Linuxfoundation Security Vulnerabilities (CVEs)
Track 146 security vulnerabilities affecting Linuxfoundation products and software. Get instant email alerts when new CVEs are discovered, automated security monitoring, and patch guidance.
This CVE allows attackers with read/write access to Vitess backup storage locations to manipulate backup manifest files and perform path traversal att...
Feb 26, 2026This vulnerability allows attackers with read/write access to Vitess backup storage locations to manipulate backup manifest files, leading to arbitrar...
Feb 26, 2026This vulnerability in NATS-Server allows attackers to cause denial of service via compression bombs in WebSocket messages. It affects deployments usin...
Feb 24, 2026This vulnerability allows unauthorized authentication in Strimzi Kafka clusters when using custom CA certificates with multi-stage chains. Attackers w...
Feb 21, 2026This vulnerability in Strimzi allows Kafka Connect or Kafka MirrorMaker 2 operands to incorrectly trust all certificates in a CA chain when connecting...
Feb 20, 2026This vulnerability in Inspektor Gadget allows malicious containers to inject ANSI escape sequences into terminal output, potentially enabling terminal...
Feb 12, 2026This vulnerability in Antrea's network policy priority assignment system causes incorrect traffic enforcement due to a uint16 arithmetic overflow when...
Feb 6, 2026OpenTelemetry-Go SDK versions v1.20.0 through v1.39.0 on macOS/Darwin systems are vulnerable to path hijacking attacks. An attacker with local access ...
Feb 2, 2026A path traversal vulnerability in Backstage's TechDocs local generator allows attackers to read arbitrary files from the host filesystem when processi...
Jan 30, 2026This vulnerability allows attackers to execute arbitrary Python code on TechDocs build servers when configured with 'runIn: local'. Malicious actors w...
Jan 30, 2026CVE-2026-24905 is a command injection vulnerability in Inspektor Gadget's image building functionality. An attacker who can control the YAML gadget ma...
Jan 29, 2026A critical authentication bypass vulnerability in Podman Desktop allows any installed extension to completely circumvent permission checks and gain un...
Jan 28, 2026A vulnerability in PyTorch's `weights_only` unpickler allows attackers to craft malicious checkpoint files (.pth) that, when loaded, can corrupt memor...
Jan 27, 2026Dragonfly versions 2.4.1-rc.0 and below have missing authentication and authorization checks on Job API endpoints, allowing unauthenticated users with...
Jan 22, 2026CVE-2026-24117 is a Server-Side Request Forgery (SSRF) vulnerability in Rekor's /api/v1/index/retrieve endpoint that allows attackers to trigger GET r...
Jan 22, 2026This CVE describes a nil pointer dereference vulnerability in Rekor's entry implementation that can cause a panic when processing attacker-controlled ...
Jan 22, 2026This vulnerability in EVerest EV charging software allows malicious operators to read unintended memory regions (heap/stack) through pointer arithmeti...
Jan 21, 2026This vulnerability in EVerest libocpp causes memory leaks through unfreed strdup pointers during connection attempts. It affects EV charging systems u...
Jan 21, 2026This vulnerability in EVerest EV charging software allows attackers to exploit other weaknesses by keeping connections alive despite errors. All EVere...
Jan 21, 2026This vulnerability allows attackers to bypass session validation in EVerest EV charging software by sending V2G messages with session ID 0 when no ses...
Jan 21, 2026A null pointer dereference vulnerability in EVerest EV charging software allows remote attackers to cause denial of service by sending specially craft...
Jan 21, 2026This vulnerability in EVerest EV charging software allows attackers to cause denial of service through null pointer dereference when handling SDP requ...
Jan 21, 2026An integer overflow vulnerability in EVerest EV charging software allows attackers to trigger either infinite loops or stack buffer overflows by sendi...
Jan 21, 2026This vulnerability in EVerest EV charging software allows attackers to crash the process by sending malformed SLIP frames via serial input. It affects...
Jan 21, 2026This vulnerability in EVerest EV charging software allows attackers to cause denial of service by triggering assertion failures that crash individual ...
Jan 21, 2026This vulnerability in EVerest EV charging software allows unhandled C++ exceptions in the TbdController loop to cause silent termination of the contro...
Jan 21, 2026This vulnerability in EVerest EV charging software allows attackers to cause denial of service by exhausting system memory through unlimited TCP conne...
Jan 21, 2026CVE-2026-22772 is a server-side request forgery (SSRF) vulnerability in Fulcio's MetaIssuer URL validation. Attackers can bypass validation using unan...
Jan 12, 2026Spinnaker versions prior to 2025.1.6, 2025.2.3, and 2025.3.0 are vulnerable to server-side request forgery (SSRF) that allows attackers to fetch data ...
Jan 5, 2026A denial-of-service vulnerability in the omec-project UPF's pfcpiface component allows attackers to crash the UPF process by sending malformed PFCP Se...
Dec 18, 2025This vulnerability in Strimzi Kafka Operator versions 0.47.0 through 0.49.0 creates an overly permissive Kubernetes Role that grants Kafka Connect and...
Dec 5, 2025This CVE describes a memory exhaustion vulnerability in containerd's CRI Attach implementation where goroutine leaks allow users to consume host memor...
Nov 7, 2025This CVE-2025-52881 vulnerability in runc allows attackers to redirect writes to /proc filesystem to other locations through race conditions with shar...
Nov 6, 2025A vulnerability in runc allows attackers to bypass container isolation by tricking the system into bind-mounting sensitive read-only or masked paths t...
Nov 6, 2025This vulnerability in runc allows attackers to bypass container isolation by exploiting insufficient verification of bind-mount sources when using /de...
Nov 6, 2025Containerd versions before 1.7.29, 2.0.7, 2.1.5, and 2.2.0 create critical directories with overly permissive access controls, allowing group/world re...
Nov 6, 2025This vulnerability in the GNSS service allows an out-of-bounds write due to incorrect bounds checking. It enables local privilege escalation if an att...
Nov 4, 2025This vulnerability in the GNSS service allows an attacker with System privilege to perform an out-of-bounds write, potentially leading to local privil...
Nov 4, 2025This vulnerability allows local privilege escalation on MediaTek devices due to an insecure default value in the preloader component. An attacker with...
Nov 4, 2025CVE-2025-55552 is an integer overflow vulnerability in PyTorch v2.8.0 that occurs when torch.rot90 and torch.randn_like functions are used together, p...
Sep 25, 2025PyTorch v2.8.0 contains an integer overflow vulnerability in torch.nan_to_num-.long() that could allow memory corruption or denial of service. This af...
Sep 25, 2025A vulnerability in PyTorch v2.7.0 causes a Name Error when models containing torch.cummin operations are compiled with Inductor, leading to Denial of ...
Sep 25, 2025This CVE describes an assertion error vulnerability in PyTorch's nn.Fold module when using the inductor compiler. The vulnerability can cause denial o...
Sep 25, 2025This CVE describes a vulnerability in PyTorch's torch.compile feature where FractionalMaxPool2d produces inconsistent results. This could lead to inco...
Sep 25, 2025A vulnerability in PyTorch's bitwise_right_shift function produces incorrect output when given out-of-bounds values for the 'other' argument. This cou...
Sep 25, 2025This vulnerability in PyTorch versions before 3.7.0 affects the bernoulli_p decompose function, causing inconsistency with CPU implementations that ne...
Sep 25, 2025A vulnerability in PyTorch's torch.linalg.lu component allows attackers to trigger a Denial of Service (DoS) through specific slice operations. This a...
Sep 25, 2025Dragonfly versions before 2.1.0 use MD5 hashing for file verification, which is cryptographically broken and allows attackers to create malicious file...
Sep 17, 2025A denial-of-service vulnerability in Dragonfly's P2P file distribution system allows attackers to bypass rate limiting by exploiting an uninitialized ...
Sep 17, 2025Dragonfly's proxy access control mechanism prior to version 2.1.0 uses simple string comparisons vulnerable to timing attacks. Attackers can guess pas...
Sep 17, 2025Why Monitor Linuxfoundation Security Vulnerabilities?
Real-time CVE tracking: Our automated system monitors 146+ known vulnerabilities affecting Linuxfoundation products and software packages. Stay ahead of emerging threats with instant email notifications when new security issues are discovered.
Automated security monitoring: Unlike manual CVE checking, FixTheCVE automatically scans your servers and detects vulnerable Linuxfoundation packages in under 60 seconds. No agents required - completely agentless scanning that works across Linuxfoundation deployments.
Free vulnerability database: Access detailed information about every Linuxfoundation CVE including CVSS scores, severity ratings, affected versions, and actionable patch guidance. Filter by critical, high, medium, or low severity to prioritize your security remediation efforts.
🚀 Get Started in 60 Seconds
- Register free account & add your servers
- Run one-time scan or schedule automatic monitoring (every 1-24 hours)
- Receive instant alerts when new Linuxfoundation CVEs affect your systems
- Access dashboard with severity breakdown & fix instructions
