Ubuntu security vulnerabilities
Ubuntu package CVEs and security updates with links back to Canonical and merged public catalogs.
Built for Linux administrators and DevOps.
222 public records · 138 security-fix timeline events.
Version-specific security
High-intent pages for “Ubuntu {version} security vulnerabilities” queries.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 2
- High 24
- Medium 5
- Low 0
2026-07-2131 issues2026-10-18
Known exploited
View all known exploitedRecently published
Browse catalog- Medium5.3kin-openapi is a Go project for handling OpenAPI files.Check if you run itEPSS 0.52%Oct 15, 2026
- High7.8In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.Check if you run itEPSS 0.15%Oct 7, 2026
- Medium6.5In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.Check if you run itEPSS 0.19%Oct 6, 2026
- High7.1In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short beacon and probe responses libipw_process_probe_response() and the libipw_networkCheck if you run itEPSS 0.26%Oct 6, 2026
- High7.5In the Linux kernel, the following vulnerability has been resolved: smb: client: fix rlist race and missing initialization TCP_Server_Info.rlist is allocated via kzalloc which zeroCheck if you run itEPSS 0.36%Oct 6, 2026
- High8.8Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a dirCheck if you run itEPSS 0.44%Oct 1, 2026
- High7.5Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi respCheck if you run itEPSS 0.50%Oct 1, 2026
- High7.5A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of seCheck if you run itEPSS 0.48%Oct 1, 2026
- High7.5Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of serviceCheck if you run itEPSS 0.88%Oct 1, 2026
- High7.5Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configuratiCheck if you run itEPSS 0.47%Oct 1, 2026