Vendor
Fedora
90 known vulnerabilities.
Fedora at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 1 | 0 |
| Sep 2026 | 2 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Most common weaknesses
Products
Latest advisories
-
High max 4.4
Xen: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen
Ein lokaler Angreifer kann mehrere Schwachstellen in Xen ausnutzen, um Sicherheitsvorkehrungen zu umgehen und beliebigen Speicher anderer Domänen zu lesen und zu überschreiben.
first Nov 3, 2026 -
Medium max 7.5
Internet Systems Consortium BIND: Mehrere Schwachstellen
Ein entfernter Angreifer kann mehrere Schwachstellen in Internet Systems Consortium BIND ausnutzen, um Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen oder Denial-of-Service-Zustände herbeizuführen.
first Sep 16, 2026 -
Medium max 7.6
PCRE (Perl Compatible Regular Expressions): Schwachstelle ermöglicht Codeausführung
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in PCRE (Perl Compatible Regular Expressions) ausnutzen, um möglicherweise beliebigen Code auszuführen, angrenzenden Speicher zu beschädigen oder einen Denial-of-Service-Zustand herbeizuführen.
first Sep 28, 2026 -
Critical max 9.2
Node.js: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um einen Denial of Service Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen und um beliebigen Programmcode auszuführen.
first Oct 21, 2026 -
Medium max 7.5
Internet Systems Consortium BIND: Mehrere Schwachstellen
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Internet Systems Consortium BIND ausnutzen, um eine Speicherbeschädigung auszulösen oder einen Denial-of-Service-Zustand zu verursachen.
first May 20, 2026
90 results · Feed
-
High 8.8
xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape
An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Fl…
-
High 7.1
PackageKit: dnf5 backend ignores SIMULATE on RepoRemove
A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard…
-
High 7.8
NetworkManager-l2tp: local privilege escalation via ipsec.conf injection
A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate t…
-
High 8.8
Incomplete fix for CVE-2024-1929
Incomplete fix for CVE-2024-1929 The problem with CVE-2024-1929 was that the dnf5 D-Bus daemon accepted arbitrary configuration parameters from unprivileged users, which allowed a local root exploit by tricking the daemon into loading a user controlled "plugi…
-
High 7.5
Local Root Exploit via Configuration Dictionary
Local Root Exploit via Configuration Dictionary in dnf5daemon-server before 5.1.17 allows a malicious user to impact Confidentiality and Integrity via Configuration Dictionary. There are issues with the D-Bus interface long before Polkit is invoked. The `org.…
-
Medium 6.5
No Limit on Number of Open Sessions / Bad Session Close Behaviour
No Limit on Number of Open Sessions / Bad Session Close Behaviour in dnf5daemon-server before 5.1.17 allows a malicious user to impact Availability via No Limit on Number of Open Sessions. There is no limit on how many sessions D-Bus clients may create using …
-
High 8.1
Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the decode_deliver_report() function
A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_deliver_report() function during the SMS decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious bas…
-
High 8.1
Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the decode_submit_report() function
A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_submit_report() function during the SMS decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base…
-
High 8.1
Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the sms_decode_address_field() function
A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the sms_decode_address_field() function during the SMS PDU decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malici…
-
High 8.1
Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the decode_status_report() function
A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_status_report() function during the SMS decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base…
-
High 7.5
Openvswsitch: ovs-vswitch fails to recover after malformed geneve metadata packet
A flaw was found in Open vSwitch where multiple versions are vulnerable to crafted Geneve packets, which may result in a denial of service and invalid memory accesses. Triggering this issue requires that hardware offloading via the netlink path is enabled.
-
Medium 5.1
Kernel: race condition leads to use after free during vma lock in lock_vma_under_rcu
A use-after-free flaw was found in the Linux kernel's Memory Management subsystem when a user wins two races at the same time with a fail in the mas_prev_slot function. This issue could allow a local user to crash the system.
-
High 7.7
Yarn: untrusted search path
An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.
-
Medium 5.3
Glibc: integer overflow in __vsyslog_internal()
An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a very long message, leading to an incorrect calculation…
-
High 8.2
Glibc: off-by-one heap-based buffer overflow in __vsyslog_internal()
An off-by-one heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a message bigger than INT_MAX bytes…
-
High 8.4CVE-2023-6246 Public exploit
Glibc: heap-based buffer overflow in __vsyslog_internal()
A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to N…
-
High 8.1
Pkcs11-provider: side-channel proofing pkcs#1 1.5 paths
A security vulnerability has been identified in the pkcs11-provider, which is associated with Public-Key Cryptography Standards (PKCS#11). If exploited successfully, this vulnerability could result in a Bleichenbacher-like security flaw, potentially enabling …
-
High 7.5
Kernel: icmpv6 router advertisement packets, aka linux tcp/ip remote code execution vulnerability
A race condition was found in the Linux Kernel. Under certain conditions, an unauthenticated attacker from an adjacent network could send an ICMPv6 router advertisement packet, causing arbitrary code execution.
-
Medium 6.7
Mock: privilege escalation for users that can access mock configuration
The Mock software contains a vulnerability wherein an attacker could potentially exploit privilege escalation, enabling the execution of arbitrary code with root user privileges. This weakness stems from the absence of proper sandboxing during the expansion a…
-
Medium 6.6
Sudo: improper handling of ipa_hostname leads to privilege mismanagement
A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after ret…
-
Medium 5.5
W3m: out-of-bounds write in function checktype() in etc.c (incomplete fix for cve-2022-38223)
An out-of-bounds write issue has been discovered in the backspace handling of the checkType() function in etc.c within the W3M application. This vulnerability is triggered by supplying a specially crafted HTML file to the w3m binary. Exploitation of this flaw…
-
Medium 5.5
Tcpreplay: tcprewrite: double free in tcpedit_dlt_cleanup() in plugins/dlt_plugins.c
Within tcpreplay's tcprewrite, a double free vulnerability has been identified in the tcpedit_dlt_cleanup() function within plugins/dlt_plugins.c. This vulnerability can be exploited by supplying a specifically crafted file to the tcprewrite binary. This flaw…
-
High 7.5
Openimageio: heap-buffer-overflow in file src/gif.imageio/gifinput.cpp
A vulnerability was found in OpenImageIO, where a heap buffer overflow exists in the src/gif.imageio/gifinput.cpp file. This flaw allows a remote attacker to pass a specially crafted file to the application, which triggers a heap-based buffer overflow and cou…
-
Medium 5.5
Kernel: io_uring out of boundary memory access in __io_uaddr_map()
An out-of-bounds memory access flaw was found in the io_uring SQ/CQ rings functionality in the Linux kernel. This issue could allow a local user to crash the system.
-
High 7.0
Kernel: the nfta_inner_num and nfta_expr_name netlink attributes accessed without checking its presence in nft_inner.c
A null pointer dereference flaw was found in the nft_inner.c functionality of netfilter in the Linux kernel. This issue could allow a local user to crash the system or escalate their privileges on the system.
-
Medium 6.7
Kernel: nvme: memory corruption via unprivileged user passthrough
A buffer overflow vulnerability was found in the NVM Express (NVMe) driver in the Linux kernel. Only privileged user could specify a small meta buffer and let the device perform larger Direct Memory Access (DMA) into the same buffer, overwriting unrelated ker…
-
Medium 5.5
Kernel: use-after-free in drivers/net/usb/lan78xx.c in lan78xx_disconnect
A use-after-free flaw was found in lan78xx_disconnect in drivers/net/usb/lan78xx.c in the network sub-component, net/usb/lan78xx in the Linux Kernel. This flaw allows a local attacker to crash the system when the LAN78XX USB device detaches.
-
High 7.5
Samba: ad dc password exposure to privileged users and rodcs
A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to acces…
-
High 7.1
Use-after-free in parse_lease_state()
An out-of-bounds (OOB) memory read flaw was found in parse_lease_state in the KSMBD implementation of the in-kernel samba server and CIFS in the Linux kernel. When an attacker sends the CREATE command with a malformed payload to KSMBD, due to a missing check …
-
Medium 6.2
Potential buffer overflow in php_cli_server_startup_workers
A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow.
-
Medium 6.2
Reachable assertion in avahi_alternative_host_name
A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name() function.
-
Medium 6.2
Reachable assertion in avahi_rdata_parse
A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function.
-
Medium 6.2
Reachable assertion in dbus_set_host_name
A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function.
-
Medium 6.2
Reachable assertion in avahi_escape_label
A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function.
-
Medium 6.2
Reachable assertion in avahi_dns_packet_append_record
A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record.
-
Medium 5.5
Heap-buffer-overflow in extractimagesection()
A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file.
-
Medium 6.5
Use-after-free in setup_async_work()
A use-after-free flaw was found in setup_async_work in the KSMBD implementation of the in-kernel samba server and CIFS in the Linux kernel. This issue could allow an attacker to crash the system by accessing freed work.
-
Medium 6.5
Use-after-free in smb2_is_status_io_timeout()
A use-after-free flaw was found in smb2_is_status_io_timeout() in CIFS in the Linux Kernel. After CIFS transfers response data to a system call, there are still local variable points to the memory region, and if the system call frees it faster than CIFS uses …
-
Medium 5.3
Draw while calling getdrawinfo()
A memory leak flaw was found in ruby-magick, an interface between Ruby and ImageMagick. This issue can lead to a denial of service (DOS) by memory exhaustion.
-
Medium 5.5
Kernel: integer overflow in igmpv3_newpack leading to exploitable memory access
An integer overflow flaw was found in the Linux kernel. This issue leads to the kernel allocating `skb_shared_info` in the userspace, which is exploitable in systems without SMAP protection since `skb_shared_info` contains references to function pointers.