNot confirmed | FixYes | Affected productLinux kernel | Published04/23/2020 | SeverityHigh |
CVE-2019-15793Mishandling of file-system uid/gid with namespaces in shiftfs | Exploitation statusNot confirmed | FixYes | Affected productShiftfs in the Linux kernel | Published04/23/2020 | SeverityMedium |
CVE-2019-15792Type confusion in shiftfs | Exploitation statusNot confirmed | FixYes | Affected productShiftfs in the Linux kernel | Published04/23/2020 | SeverityHigh |
CVE-2019-15791Reference count underflow in shiftfs | Exploitation statusNot confirmed | FixYes | Affected productShiftfs in the Linux kernel | Published04/23/2020 | SeverityHigh |
CVE-2020-8832Ubuntu 18.04 Linux kernel i915 incomplete fix for CVE-2019-14615 | Exploitation statusNot confirmed | FixYes | Affected product18.04 LTS (bionic) Linux kernel | Published04/09/2020 | SeverityMedium |
CVE-2019-15796python-apt downloads from untrusted sources | Exploitation statusNot confirmed | FixYes | Affected productpython-apt | Published03/26/2020 | SeverityMedium |
CVE-2019-15795python-apt uses MD5 for validation | Exploitation statusNot confirmed | FixYes | Affected productpython-apt | Published03/26/2020 | SeverityMedium |
CVE-2012-2092 | Exploitation statusNot confirmed | FixNot confirmed | Affected productCobbler | Published12/06/2019 | SeverityUnknown |
CVE-2019-7307Apport contains a TOCTTOU vulnerability when reading the users ~/.apport-ignore.xml | Exploitation statusNot confirmed | FixNot confirmed | Affected productApport | Published08/29/2019 | SeverityMedium |
CVE-2019-11476Integer overflow in whoopsie results in out-of-bounds heap write | Exploitation statusNot confirmed | FixNot confirmed | Affected productWhoopsie | Published08/29/2019 | SeverityMedium |
CVE-2016-1587 | Exploitation statusNot confirmed | FixYes | Affected productsnapweb | Published04/22/2019 | SeverityHigh |
CVE-2016-1586 | Exploitation statusNot confirmed | FixYes | Affected productOxide | Published04/22/2019 | SeverityLow |
CVE-2016-1584Unity8 converged application lifecycle allows background applications to use on-screen keyboard when not top-most | Exploitation statusNot confirmed | FixNot confirmed | Affected productUnity8 | Published04/22/2019 | SeverityLow |
CVE-2016-1579UDM doesn't check for confinement before running post-processing commands | Exploitation statusNot confirmed | FixYes | Affected productUbuntu Download Manager | Published04/22/2019 | SeverityMedium |
CVE-2016-1573Using a specially crafted fallback art property, scopes can execute arbitrary QML code in context of unity8-dash | Exploitation statusNot confirmed | FixYes | Affected productUnity8 | Published04/22/2019 | SeverityMedium |
CVE-2015-1343unity-scope-gdrive search feature logs search terms to syslog | Exploitation statusNot confirmed | FixNot confirmed | Affected productunity-scope-gdrive | Published04/22/2019 | SeverityLow |
CVE-2015-1341Apport privilege escalation through Python module imports | Exploitation statusNot confirmed | FixYes | Affected productApport | Published04/22/2019 | SeverityHigh |
CVE-2015-1340chmod race in doUidshiftIntoContainer | Exploitation statusNot confirmed | FixYes | Affected productLXD | Published04/22/2019 | SeverityHigh |
CVE-2015-1327Content-hub DBUS API doesn't prevent confined apps from passing paths to files without access | Exploitation statusNot confirmed | FixYes | Affected productContent Hub | Published04/22/2019 | SeverityLow |
CVE-2015-1326python-dbusmock arbitrary code execution or file overwrite when templates are loaded from /tmp | Exploitation statusNot confirmed | FixYes | Affected productpython-dbusmock | Published04/22/2019 | SeverityMedium |
CVE-2015-1320Probe-and-enlist for SeaMicro chassis writes password to the log | Exploitation statusNot confirmed | FixYes | Affected productmaas | Published04/22/2019 | SeverityMedium |
CVE-2015-1316Juju Joyent provider uploads user's private ssh key by default | Exploitation statusNot confirmed | FixYes | Affected productJuju | Published04/22/2019 | SeverityMedium |
CVE-2014-1428uuid.uuid1() is not suitable as an unguessable identifier/token | Exploitation statusNot confirmed | FixYes | Affected productmaas | Published04/22/2019 | SeverityLow |
CVE-2014-1427MAAS API vulnerable to CSRF attack | Exploitation statusNot confirmed | FixYes | Affected productmaas | Published04/22/2019 | SeverityCritical |
CVE-2014-1426get_file_by_name does not check owner | Exploitation statusNot confirmed | FixYes | Affected productmaas | Published04/22/2019 | SeverityHigh |
CVE-2018-6557Insecure temporary file use in base-files | Exploitation statusNot confirmed | FixYes | Affected productbase-files | Published08/21/2018 | SeverityUnknown |
CVE-2017-14461 | Exploitation statusNot confirmed | FixNot confirmed | Affected productdovecot | Published03/02/2018 | SeverityMedium |
CVE-2015-5479 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/19/2016 | SeverityUnknown |
CVE-2015-1322 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/29/2015 | SeverityUnknown |
CVE-2015-2150 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/12/2015 | SeverityUnknown |
CVE-2015-2285 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/12/2015 | SeverityUnknown |
CVE-2014-1424 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published11/24/2014 | SeverityUnknown |
CVE-2013-1070 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/17/2014 | SeverityUnknown |
CVE-2013-1069 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/17/2014 | SeverityUnknown |
CVE-2011-4613 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/05/2014 | SeverityUnknown |
CVE-2013-2186 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/28/2013 | SeverityUnknown |
CVE-2011-1842 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/03/2011 | SeverityUnknown |
CVE-2011-0729 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/29/2011 | SeverityUnknown |
CVE-2011-0724 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/18/2011 | SeverityUnknown |
CVE-2010-0834 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/09/2010 | SeverityUnknown |
CVE-2009-1296 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/09/2009 | SeverityUnknown |
CVE-2009-1601 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/11/2009 | SeverityUnknown |
CVE-2008-6792 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/07/2009 | SeverityUnknown |
CVE-2009-1573 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/06/2009 | SeverityUnknown |
CVE-2009-1295 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/30/2009 | SeverityUnknown |
CVE-2009-0365 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/05/2009 | SeverityUnknown |
CVE-2009-0578 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/05/2009 | SeverityUnknown |
CVE-2008-4395 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published11/06/2008 | SeverityUnknown |
CVE-2008-4306 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published11/04/2008 | SeverityUnknown |
CVE-2008-2285 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/18/2008 | SeverityUnknown |
CVE-2006-7229 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published11/15/2007 | SeverityHigh |
CVE-2007-5365 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published10/11/2007 | SeverityUnknown |
CVE-2007-4601 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/30/2007 | SeverityUnknown |
CVE-2007-1351 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/06/2007 | SeverityUnknown |
CVE-2007-1352 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/06/2007 | SeverityUnknown |
CVE-2006-5649 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published12/14/2006 | SeverityMedium |
CVE-2006-5648 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published12/14/2006 | SeverityMedium |
CVE-2006-6235 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/07/2006 | SeverityUnknown |
CVE-2006-5466 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published11/06/2006 | SeverityUnknown |
CVE-2006-3597 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/14/2006 | SeverityUnknown |
CVE-2006-3378 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/06/2006 | SeverityUnknown |
CVE-2006-1183 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/13/2006 | SeverityUnknown |
CVE-2006-0151 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/09/2006 | SeverityUnknown |
CVE-2005-3625 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/06/2006 | SeverityUnknown |
CVE-2005-3624 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/06/2006 | SeverityUnknown |
CVE-2005-3626 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/06/2006 | SeverityUnknown |
CVE-2005-0106 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/03/2005 | SeverityUnknown |
CVE-2005-0754 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/24/2005 | SeverityUnknown |
CVE-2005-0988 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/06/2005 | SeverityUnknown |
CVE-2005-0750 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/03/2005 | SeverityUnknown |
CVE-2005-0384 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/18/2005 | SeverityUnknown |
CVE-2005-0109 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/08/2005 | SeverityUnknown |
CVE-2005-0206 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/15/2005 | SeverityUnknown |
CVE-2005-0156 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/07/2005 | SeverityUnknown |
CVE-2005-0077 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/29/2005 | SeverityUnknown |
CVE-1999-1572 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/29/2005 | SeverityUnknown |
CVE-2004-1235 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/20/2005 | SeverityUnknown |
CVE-2005-0080 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/19/2005 | SeverityUnknown |
CVE-2004-1337 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/06/2005 | SeverityUnknown |
CVE-2004-1019 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/22/2004 | SeverityUnknown |
CVE-2004-1058 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/22/2004 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
%20Linux%20kernel.svg){kind=icon}
