Linux vulnerabilities

CVEs with a distro fix entry for Ubuntu, Debian, Red Hat, SUSE, Alpine, Amazon Linux, Arch or Fedora.

3280 tracked CVEs have fix information for Linux distributions. Highest priority: CVE-2024-21762 (Fortinet FortiOS Out-of-Bound Write Vulnerability), score 100/100.

• CVE-2024-21762 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE Fortinet FortiOS Out-of-Bound Write Vulnerability
• CVE-2015-3306 CRITICAL 10.0 EXPLOITED MITIGATE MITIGATE ProFTPD Improper Access Control Vulnerability
• CVE-2025-39682 CRITICAL 9.8 EXPLOITED UPGRADE MITIGATE Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
• CVE-2026-88771 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE Citrix NetScaler Improper Input Validation Vulnerability
• CVE-2026-85706 CRITICAL 10.0 EXPLOITED UPGRADE GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
• CVE-2026-20079 CRITICAL 10.0 EXPLOITED DOWNGRADE Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
• CVE-2026-21962 CRITICAL 10.0 EXPLOITED DOWNGRADE DOWNGRADE Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
• CVE-2021-3199 CRITICAL 9.8 EXPLOITED UPGRADE ONLYOFFICE Docs Server Path Traversal Vulnerability
• CVE-2026-19490 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
• CVE-2026-9586 CRITICAL 9.8 EXPLOITED UPGRADE Sangoma Switchvox SQL Injection Vulnerability
• CVE-2026-83548 CRITICAL 10.0 EXPLOITED UPGRADE UPGRADE SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
• CVE-2023-49105 CRITICAL 9.8 EXPLOITED UPGRADE ownCloud Improper Authentication Vulnerability
• CVE-2026-60004 CRITICAL 9.8 EXPLOITED UPGRADE Gitea Code Injection Vulnerability
• CVE-2026-86060 CRITICAL 9.8 EXPLOITED UPGRADE MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
• CVE-2026-86218 CRITICAL 9.8 EXPLOITED UPGRADE N-able N-central Static Code Injection Vulnerability
• CVE-2026-75650 CRITICAL 10.0 EXPLOITED UPGRADE UPGRADE Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
• CVE-2026-82329 CRITICAL 9.8 EXPLOITED UPGRADE JFrog Artifactory Improper Authentication Vulnerability
• CVE-2026-71362 CRITICAL 9.1 EXPLOITED UPGRADE UPGRADE Adobe Commerce and Magento Incorrect Authorization Vulnerability
• CVE-2026-81578 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
• CVE-2026-105134 CRITICAL 10.0 EXPLOITED UPGRADE Ahsay AhsayCBS Command Injection Vulnerability
• CVE-2016-3081 HIGH 8.1 EXPLOITED MITIGATE DOWNGRADE Apache Struts Command Injection Vulnerability
• CVE-2026-94127 CRITICAL 9.8 EXPLOITED UPGRADE F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
• CVE-2026-49869 CRITICAL 10.0 EXPLOITED UPGRADE Kestra OSS OS Command Injection Vulnerability
• CVE-2026-76460 CRITICAL 10.0 EXPLOITED DOWNGRADE DOWNGRADE Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
• CVE-2026-85102 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE Check Point Multiple Products Improper Certificate Validation Vulnerability
• CVE-2026-93616 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE Check Point Multiple Products Path Traversal Vulnerability
• CVE-2026-76461 CRITICAL 9.8 EXPLOITED UPGRADE Cisco Secure Email Gateway SQL Injection Vulnerability
• CVE-2026-104935 HIGH 8.6 EXPLOITED UPGRADE Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
• CVE-2015-5477 HIGH 7.5 EXPLOITED UPGRADE MITIGATE ISC BIND Data Processing Errors Vulnerability
• CVE-2026-76519 CRITICAL 9.8 EXPLOITED UPGRADE Cisco Secure Email Gateway Relative Path Traversal Vulnerability
• CVE-2026-88772 HIGH 8.1 EXPLOITED UPGRADE UPGRADE Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
• CVE-2026-21589 HIGH 7.5 EXPLOITED UPGRADE UPGRADE Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
• CVE-2026-104286 CRITICAL 9.8 EXPLOITED UPGRADE Fortinet FortiMail Path Traversal Vulnerability
• CVE-2026-87902 HIGH 8.1 EXPLOITED UPGRADE WordPress Core Remote File Inclusion Vulnerability
• CVE-2021-23758 HIGH 8.1 EXPLOITED MITIGATE UPGRADE Ajax.NET Professional Deserialization of Untrusted Data Vulnerability
• CVE-2026-65400 CRITICAL 9.8 EXPLOITED UPGRADE Apple macOS Improper Authentication Vulnerability
• CVE-2026-102764 CRITICAL 9.8 EXPLOITED UPGRADE BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
• CVE-2026-102489 CRITICAL 9.8 EXPLOITED UPGRADE Zammad GmbH Zammad Session Fixation Vulnerability
• CVE-2026-76504 CRITICAL 9.8 EXPLOITED UPGRADE Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
• CVE-2026-82078 CRITICAL 9.1 EXPLOITED UPGRADE UPGRADE PaperCut NG/MF Unsafe Reflection Vulnerability
• CVE-2026-18577 HIGH 8.1 EXPLOITED UPGRADE N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
• CVE-2025-25249 HIGH 8.1 EXPLOITED UPGRADE UPGRADE Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
• CVE-2026-48710 MEDIUM 6.5 EXPLOITED UPGRADE UPGRADE Kludex Starlette HTTP Request/Response Smuggling Vulnerability
• CVE-2026-85046 HIGH 8.8 EXPLOITED UPGRADE UPGRADE Google Chromium V8 Type Confusion Vulnerability
• CVE-2022-0995 HIGH 7.8 EXPLOITED UPGRADE MITIGATE Linux Kernel Out-of-Bounds Write Vulnerability
• CVE-2019-1068 HIGH 8.8 EXPLOITED DOWNGRADE UPGRADE Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2015-3246 HIGH 7.4 EXPLOITED MITIGATE MITIGATE Red Hat Libuser Race Condition Vulnerability
• CVE-2026-8452 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
• CVE-2015-5287 HIGH 7.8 EXPLOITED UPGRADE MITIGATE Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
• CVE-2026-93952 CRITICAL 10.0 EXPLOITED UPGRADE Arista VeloCloud Orchestrator Improper Input Validation Vulnerability
• CVE-2026-18556 HIGH 7.4 EXPLOITED UPGRADE N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
• CVE-2026-87491 HIGH 8.8 EXPLOITED UPGRADE Google Chromium V8 Out of Bounds Write Vulnerability
• CVE-2026-110447 CRITICAL 9.2 EXPLOITED MITIGATE Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
• CVE-2026-7273 HIGH 8.8 EXPLOITED MITIGATE MITIGATE Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
• CVE-2026-67277 HIGH 8.2 EXPLOITED UPGRADE MikroTik RouterOS Missing Authentication for Critical Function Vulnerability
• CVE-2026-65660 HIGH 8.8 EXPLOITED UPGRADE Microsoft SharePoint Code Injection Vulnerability
• CVE-2026-83549 HIGH 7.8 EXPLOITED UPGRADE UPGRADE SonicWall SMA1000 Appliances OS Command Injection Vulnerability
• CVE-2026-42018 HIGH 7.5 EXPLOITED UPGRADE JFrog Artifactory Improper Authentication Vulnerability
• CVE-2026-5430 CRITICAL 10.0 EXPLOITED UPGRADE UPGRADE WSO2 Multiple Products Path Traversal Vulnerability
• CVE-2026-85880 HIGH 7.8 EXPLOITED UPGRADE UPGRADE Microsoft Windows Heap-Based Buffer Overflow Vulnerability
• CVE-2026-96951 HIGH 8.8 EXPLOITED MITIGATE UPGRADE Microsoft Windows Command Injection Vulnerability
• CVE-2026-105133 HIGH 7.3 EXPLOITED UPGRADE Ahsay AhsayCBS Improper Authentication Vulnerability
• CVE-2026-86950 HIGH 8.8 EXPLOITED UPGRADE UPGRADE Apple Multiple Products Out-of-Bounds Write Vulnerability
• CVE-2026-42016 HIGH 8.1 EXPLOITED UPGRADE JFrog Artifactory Incorrect Authorization Vulnerability
• CVE-2025-39964 HIGH 7.8 EXPLOITED UPGRADE MITIGATE Linux Kernel Race Condition Vulnerability
• CVE-2026-53266 HIGH 8.8 EXPLOITED UPGRADE Linux Kernel Out-of-Bounds Write Vulnerability
• CVE-2026-84869 CRITICAL 9.9 EXPLOITED UPGRADE ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability
• CVE-2026-114625 CRITICAL 9.9 EXPLOITED UPGRADE Arista VeloCloud Orchestrator SQL Injection Vulnerability
• CVE-2026-67279 MEDIUM 6.5 EXPLOITED UPGRADE Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
• CVE-2026-59822 HIGH 8.2 EXPLOITED UPGRADE BerriAI LiteLLM Improper Authentication Vulnerability
• CVE-2026-73296 CRITICAL 9.4 Microsoft UFO open-source framework for intelligent automation across devices and platforms
• CVE-2026-109618 CRITICAL 9.8 UPGRADE MITIGATE PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the reques
• CVE-2026-53362 HIGH 7.8 EXPLOITED UPGRADE MITIGATE Linux Kernel Unspecified Vulnerability
• CVE-2023-22894 MEDIUM 4.9 EXPLOITED UPGRADE Strapi Cleartext Storage of Sensitive Information Vulnerability
• CVE-2026-28672 CRITICAL 9.8 UPGRADE Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ra
• CVE-2026-73034 CRITICAL 9.8 DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write a
• CVE-2026-106931 HIGH 7.8 EXPLOITED UPGRADE UPGRADE EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
• CVE-2026-18685 CRITICAL 9.8 A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5
• CVE-2026-18686 CRITICAL 9.8 A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5
• CVE-2026-67208 CRITICAL 9.8 Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attacke
• CVE-2026-18601 CRITICAL 9.8 A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5
• CVE-2026-18602 CRITICAL 9.8 A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5
• CVE-2026-41452 CRITICAL 9.8 Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unaut
• CVE-2026-18612 CRITICAL 9.8 A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5
• CVE-2026-18614 CRITICAL 9.8 A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5
• CVE-2026-18615 CRITICAL 9.8 A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5
• CVE-2026-18616 CRITICAL 9.8 A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5
• CVE-2026-18684 CRITICAL 9.8 A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5
• CVE-2026-19348 CRITICAL 9.8 A security flaw has been discovered in Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea7890a
• CVE-2026-18963 CRITICAL 9.1 A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine fo
• CVE-2026-58704 HIGH 8.8 EXPLOITED MITIGATE Google Pixel Improper Authorization Vulnerability
• CVE-2026-88779 HIGH 7.5 EXPLOITED UPGRADE UPGRADE Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
• CVE-2026-0322 HIGH 7.2 EXPLOITED UPGRADE Palo Alto Networks PAN-OS Code Injection Vulnerability
• CVE-2026-61515 CRITICAL 9.8 Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability
• CVE-2026-61808 CRITICAL 9.8 LightRAG provides simple and fast retrieval-augmented generation
• CVE-2026-59124 CRITICAL 9.8 UPGRADE Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized at
• CVE-2026-15748 CRITICAL 9.8 The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and in
• CVE-2025-6424 CRITICAL 9.8 UPGRADE A use-after-free in FontFaceSet resulted in a potentially exploitable crash
• CVE-2026-69084 CRITICAL 10.0 SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL
• CVE-2026-42537 CRITICAL 9.8 UPGRADE Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to ver
• CVE-2026-44416 CRITICAL 9.8 UPGRADE Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <
• CVE-2026-109619 HIGH 8.1 UPGRADE MITIGATE PHP has various global state that temporarily points into request memory
• CVE-2026-81963 HIGH 7.8 EXPLOITED UPGRADE UPGRADE Microsoft Windows Link Following Vulnerability
• CVE-2026-34977 CRITICAL 9.8 UPGRADE Aperi'Solve is an open-source steganalysis web platform
• CVE-2026-38711 CRITICAL 9.8 TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19,
• CVE-2026-38708 CRITICAL 9.8 TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19,
• CVE-2026-38713 CRITICAL 9.8 TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19,
• CVE-2021-48014 CRITICAL 9.8 FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operatio
• CVE-2026-52680 CRITICAL 9.8 UPGRADE Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a
• CVE-2026-38709 CRITICAL 9.8 TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19,
• CVE-2026-66909 CRITICAL 9.8 UPGRADE Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserializ
• CVE-2026-69085 CRITICAL 10.0 SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where th
• CVE-2026-71945 CRITICAL 9.8 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a c
• CVE-2026-71946 CRITICAL 9.8 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a c
• CVE-2026-71947 CRITICAL 9.8 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a c
• CVE-2026-71949 CRITICAL 9.8 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a c
• CVE-2026-71950 CRITICAL 9.8 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a c
• CVE-2026-71951 CRITICAL 9.8 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a c
• CVE-2026-71952 CRITICAL 9.8 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a c
• CVE-2026-71954 CRITICAL 9.8 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a c
• CVE-2026-71955 CRITICAL 9.8 D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command
• CVE-2026-55799 CRITICAL 9.8 UPGRADE Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 Users are recommende
• CVE-2026-12571 CRITICAL 9.8 An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.
• CVE-2026-96656 HIGH 7.2 EXPLOITED UPGRADE Plex Media Server External Control of File Name or Path Vulnerability
• CVE-2026-102490 HIGH 7.8 EXPLOITED UPGRADE Zammad GmbH Zammad Improper Privilege Management Vulnerability
• CVE-2026-66803 CRITICAL 10.0 MITIGATE Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.
• CVE-2026-67261 CRITICAL 9.8 UPGRADE Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Comma
• CVE-2026-56162 CRITICAL 10.0 MITIGATE Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a net
• CVE-2026-71558 CRITICAL 9.8 UPGRADE Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ vers
• CVE-2026-71983 CRITICAL 9.8 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the wps.cgi in
• CVE-2026-71984 CRITICAL 9.8 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the urlfilter
• CVE-2026-71985 CRITICAL 9.8 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the accesscont
• CVE-2026-71986 CRITICAL 9.8 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the dmz functi
• CVE-2026-71987 CRITICAL 9.8 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the alg functi
• CVE-2026-71988 CRITICAL 9.8 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the portFw fun
• CVE-2026-71989 CRITICAL 9.8 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the porTrigger
• CVE-2026-71990 CRITICAL 9.8 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH
• CVE-2026-71991 CRITICAL 9.8 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH
• CVE-2026-71992 CRITICAL 9.8 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the macfilter
• CVE-2026-71993 CRITICAL 9.8 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the openvpn fu
• CVE-2026-72590 CRITICAL 9.8 An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remot
• CVE-2026-110063 CRITICAL 10.0 Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allo
• CVE-2026-73240 CRITICAL 9.8 UPGRADE Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects Apache Al
• CVE-2026-73299 CRITICAL 10.0 Prompty is a markdown file format (.prompty) for LLM prompts
• CVE-2026-73487 CRITICAL 9.8 UPGRADE Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that
• CVE-2026-96654 MEDIUM 6.5 EXPLOITED UPGRADE Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
• CVE-2026-60113 CRITICAL 9.8 UPGRADE AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing authenticati
• CVE-2026-51785 CRITICAL 9.8 An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a c
• CVE-2026-18588 CRITICAL 9.8 A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628
• CVE-2026-24254 CRITICAL 9.8 UPGRADE NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could c

FAQ

How do I patch a Linux CVE?

Open the CVE page, pick your distribution, and run the listed command, for example apt install --only-upgrade or dnf upgrade. Then verify the version.

Why does my package version not match the advisory?

Distributions backport fixes without changing the upstream version number. Compare against the distro fixed version shown on the CVE page.