Vendor
Fedoraproject
5,442 known vulnerabilities in products by Fedoraproject, 88 of them actively exploited (CISA KEV).
Key figures
5,442
Vulnerabilities
88
Actively exploited (KEV)
11
Used by ransomware
578
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2024-4577 | Argument Injection in PHP-CGI In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2021-44228 | Apache Log4j2 Remote Code Execution Vulnerability In CISA KEVRansomware | 10.0 | |
| Critical | CVE-2021-41773 | Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2021-42013 | Apache HTTP Server Path Traversal Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2019-5544 | VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2021-45046 | Apache Log4j2 Deserialization of Untrusted Data Vulnerability In CISA KEVRansomware | 9.0 | |
| Critical | CVE-2021-40438 | mod_proxy SSRF In CISA KEVRansomware | 9.0 | |
| Critical | CVE-2022-2294 | WebRTC Heap Buffer Overflow Vulnerability In CISA KEVRansomware | 8.8 | |
| Critical | CVE-2019-11043 | Underflow in PHP-FPM can lead to RCE In CISA KEVRansomware | 8.7 | |
| Critical | CVE-2023-44487 | HTTP/2 Rapid Reset Attack Vulnerability In CISA KEV | 7.5 | |
| Critical | CVE-2024-4671 | Google Chromium Visuals Use-After-Free Vulnerability In CISA KEV | 9.6 | |
| Critical | CVE-2024-1086 | Linux Kernel Use-After-Free Vulnerability In CISA KEVRansomware | 7.8 | |
| Critical | CVE-2024-4761 | Google Chromium V8 Out-of-Bounds Memory Write Vulnerability In CISA KEV | 8.8 | |
| Critical | CVE-2020-1472 | Netlogon Elevation of Privilege Vulnerability In CISA KEVRansomware | 5.5 | |
| Critical | CVE-2015-3306 | ProFTPD Improper Access Control Vulnerability In CISA KEV | 10.0 | |
| Critical | CVE-2012-1823 | PHP-CGI Query String Parameter Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2021-39226 | Snapshot authentication bypass in grafana In CISA KEV | 9.8 | |
| Critical | CVE-2020-16846 | SaltStack Salt Shell Injection Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2020-1938 | Apache Tomcat Improper Privilege Management Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2020-7247 | OpenSMTPD Remote Code Execution Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2024-4947 | Google Chromium V8 Type Confusion Vulnerability In CISA KEV | 9.6 | |
| Critical | CVE-2021-44026 | Roundcube Webmail SQL Injection Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2023-4863 | Google Chromium WebP Heap-Based Buffer Overflow Vulnerability In CISA KEV | 8.8 | |
| Critical | CVE-2023-6345 | Google Skia Integer Overflow Vulnerability In CISA KEV | 9.6 | |
| Critical | CVE-2019-16928 | Exim Out-of-bounds Write Vulnerability In CISA KEV | 9.8 |
News
- Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agenciesthehackernews,
- 58 hardware vulnerabilities: A guide to the threatscsoonline,
- CISA Adds 10 CVEs to Known Exploited Vulnerabilities Catalog, Five with Three-day Mitigation Deadlinessans-newsbites-mail,
- 16-year-old KVM flaw allows attackers to escape VMs and take over Linux serverscsoonline,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 23sans-atrisk-mail,
- Flaws in Linux Kernel and Android Exploited, Added to CISA KEVsans-newsbites-mail,
Products
| Product | CVEs | Actively exploited |
|---|---|---|
| Fedora | 5,360 | 88 |
| Extra Packages For Enterprise Linux | 76 | 1 |
| Fedora Project 389 Directory Server | 39 | 0 |
| Fedora SSSD - System Security Services Daemon | 32 | 0 |
| Fedora Core | 8 | 0 |