ubuntu has 3 CVEs on record between 2025 and 2026. The median CVSS is 5.5 (medium), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.5
- Publish → KEV
- —
- Last 90 days
- 0 prev 1
Products
- github.com/ubuntu/adsys 1
- libefiboot 1
- python-apt 1
3
Total CVEs
1
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-12249Critical· 9.0Canonical ADSys Uses a Less Trusted Source50CVE-2026-6862Medium· 5.5A flaw was found in libefiboot, a component of efivar30CVE-2025-6966Medium· 5.5NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.30
ubuntu vulnerabilities
CVEs affecting ubuntu, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-12249Critical· 9.0Canonical ADSys Uses a Less Trusted Source
Canonical ADSys Uses a Less Trusted Source
▾ Midnightubuntu · github.com/ubuntu/adsysEPSS 0.14%via OSV
CVE-2026-6862Medium· 5.5A flaw was found in libefiboot, a component of efivar
A flaw was found in libefiboot, a component of efivar. The device path node parser in libefiboot fails to validate that each node's Length field is at least 4 bytes, which is the minimum size for an EFI (Extensible Firmware Interface) de…
▾ Sunlitubuntu · libefibootEPSS 0.12%via NVD
CVE-2025-6966Medium· 5.5NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.
NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.
▾ Sunlitubuntu · python-aptEPSS 0.14%via NVD