Canonical Vulnerabilities and Affected Products
Vulnerabilities associated with Ubuntu 14.04 LTS.
Products
Clear product- LXD30 vulnerabilities
- apport28 vulnerabilities
- Ubuntu Linux13 vulnerabilities
- Juju12 vulnerabilities
- snapd9 vulnerabilities
- Ubuntu 22.04 LTS8 vulnerabilities
- Ubuntu 24.04 LTS8 vulnerabilities
- Ubuntu 20.04 LTS7 vulnerabilities
- Ubuntu 26.04 LTS7 vulnerabilities
- Ubuntu 16.04 LTS6 vulnerabilities
- Ubuntu 18.04 LTS6 vulnerabilities
- ubuntu_linux6 vulnerabilities
- Multipass5 vulnerabilities
- Python-apt4 vulnerabilities
- aptdaemon3 vulnerabilities
- cloud-init3 vulnerabilities
- pulseaudio3 vulnerabilities
- Ubuntu3 vulnerabilities
- ubuntu-pro-client (ubuntu-advantage-tools)3 vulnerabilities
- authd2 vulnerabilities
- Subiquity2 vulnerabilities
- ubantu_kernel2 vulnerabilities
- Ubuntu 14.04 LTS2 vulnerabilities
- Ubuntu Kernel2 vulnerabilities
- unity-firefox-extension2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-11386CRITICAL | ubuntu-pro-client Input Validation Vulnerability Leading to Arbitrary APT Directive Injection and Remote Code ExecutionAn input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, … CWE-20Jul 16, 2026 | CVSS9.0v3.1 | EPSS0.342% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-9494MEDIUM | ubuntu-pro-client Information Disclosure via Cleartext Bearer Token Exposure in Process Command LineAn information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:<token>@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc fil… CWE-214Jul 16, 2026 | CVSS5.5v3.1 | EPSS0.113% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |