Ubuntu — Security Activity Report

Canonical Ubuntu (USN advisories)

Generated May 28, 2026Cohort: 3 vendors with ≥10 CVE advisoriesMethodology ↗

CVE Disclosure Volume

Total all-time: 18,310 CVEs with Ubuntu advisories. Source: NVD CVE records joined with vendor advisory publish dates.

Severity Composition

↑ +2.5 pp

42.8% of Ubuntu's 18,310 CVEs are CRITICAL or HIGH severity. Industry median: 40.3%. Source: NVD CVSS v3.1.

CRITICAL 1,601 (8.7%)HIGH 6,228 (34.0%)MEDIUM 7,936 (43.3%)LOW 506 (2.8%)NONE 2,034 (11.1%)

CISA KEV Listings

↓ -0.2 pp

36 of 6,364 Ubuntu CVEs in the last 3 years are on CISA's Known Exploited Vulnerabilities catalog (0.6%). Industry median: 0.7%.

Source: CISA Known Exploited Vulnerabilities catalog (current snapshot). KEV listing means CISA observed active in-the-wild exploitation.

Vendor Patch Velocity

Insufficient data to publish a reliable patch-velocity metric for Ubuntu(sample size: 0, minimum required: 10).

Top Recurring Weakness Classes

Most-frequently mapped CWEs across Ubuntu's last 3 years of CVE disclosures. Source: NVD — CWE mapping per MITRE taxonomy.

CWE-476NULL Pointer Dereference630 CVEs
CWE-416Use After Free514 CVEs
CWE-787Out-of-bounds Write300 CVEs
CWE-125Out-of-bounds Read230 CVEs
CWE-401Missing Release of Memory after Effective Lifetime (Memory Leak)204 CVEs

Data sources & corrections

NVD National Vulnerability Database (nvd.nist.gov) — CVE records + CVSS v3.1 severity
MITRE cvelistV5 (github.com/CVEProject/cvelistV5) — CNA-published CVE timestamps
CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
Vendor security advisories (RHSA, USN, MSRC, GHSA, etc.) — published_at timestamps
MITRE CWE taxonomy (cwe.mitre.org) — weakness class mappings

Snapshot generated May 28, 2026. Industry medians refresh every 6 hours; raw vendor counts are queried live on each request.

Spot a factual error in this report?

Email support@echelongraph.io with the specific number you're disputing and a link to the authoritative source. We review every report and publish corrections on the methodology page.