Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24 results
Oct 22, 2026Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a CVE-2026-93336 · Other software · Canonical · reported by security@ubuntu.comHigh 7.1
Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a user with only login permission) to read any application's charm resource in any model, including container-registry credentials, via a crafted request naming an arbitrary unit.
- Product
- Juju
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026Improper synchronization of the userTokens map in the API server in Canonical Juju 4.0.5, 3.6.20, and 2.9.56 may allow an authenticated user to possibly cause aCVE-2026-5774 · Other software · Canonical · reported by security@ubuntu.comMedium 6
Improper synchronization of the userTokens map in the API server in Canonical Juju 4.0.5, 3.6.20, and 2.9.56 may allow an authenticated user to possibly cause a denial of service on the server or possibly reuse a single-use discharge token.
- Product
- Juju
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade.CVE-2026-5412 · Other software · Canonical · reported by security@ubuntu.comCritical 9.9
In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privileged user to access sensitive credentials. This issue is resolved in Juju versions 2.9.57 and 3.6.21.
- Product
- Juju
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators callCVE-2025-68153 · Other software · juju · reported by GitHubHigh 7.1
Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, any authenticated user, machine or controller under a Juju controller can modify the resources of an application within the entire controller. This issue has been patched in versions 2.9.56 and 3.6.19.
- Product
- juju
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators callCVE-2025-68152 · Other software · juju · reported by GitHubMedium 6.9
Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, it is possible that a compromised workload machine under a Juju controller can read any log file for any entity in any model at any level. This issue has been patched in versions 2.9.56 and 3.6.19.
- Product
- juju
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the internal Dqlite database cluster fails to perCVE-2026-4370 · Other software · Canonical · reported by security@ubuntu.comCritical 10
A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the internal Dqlite database cluster fails to perform proper TLS client and server authentication. Specifically, the Juju controller's database endpoint does not validate client certificates when a new node attempts to join the cluster. An unauthenticated attacker with network reachability to the Juju controller's Dqlite port can exploit this flaw to join the database cluster. Once joined, the attacker gains full read and write access to the underlying database, allowing for total data compromise.
- Product
- Juju
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusively on a predictableCVE-2026-32694 · Other software · Canonical · reported by security@ubuntu.comMedium 6.6
In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusively on a predictable XID of the secret to verify ownership. This allows a malicious grantee which can request secrets to predict past secrets granted by the same secret owner to different grantees, allowing them to use the resources granted by those past secrets. Successful exploitation relies on a very specific configuration, specific data semantic, and the administrator having the need to deploy at least two different applications, one of them controlled by the attacker.
- Product
- Juju
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which allows a grantee to update the secret coCVE-2026-32693 · Other software · Canonical · reported by security@ubuntu.comHigh 8.8
In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which allows a grantee to update the secret content, and can lead to reading or updating other secrets. When the "secret-set" tool logs an error in an exploitation attempt, the secret is still updated contrary to expectations, and the new value is visible to both the owner and the grantee.
- Product
- Juju
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 through 3.6.18 allows an authenticated unit agent to pCVE-2026-32692 · Other software · Canonical · reported by security@ubuntu.comHigh 7.6
An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 through 3.6.18 allows an authenticated unit agent to perform unauthorized updates to secret revisions. With sufficient information, an attacker can poison any existing secret revision within the scope of that Vault secret back-end.
- Product
- Juju
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026A race condition in the secrets management subsystem of Juju versions 3.0.0 through 3.6.18 allows an authenticated unit agent to claim ownership of a newly initCVE-2026-32691 · Other software · Canonical · reported by security@ubuntu.comMedium 5.3
A race condition in the secrets management subsystem of Juju versions 3.0.0 through 3.6.18 allows an authenticated unit agent to claim ownership of a newly initialized secret. Between generating a Juju Secret ID and creating the secret's first revision, an attacker authenticated as another unit agent can claim ownership of a known secret. This leads to the attacking unit being able to read the content of the initial secret revision.
- Product
- Juju
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026Vulnerable cross-model authorization in juju.CVE-2026-1237 · Other software · Canonical · reported by security@ubuntu.comLow 2.1
Vulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to update database records can mint an invalid macaroon that is incorrectly validated by the juju controller, enabling a charm to maintain otherwise revoked or expired permissions. This allows a charm to continue relating to another charm in a cross-model relation, and use their workload without their permission. No fix is available as of the time of writing.
- Product
- juju
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025In Juju versions prior to 3.6.8 and 2.9.52, any authenticated controller user was allowed to upload arbitrary agent binaries to any model or to the controller iCVE-2025-0928 · Other software · Canonical · reported by security@ubuntu.comHigh 8.8
In Juju versions prior to 3.6.8 and 2.9.52, any authenticated controller user was allowed to upload arbitrary agent binaries to any model or to the controller itself, without verifying model membership or requiring explicit permissions. This enabled the distribution of poisoned binaries to new or upgraded machines, potentially resulting in remote code execution.
- Product
- Juju
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upload a charm.CVE-2025-53513 · Other software · Canonical · reported by security@ubuntu.comHigh 8.8
The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upload a charm. Uploading a malicious charm that exploits a Zip Slip vulnerability could allow an attacker to gain access to a machine running a unit through the affected charm.
- Product
- Juju
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that could contain sensitiveCVE-2025-53512 · Other software · Canonical · reported by security@ubuntu.comMedium 6.5
The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that could contain sensitive information.
- Product
- Juju
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2025Certificate generation in juju/utils using the cert.NewLeaf function could include private information.CVE-2025-6224 · Other software · Canonical · reported by security@ubuntu.comMedium 6.5
Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it.
- Product
- Juju utils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's filesCVE-2023-0092 · Other software · Canonical Ltd. · reported by security@ubuntu.comMedium 4.9
An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's filesystem.
- Product
- Juju
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2024jj, or Jujutsu, is a Git-compatible VCS written in rust.CVE-2024-51990 · Other software · martinvonz · reported by GitHubCritical 9.3
jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause `jj` to write files outside the clone. This issue has been addressed in version 0.23.0. Users are advised to upgrade. Users unable to upgrade should avoid cloning repos from unknown sources.
- Product
- jj
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2024Vulnerable juju introspection abstract UNIX domain socket.CVE-2024-8038 · Other software · Canonical Ltd. · reported by security@ubuntu.comHigh 7.9
Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication locally to network namespace users. This enables denial of service attacks.
- Product
- Juju
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2024Vulnerable juju hook tool abstract UNIX domain socket.CVE-2024-8037 · Other software · Canonical Ltd. · reported by security@ubuntu.comMedium 6.5
Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with access to the default network namespace may connect to the @/var/lib/juju/agents/unit-xxxx-yyyy/agent.socket and perform actions that are normally reserved to a juju charm.
- Product
- Juju
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2024JUJU_CONTEXT_ID is a predictable authentication secret.CVE-2024-7558 · Other software · Canonical Ltd. · reported by security@ubuntu.comHigh 8.7
JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the Juju charm.
- Product
- Juju
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2024An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive dataCVE-2024-6984 · Other software · Canonical Ltd. · reported by security@ubuntu.comHigh 8.8
An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm.
- Product
- Juju
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2023A vulnerability was found in juju2143 WalrusIRC 0.0.2.CVE-2015-10079 · Other software · juju2143 · reported by VulDBLow 3.5
A vulnerability was found in juju2143 WalrusIRC 0.0.2. It has been rated as problematic. This issue affects the function parseLinks of the file public/parser.js. The manipulation of the argument text leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 0.0.3 is able to address this issue. The patch is named 45fd885895ae13e8d9b3a71e89d59768914f60af. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220751.
- Product
- WalrusIRC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2019Juju Core's Joyent provider before version 1.25.5 uploads the user's private ssh key.CVE-2015-1316 · Other software · Ubuntu · reported by security@ubuntu.comMedium 6.4
Juju Core's Joyent provider before version 1.25.5 uploads the user's private ssh key.
- Product
- Juju
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbazaar.launchpad.netbazaar.launchpad.net
May 27, 2017Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalationCVE-2017-9232 · Other software · Canonical · reported by MITRECritical 9.8
Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.
- Product
- Juju
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.combugs.launchpad.net
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.