Critical and exploited vulnerabilities
The most important vulnerabilities for Linux and Unix servers right now: flaws that are being exploited, rated critical, or high in widely used server software. Updated every hour from official sources.
Last update: 2026-11-03 17:06 UTC · 272 vulnerabilities · RSS feed · Terms like exploited (KEV) and CVSS are explained in the glossary
| Date | Vulnerability | Product | Severity |
|---|---|---|---|
| 2026-10-29 | CVE-2026-97229 GitLab CI/CD regular expression integer overflow allows unauthenticated RCE | GitLab CE/EE | Exploited Critical 10.0 |
| 2026-10-28 | CVE-2026-46300 Linux kernel ESP-in-TCP page-cache write to root (Fragnesia) | Linux kernel | Exploited High 7.8 |
| 2026-10-27 | CVE-2026-111497 Brotli decoder out-of-bounds write in Node.js enables RCE (Node2Shell) | Brotli | Exploited Critical 9.2 |
| 2026-10-27 | CVE-2026-48356 Adobe Commerce / Magento unrestricted file upload (APSB26-73) | Magento / Adobe Commerce | Exploited Critical 9.3 |
| 2026-10-26 | CVE-2026-109618 PHP out-of-memory handling corrupts request memory, remote code execution | PHP | Exploited Critical 9.2 |
| 2026-10-26 | CVE-2026-109619 PHP stale request state reused by the next request, remote code execution | PHP | Exploited Critical 9.2 |
| 2026-10-23 | CVE-2026-105482 Node.js dns.resolve*() silently truncates hostnames at a NUL byte | Node.js | High 7.4 |
| 2026-10-23 | CVE-2026-105483 Node.js TLS hostname check bypass with fullwidth-digit IP addresses | Node.js | High 7.4 |
| 2026-10-23 | CVE-2026-106069 Node.js TLS hostname check bypass with leading-zero IPv4 hosts | Node.js | High 7.4 |
| 2026-10-23 | CVE-2026-110447 Nextcloud Collabora Built-in CODE Server (richdocumentscode) command injection | Collabora Online | Exploited Critical 9.2 |
| 2026-10-22 | CVE-2026-110264 GitLab Org-mode regex integer overflow allows unauthenticated RCE | GitLab CE/EE | Critical 10.0 |
| 2026-10-20 | CVE-2026-106931 SiteGuard Server Edition statistics feature OS command injection (root) | Apache HTTP Server | Exploited High 8.5 |
| 2026-10-20 | CVE-2026-113672 Argo CD Jsonnet imports read any file in repo-server, including credentials | Critical 9.9 | |
| 2026-10-20 | CVE-2026-113708 Argo CD Kustomize remote ref option injection runs commands in repo-server | Critical 9.9 | |
| 2026-10-20 | CVE-2026-96652 Plex Media Server unauthenticated SSRF via /player/timeline (Plex2Shell) | Plex Media Server | Exploited Medium 5.3 |
| 2026-10-20 | CVE-2026-96654 Plex Media Server searchOne injection reaches loopback agent API (Plex2Shell) | Plex Media Server | Exploited Medium 6.9 |
| 2026-10-20 | CVE-2026-96655 Plex Media Server owner admin token disclosure / transcode SSRF (Plex2Shell) | Plex Media Server | Exploited Medium 5.3 |
| 2026-10-20 | CVE-2026-96656 Plex Media Server file write to Codecs dir via transcoder prefs (Plex2Shell) | Plex Media Server | Exploited High 8.6 |
| 2026-10-19 | CVE-2026-112900 Pillow: Argument Injection in Ghostscript call, potentially leading into RCE | Ghostscript | Critical 9.2 |
| 2026-10-15 | CVE-2026-101304 Multiple jail filesystem root escapes | FreeBSD | High 7.1 |
| 2026-10-15 | CVE-2026-101307 Remotely triggerable buffer overflow in tcp_rack | FreeBSD | High 8.2 |
| 2026-10-15 | CVE-2026-111094 TeamCity On-Premises RCE via whitelist bypass in the build messages protocol | Critical 9.8 | |
| 2026-10-15 | CVE-2026-21589 Atlassian Data Center products: unauthenticated arbitrary file access | Atlassian Confluence | Exploited Critical 9.3 |
| 2026-10-14 | CVE-2026-105133 AhsayCBS API authentication bypass (checkSysPwd) | Exploited Medium 6.9 | |
| 2026-10-14 | CVE-2026-105134 AhsayCBS Replication Receiver OS command injection (UpdateReceivers.do) | Exploited Critical 10.0 | |
| 2026-10-14 | CVE-2026-59774 Gitea Org-mode #+INCLUDE lets anonymous users read server files, then RCE | Critical 9.8 | |
| 2026-10-12 | CVE-2026-103903 MikroTik RouterOS WinBox: low-privilege user can get admin session | MikroTik RouterOS | High 8.7 |
| 2026-10-08 | CVE-2015-3306 ProFTPD mod_copy unauthenticated SITE CPFR/CPTO file copy | Exploited Critical 10.0 | |
| 2026-10-08 | CVE-2015-5477 ISC BIND TKEY query REQUIRE assertion failure (remote named crash) | ISC BIND 9 | Exploited High 7.5 |
| 2026-10-08 | CVE-2016-3081 Apache Struts 2 S2-032 RCE via method: prefix with Dynamic Method Invocation | Apache Struts | Exploited High 8.1 |
| 2026-10-08 | CVE-2021-3199 ONLYOFFICE Document Server /upload path traversal to RCE | Exploited Critical 9.8 | |
| 2026-10-08 | CVE-2023-22894 Strapi private-field filtering leaks password hashes and reset tokens | Exploited Medium 4.9 | |
| 2026-10-06 | CVE-2026-106553 OpenSSH: In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSS… | OpenSSH | High 7.5 |
| 2026-10-06 | CVE-2026-106555 OpenSSH: In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly… | OpenSSH | High 7.5 |
| 2026-10-06 | CVE-2026-106583 OpenSSH: In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, le… | OpenSSH | High 7.8 |
| 2026-10-02 | CVE-2026-102489 Zammad 6.3-6.5 session hijack leading to RCE as the zammad user | Linux kernel | Exploited Critical 9.4 |
| 2026-10-02 | CVE-2026-102490 Zammad DEB/RPM packages (packager.io) local privilege escalation to root | Linux kernel | Exploited Critical 9.4 |
| 2026-10-02 | CVE-2026-84411 MikroTik RouterOS web interface: one request can run code as root | MikroTik RouterOS | Critical 9.3 |
| 2026-09-29 | CVE-2026-84440 IBM Guardium Data Protection is affected by multiple vulnerabilities. | Linux kernel | High 8.8 |
| 2026-09-29 | CVE-2026-84782 OpenSSL DTLS retransmission heap over-read (High) | High 8.2 | |
| 2026-09-26 | CVE-2026-98163 cgroup: Avoid iteration of dying tasks with zero refcount | Linux kernel | High 7.0 |
| 2026-09-25 | CVE-2026-100072 ACPI: platform: Use acpi_bus_get_primary_device() | Linux kernel | High 7.8 |
| 2026-09-25 | CVE-2026-67279 MikroTik RouterOS SSH runs commands before login (exploited) | MikroTik RouterOS | Exploited Medium 6.9 |
| 2026-09-25 | CVE-2026-87902 WordPress core page-template path traversal, conditional RCE | WordPress core | Exploited High 8.1 |
| 2026-09-25 | CVE-2026-98093 ASoC: fsl_micfil: balance mclk enable/disable | Linux kernel | High 7.8 |
| 2026-09-25 | CVE-2026-98111 Bluetooth: btintel: validate version TLV value lengths | Linux kernel | High 7.1 |
| 2026-09-25 | CVE-2026-98117 cachefiles: Fix potential UAF/KASAN warning | Linux kernel | High 7.8 |
| 2026-09-25 | CVE-2026-98118 netfs: Fix readahead synchronisation issues by loading all folios upfront | Linux kernel | High 7.1 |
| 2026-09-25 | CVE-2026-98136 ntfs: bound $AttrDef table walk to the loaded table size | Linux kernel | High 7.1 |
| 2026-09-25 | CVE-2026-98149 bpf: Fix percpu map update indexing with sparse CPU IDs | Linux kernel | High 7.8 |
| 2026-09-25 | CVE-2026-98155 accel/qaic: Address potential out-of-bounds read in resp_worker() | Linux kernel | High 7.1 |
| 2026-09-24 | CVE-2026-5430 WSO2 API Manager JWT algorithm confusion authentication bypass | Exploited Critical 10.0 | |
| 2026-09-24 | CVE-2026-71362 Adobe Commerce / Magento incorrect authorization, privilege escalation | Magento / Adobe Commerce | Exploited Critical 9.1 |
| 2026-09-23 | CVE-2026-6730 Multiple Vulnerabilities in IBM Concert Software | Linux kernel | High 7.8 |
| 2026-09-22 | CVE-2026-65114 Linux kernel: NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker coul… | Linux kernel | Critical 9.8 |
| 2026-09-22 | CVE-2026-65117 Linux kernel: NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker coul… | Linux kernel | High 8.8 |
| 2026-09-22 | CVE-2026-65118 Linux kernel: NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker coul… | Linux kernel | Critical 9.8 |
| 2026-09-22 | CVE-2026-65121 Linux kernel: NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker coul… | Linux kernel | Critical 9.8 |
| 2026-09-22 | CVE-2026-65124 Linux kernel: NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker coul… | Linux kernel | High 8.1 |
| 2026-09-22 | CVE-2026-65125 Linux kernel: NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker coul… | Linux kernel | High 8.8 |
| 2026-09-22 | CVE-2026-65126 Linux kernel: NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker coul… | Linux kernel | High 8.8 |
| 2026-09-22 | CVE-2026-65129 Linux kernel: NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker coul… | Linux kernel | High 8.3 |
| 2026-09-22 | CVE-2026-65130 Linux kernel: NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker coul… | Linux kernel | Critical 9.8 |
| 2026-09-19 | CVE-2026-94056 Exim: Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows… | Exim | High 7.5 |
| 2026-09-18 | CVE-2025-39682 Linux kernel TLS (kTLS) zero-length record handling flaw | Linux kernel | Exploited Critical 9.8 |
| 2026-09-18 | CVE-2025-39964 Linux kernel AF_ALG concurrent-write race in crypto user API | Linux kernel | Exploited Medium 5.5 |
| 2026-09-18 | CVE-2026-53266 Linux kernel ebtables SNAT ARP rewrite writes into file-backed pages | Linux kernel | Exploited High 8.8 |
| 2026-09-16 | CVE-2026-81642 Unbound DNSSEC validator buffer overflow with crafted DNSKEY (critical) | Unbound | Critical 9.1 |
| 2026-09-16 | CVE-2026-87886 Acronis Backup plugins for cPanel/WHM, Plesk, DirectAdmin: local root (perms) | cPanel & WHM | Exploited High 7.8 |
| 2026-09-11 | CVE-2026-42016 JFrog Artifactory token scope not validated, allowing privilege escalation | Exploited High 8.8 | |
| 2026-09-11 | CVE-2026-42018 JFrog Artifactory leaks internal anonymous-user token to unauthenticated callers | Exploited High 7.5 | |
| 2026-09-11 | CVE-2026-85706 GitLab repository commits API path traversal allows unauthenticated file reads | GitLab CE/EE | Exploited Critical 10.0 |
| 2026-09-10 | CVE-2026-67277 MikroTik RouterOS bandwidth-test server leaks memory and crashes | MikroTik RouterOS | Exploited High 8.8 |
| 2026-09-10 | CVE-2026-86060 MikroTik RouterOS SSH crafted username grants admin rights (exploited) | MikroTik RouterOS | Exploited Critical 9.2 |
| 2026-09-10 | CVE-2026-89094 Forgejo template repository expansion plants .git folder for host RCE | Gitea / Forgejo | Critical 9.9 |
| 2026-09-08 | CVE-2026-75650 Adobe Commerce / Magento template injection RCE, exploited zero-day | Magento / Adobe Commerce | Exploited Critical 10.0 |
| 2026-09-08 | CVE-2026-86733 Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore | MariaDB | High 8.6 |
| 2026-09-05 | CVE-2026-67276 MikroTik RouterOS 7 SSH public-key login without the private key | MikroTik RouterOS | Critical 9.2 |
| 2026-09-05 | CVE-2026-67278 TLS server impersonation possible in Mikrotik RouterOS | MikroTik RouterOS | Medium 6.3 |
| 2026-09-05 | CVE-2026-67281 MikroTik RouterOS WebFig reads files, including credentials, without login | MikroTik RouterOS | High 8.7 |
| 2026-09-02 | CVE-2026-48710 Starlette Host header request.url confusion bypasses path-based auth (BadHost) | Exploited Medium 6.5 | |
| 2026-09-02 | CVE-2026-49869 Kestra OSS /configs suffix auth bypass to unauthenticated RCE | Exploited Critical 10.0 | |
| 2026-09-02 | CVE-2026-59822 LiteLLM proxy MCP endpoint authentication bypass with fabricated Bearer token | Exploited High 8.8 | |
| 2026-09-02 | CVE-2026-82329 JFrog Artifactory authentication bypass grants unauthenticated admin access | Exploited Critical 9.8 | |
| 2026-08-31 | CVE-2026-81578 PaperCut NG/MF authentication bypass in web admin interface | Exploited High 8.8 | |
| 2026-08-31 | CVE-2026-82078 PaperCut NG/MF unsafe dynamic class loading in database connector | Exploited Critical 9.4 | |
| 2026-08-27 | CVE-2023-49105 ownCloud core WebDAV auth bypass via pre-signed URLs | Exploited Critical 9.8 | |
| 2026-08-27 | CVE-2026-53362 Linux kernel IPv6 UDP fragment out-of-bounds write (ipv6_frag_escape) | Linux kernel | Exploited High 7.8 |
| 2026-08-27 | CVE-2026-59270 Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces | Spring Framework / Spring Boot / Spring Cloud | Critical 9.1 |
| 2026-08-27 | CVE-2026-66384 JFrog Artifactory Docker remote cache path traversal enables cache poisoning | Exploited Medium 5.3 | |
| 2026-08-27 | CVE-2026-75871 Server-Side Request Forgery (SSRF) in GitLab AI Gateway | GitLab CE/EE | Critical 9.6 |
| 2026-08-26 | CVE-2015-3246 libuser /etc/passwd race via userhelper (local root, with CVE-2015-3245) | Exploited High 7.4 | |
| 2026-08-26 | CVE-2015-5287 ABRT abrt-hook-ccpp symlink attack on predictable core file (local root) | Exploited High 7.8 | |
| 2026-08-26 | CVE-2022-0995 Linux kernel watch_queue out-of-bounds write | Linux kernel | Exploited High 7.8 |
| 2026-08-26 | CVE-2026-47837 Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests | Spring Framework / Spring Boot / Spring Cloud | Critical 9.8 |
| 2026-08-25 | CVE-2026-60004 Gitea diffpatch API lets repository writers plant Git hooks and run commands | Gitea / Forgejo | Exploited Critical 9.8 |
| 2026-08-25 | CVE-2026-65081 Linux kernel: NVIDIA NemoClaw for Linux contains a vulnerability in its installation process, where an a… | Linux kernel | Critical 9.8 |
| 2026-08-25 | CVE-2026-65082 Linux kernel: NVIDIA NemoClaw for Linux contains a vulnerability in its migration command, where a local… | Linux kernel | High 7.8 |
| 2026-08-25 | CVE-2026-65084 Linux kernel: NVIDIA NemoClaw for Linux contains a vulnerability in its deployment process, where an att… | Linux kernel | Critical 9.8 |
| 2026-08-25 | CVE-2026-65097 Linux kernel: NVIDIA NemoClaw for Linux contains a vulnerability in its installation scripts, where an a… | Linux kernel | High 8.8 |
| 2026-08-25 | CVE-2026-65098 Linux kernel: NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, w… | Linux kernel | Critical 9.8 |
| 2026-08-24 | CVE-2026-21962 Oracle HTTP Server / WebLogic Server Proxy Plug-in unauthenticated takeover | Exploited Critical 10.0 | |
| 2026-08-21 | CVE-2026-73570 Zimbra ZCS zimbra-snmp notification command injection (unauthenticated RCE) | Zimbra Collaboration | Exploited High 8.9 |
| 2026-08-20 | CVE-2026-17000 Vulnerabilities in IBM AIX and PowerVM VIOS | IBM AIX | Critical 9.8 |
| 2026-08-20 | CVE-2026-17003 Vulnerabilities in IBM AIX and PowerVM VIOS | IBM AIX | Critical 9.1 |
| 2026-08-20 | CVE-2026-17006 Vulnerabilities in IBM AIX and PowerVM VIOS | IBM AIX | Critical 9.8 |
| 2026-08-20 | CVE-2026-17024 Vulnerabilities in IBM AIX and PowerVM VIOS | IBM AIX | Critical 9.8 |
| 2026-08-20 | CVE-2026-17060 Vulnerabilities in IBM AIX and PowerVM VIOS | IBM AIX | Critical 9.1 |
| 2026-08-20 | CVE-2026-17138 Vulnerabilities in IBM AIX and PowerVM VIOS | IBM AIX | Critical 9.8 |
| 2026-08-20 | CVE-2026-17423 Vulnerabilities in IBM AIX and PowerVM VIOS | IBM AIX | Critical 9.1 |
| 2026-08-20 | CVE-2026-17436 Vulnerabilities in IBM AIX and PowerVM VIOS | IBM AIX | Critical 9.8 |
| 2026-08-20 | CVE-2026-18670 Vulnerabilities in IBM AIX and PowerVM VIOS | IBM AIX | Critical 9.1 |
| 2026-08-20 | CVE-2026-18716 Vulnerabilities in IBM AIX and PowerVM VIOS | IBM AIX | Critical 9.1 |
| 2026-08-20 | CVE-2026-18832 Vulnerabilities in IBM AIX and PowerVM VIOS | IBM AIX | Critical 9.8 |
| 2026-08-20 | CVE-2026-19437 Vulnerabilities in IBM AIX and PowerVM VIOS | IBM AIX | Critical 9.8 |
| 2026-08-20 | CVE-2026-72529 TrueConf Server missing authentication on 4307/TCP (arbitrary script execution) | Exploited Critical 9.3 | |
| 2026-08-20 | CVE-2026-72530 TrueConf Server sandbox escape / code injection to host code execution | Exploited Critical 9.5 | |
| 2026-08-19 | CVE-2026-64849 MLflow tracking server unauthenticated full-read SSRF via webhook test | Exploited Critical 9.3 | |
| 2026-08-18 | CVE-2026-47606 Linux kernel: NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could… | Linux kernel | Critical 9.1 |
| 2026-08-17 | CVE-2025-62593 Ray dashboard/jobs API RCE via DNS rebinding from Firefox/Safari | Exploited Critical 9.4 | |
| 2026-08-17 | CVE-2026-19478 Improper Control of Generation of Code ('Code Injection') in GitLab | GitLab CE/EE | Critical 9.1 |
| 2026-08-17 | CVE-2026-75003 Roundcube Webmail: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI… | Roundcube Webmail | Critical 9.8 |
| 2026-08-13 | CVE-2026-53789 rsync < 3.5.0 Arbitrary File Deletion via Malicious File List | rsync | High 7.1 |
| 2026-08-13 | CVE-2026-70457 rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg() | rsync | High 8.3 |
| 2026-08-13 | CVE-2026-72676 Improper Control of Generation of Code in Fleet Server Leading to Code Injection | Elasticsearch / Kibana | Critical 9.1 |
| 2026-08-12 | CVE-2026-16627 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab | GitLab CE/EE | Critical 9.0 |
| 2026-08-11 | CVE-2026-72898 Metabase unauthenticated SQL injection via /api/session/reset_password | Exploited Critical 10.0 | |
| 2026-08-05 | CVE-2026-63077 TeamCity On-Premises unauthenticated RCE via the agent polling protocol | Exploited Critical 9.8 | |
| 2026-08-05 | CVE-2026-70426 Jenkins Remoting deserialization filter bypass, agent-to-controller RCE | Critical 9.0 | |
| 2026-08-04 | CVE-2026-34486 Apache Tomcat EncryptInterceptor bypass (incomplete fix for CVE-2026-29146) | Apache Tomcat | Exploited High 7.5 |
| 2026-08-04 | CVE-2026-47487 Linux kernel: NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause… | Linux kernel | High 7.1 |
| 2026-08-04 | CVE-2026-47619 Linux kernel: NVIDIA Dynamo for Linux examples and recipes contain a vulnerability where an attacker cou… | Linux kernel | High 8.1 |
| 2026-08-04 | CVE-2026-56846 Node.js HTTP/2 retained header blocks bypass maxSessionMemory | Node.js | High 7.5 |
| 2026-08-04 | CVE-2026-56848 Node.js HTTP/2 re-entrant send causes heap use-after-free | Node.js | High 7.5 |
| 2026-08-04 | CVE-2026-9198 Langflow OSS auto_login + validate/code chain: unauthenticated RCE | Exploited Critical 9.8 | |
| 2026-07-30 | CVE-2026-17543 SQL injection in ext-pgsql via E'...' backslash breakout | PHP | High 8.1 |
| 2026-07-30 | CVE-2026-17544 Out-of-bounds write in bccomp() via crafted operand and scale | PHP | High 8.1 |
| 2026-07-30 | CVE-2026-58043 Node.js permission model over-grants filesystem access across path prefixes | Node.js | High 8.4 |
| 2026-07-28 | CVE-2026-14958 OS command injection in IBM Aspera Faspex | Linux kernel | High 7.2 |
| 2026-07-28 | CVE-2026-14959 OS Command Injection in IBM Aspera Faspex | Linux kernel | High 7.2 |
| 2026-07-27 | CVE-2026-55953 TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication | Erlang/OTP | Critical 9.1 |
| 2026-07-25 | CVE-2026-64270 Input: mms114 - reject an oversized device packet size | Linux kernel | High 7.8 |
| 2026-07-25 | CVE-2026-64271 Input: touchwin - reset the packet index on every complete packet | Linux kernel | High 7.8 |
| 2026-07-25 | CVE-2026-64272 Input: mms114 - fix touch indexing for MMS134S and MMS136 | Linux kernel | High 7.8 |
| 2026-07-25 | CVE-2026-64273 Input: iforce - bound the device-reported force-feedback effect index | Linux kernel | High 7.8 |
| 2026-07-25 | CVE-2026-64274 Input: goodix - clamp the device-reported contact count | Linux kernel | High 7.8 |
| 2026-07-25 | CVE-2026-64283 KVM: guest_memfd: Treat memslot binding offset+size as unsigned values | Linux kernel | High 7.0 |
| 2026-07-25 | CVE-2026-64305 crypto: qat - protect service table iterations with service_lock | Linux kernel | High 7.8 |
| 2026-07-25 | CVE-2026-64329 usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove | Linux kernel | High 7.8 |
| 2026-07-25 | CVE-2026-64330 usb: typec: tcpm: Validate SVID index in svdm_consume_modes() | Linux kernel | High 7.8 |
| 2026-07-25 | CVE-2026-64339 usb: misc: usbio: bound bulk IN response length to the received transfer | Linux kernel | High 7.1 |
| 2026-07-25 | CVE-2026-64340 USB: legousbtower: fix use-after-free on disconnect race | Linux kernel | High 7.8 |
| 2026-07-25 | CVE-2026-64341 USB: iowarrior: fix use-after-free on disconnect race | Linux kernel | High 7.8 |
| 2026-07-25 | CVE-2026-64342 USB: iowarrior: fix use-after-free on disconnect | Linux kernel | High 7.8 |
| 2026-07-25 | CVE-2026-64343 USB: ldusb: fix use-after-free on disconnect race | Linux kernel | High 7.8 |
| 2026-07-25 | CVE-2026-64344 USB: idmouse: fix use-after-free on disconnect race | Linux kernel | High 7.8 |
| 2026-07-25 | CVE-2026-64346 usb: gadget: udc: Fix use-after-free in gadget_match_driver | Linux kernel | High 7.8 |
| 2026-07-25 | CVE-2026-64348 usb: free iso schedules on failed submit | Linux kernel | High 7.8 |
| 2026-07-25 | CVE-2026-64352 bpf: Allow LPM map access from sleepable BPF programs | Linux kernel | High 7.8 |
| 2026-07-25 | CVE-2026-64362 HID: lg-g15: cancel pending work on remove to fix a use-after-free | Linux kernel | High 7.8 |
| 2026-07-25 | CVE-2026-64363 HID: appleir: fix UAF on pending key_up_timer in remove() | Linux kernel | High 7.8 |
| 2026-07-25 | CVE-2026-64365 HID: letsketch: fix UAF on inrange_timer at driver unbind | Linux kernel | High 7.8 |
| 2026-07-25 | CVE-2026-64377 cpufreq: qcom-cpufreq-hw: Fix possible double free | Linux kernel | High 7.8 |
| 2026-07-25 | CVE-2026-64381 smb: client: Fix next buffer leak in receive_encrypted_standard() | Linux kernel | High 7.8 |
| 2026-07-25 | CVE-2026-64421 media: nxp: imx8-isi: Fix use-after-free on remove | Linux kernel | High 7.8 |
| 2026-07-25 | CVE-2026-64424 netpoll: fix a use-after-free on shutdown path | Linux kernel | High 7.8 |
| 2026-07-25 | CVE-2026-64433 Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete | Linux kernel | High 7.8 |
| 2026-07-25 | CVE-2026-64446 staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() | Linux kernel | High 7.8 |
| 2026-07-25 | CVE-2026-64453 usb: misc: usbio: fix disconnect UAF in client teardown | Linux kernel | High 7.8 |
| 2026-07-24 | CVE-2026-64209 phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config | Linux kernel | High 7.1 |
| 2026-07-24 | CVE-2026-64224 octeontx2-pf: fix double free in rvu_rep_rsrc_init() | Linux kernel | High 7.8 |
| 2026-07-24 | CVE-2026-64225 octeontx2-af: CGX: add bounds check to cgx_speed_mbps index | Linux kernel | High 7.8 |
| 2026-07-24 | CVE-2026-64239 mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() | Linux kernel | High 7.8 |
| 2026-07-24 | CVE-2026-64242 usb: gadget: net2280: Fix double free in probe error path | Linux kernel | High 7.8 |
| 2026-07-24 | CVE-2026-64245 fbdev: modedb: fix a possible UAF in fb_find_mode() | Linux kernel | High 7.8 |
| 2026-07-24 | CVE-2026-64246 power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() | Linux kernel | High 7.8 |
| 2026-07-24 | CVE-2026-66140 Exim: Exim before 4.99.5 allows directory traversal to access files outside of the spool area, a… | Exim | High 7.8 |
| 2026-07-24 | CVE-2026-66141 Exim: Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe t… | Exim | High 7.8 |
| 2026-07-21 | CVE-2026-60137 WordPress core SQL injection via WP_Query author__not_in | WordPress core | Exploited Medium 5.9 |
| 2026-07-21 | CVE-2026-63030 WordPress REST API batch-route confusion leading to RCE | WordPress core | Exploited Critical 9.8 |
| 2026-07-19 | CVE-2026-63794 KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path | Linux kernel | High 7.8 |
| 2026-07-19 | CVE-2026-63797 rpmsg: char: Fix use-after-free on probe error path | Linux kernel | High 8.4 |
| 2026-07-19 | CVE-2026-63804 gfs2: fix use-after-free in gfs2_qd_dealloc | Linux kernel | High 7.8 |
| 2026-07-19 | CVE-2026-63898 USB: serial: mct_u232: fix memory corruption with small endpoint | Linux kernel | High 7.8 |
| 2026-07-19 | CVE-2026-63899 USB: serial: mxuport: fix memory corruption with small endpoint | Linux kernel | High 7.8 |
| 2026-07-19 | CVE-2026-63901 USB: serial: digi_acceleport: fix memory corruption with small endpoints | Linux kernel | High 7.8 |
| 2026-07-19 | CVE-2026-63902 USB: serial: cypress_m8: validate interrupt packet headers | Linux kernel | High 7.1 |
| 2026-07-19 | CVE-2026-63903 USB: serial: belkin_sa: validate interrupt status length | Linux kernel | High 7.1 |
| 2026-07-19 | CVE-2026-63904 usb: usbtmc: check URB actual_length for interrupt-IN notifications | Linux kernel | High 7.1 |
| 2026-07-19 | CVE-2026-63905 usbip: vudc: Fix use after free bug in vudc_remove due to race condition | Linux kernel | High 7.8 |
| 2026-07-19 | CVE-2026-63907 uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory | Linux kernel | High 7.8 |
| 2026-07-19 | CVE-2026-63928 USB: serial: omninet: fix memory corruption with small endpoint | Linux kernel | High 7.8 |
| 2026-07-19 | CVE-2026-63934 iio: gyro: itg3200: fix i2c read into the wrong stack location | Linux kernel | High 7.1 |
| 2026-07-19 | CVE-2026-63943 Input: xpad - fix out-of-bounds access for Share button | Linux kernel | High 7.1 |
| 2026-07-19 | CVE-2026-63949 auxdisplay: line-display: fix OOB read on zero-length message_store() | Linux kernel | High 7.1 |
| 2026-07-19 | CVE-2026-63956 USB: serial: cypress_m8: fix memory corruption with small endpoint | Linux kernel | High 7.8 |
| 2026-07-19 | CVE-2026-63957 USB: serial: safe_serial: fix memory corruption with small endpoint | Linux kernel | High 7.8 |
| 2026-07-19 | CVE-2026-63967 iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer | Linux kernel | High 7.8 |
| 2026-07-19 | CVE-2026-64001 ALSA: pcm: oss: Fix setup list UAF on proc write error | Linux kernel | High 7.8 |
| 2026-07-19 | CVE-2026-64014 Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size | Linux kernel | High 7.1 |
| 2026-07-19 | CVE-2026-64054 net: shaper: reject duplicate leaves in GROUP request | Linux kernel | High 7.8 |
| 2026-07-19 | CVE-2026-64063 netfs: Fix streaming write being overwritten | Linux kernel | High 7.8 |
| 2026-07-19 | CVE-2026-64071 nvme-pci: fix use-after-free in nvme_free_host_mem() | Linux kernel | High 7.8 |
| 2026-07-19 | CVE-2026-64075 fprobe: Fix unregister_fprobe() to wait for RCU grace period | Linux kernel | High 7.8 |
| 2026-07-19 | CVE-2026-64085 hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer | Linux kernel | High 7.8 |
| 2026-07-19 | CVE-2026-64103 scsi: isci: Fix use-after-free in device removal path | Linux kernel | High 7.8 |
| 2026-07-19 | CVE-2026-64121 net: ifb: report ethtool stats over num_tx_queues | Linux kernel | High 7.1 |
| 2026-07-19 | CVE-2026-64186 iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs | Linux kernel | High 7.1 |
| 2026-07-17 | CVE-2026-45309 AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal use | OpenSSH | High 8.2 |
| 2026-07-15 | CVE-2026-42533 nginx heap buffer overflow with map regex captures (major) | nginx | Critical 9.2 |
| 2026-07-15 | CVE-2026-60005 NGINX ngx_http_slice_module vulnerability | nginx | High 8.8 |
| 2026-07-14 | CVE-2026-48358 Adobe Commerce | Improper Encoding or Escaping of Output (CWE-116) | Magento / Adobe Commerce | Critical 9.1 |
| 2026-07-14 | CVE-2026-54433 Roundcube Webmail: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scri… | Roundcube Webmail | Critical 10.0 |
| 2026-07-14 | CVE-2026-62643 Roundcube Webmail: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sh… | Roundcube Webmail | Critical 10.0 |
| 2026-07-14 | CVE-2026-62644 Roundcube Webmail: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roun… | Roundcube Webmail | Critical 9.8 |
| 2026-07-13 | CVE-2026-13221 Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect re | Perl | Critical 9.1 |
| 2026-07-13 | CVE-2026-57432 Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S | Perl | High 8.4 |
| 2026-07-09 | CVE-2026-15308 Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations | Python (CPython) | High 8.7 |
| 2026-07-09 | CVE-2026-47829 Argument Injection in BOSH CLI Allows Local Command Execution on Operator Workstations via Compromised Director | OpenSSH | High 7.7 |
| 2026-07-08 | CVE-2026-59999 OpenSSH: In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over… | OpenSSH | High 7.5 |
| 2026-07-08 | CVE-2026-60000 OpenSSH: sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource… | OpenSSH | High 7.5 |
| 2026-07-08 | CVE-2026-60002 OpenSSH: ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key du… | OpenSSH | Critical 9.4 |
| 2026-07-03 | CVE-2026-20896 Gitea Docker images trust X-WEBAUTH-USER from any IP (user impersonation) | Critical 9.8 | |
| 2026-07-01 | CVE-2026-50195 containerd CRI checkpoint import poisons node image cache with any tag | containerd | Medium 5.6 |
| 2026-07-01 | CVE-2026-53488 containerd CRI passes image LABELs to containers, enabling host commands | containerd | Critical 9.4 |
| 2026-07-01 | CVE-2026-53492 containerd trusts CDI annotations in checkpoint images, injecting host devices | containerd | High 8.4 |
| 2026-06-26 | CVE-2026-48618 Node.js TLS wildcard-depth bypass via Unicode dot separators | Node.js | Medium 6.5 |
| 2026-06-26 | CVE-2026-48933 Node.js WebCrypto AES integer overflow aborts the process | Node.js | High 7.5 |
| 2026-06-19 | CVE-2026-44939 Rancher cluster import endpoint YAML injection runs attacker containers | Critical 9.4 | |
| 2026-06-09 | CVE-2026-45447 OpenSSL PKCS7_verify() heap use-after-free (High) | High 8.8 | |
| 2026-06-02 | CVE-2022-0492 Linux kernel cgroups v1 release_agent privilege escalation | Linux kernel | Exploited High 7.8 |
| 2026-05-26 | CVE-2026-4480 Samba print server command injection via %J in "print command" | Critical 9.0 | |
| 2026-05-22 | CVE-2026-9082 Drupal core SQL injection on PostgreSQL sites (SA-CORE-2026-004) | Drupal core | Exploited Critical 9.8 |
| 2026-05-12 | CVE-2026-45185 Exim BDAT use-after-free allows unauthenticated remote code execution | Critical 9.8 | |
| 2026-05-08 | CVE-2026-42208 LiteLLM proxy SQL injection in API key verification | Exploited Critical 9.3 | |
| 2026-05-04 | CVE-2026-23918 Apache httpd 2.4.66 HTTP/2 double free on early reset (important) | Apache HTTP Server | High 8.8 |
| 2026-05-01 | CVE-2026-31431 Linux kernel algif_aead page-cache write to root (Copy Fail) | Linux kernel | Exploited High 7.8 |
| 2026-04-30 | CVE-2026-41940 cPanel & WHM login-flow authentication bypass | cPanel & WHM | Exploited Critical 9.3 |
| 2026-04-16 | CVE-2026-34197 Apache ActiveMQ Jolokia MBean code injection (authenticated RCE) | Apache ActiveMQ | Exploited High 8.8 |
| 2026-03-30 | CVE-2026-21710 Node.js HTTP server crash via __proto__ header and req.headersDistinct | Node.js | High 7.5 |
| 2026-03-27 | CVE-2026-27876 Grafana SQL expressions arbitrary file write chained to remote code execution | Grafana | Critical 9.1 |
| 2026-03-24 | CVE-2026-33322 MinIO OIDC JWT algorithm confusion lets ClientSecret holders mint admin creds | Critical 9.2 | |
| 2026-03-20 | CVE-2025-32432 Craft CMS unauthenticated remote code execution (generate-transform) | Exploited Critical 10.0 | |
| 2026-03-11 | CVE-2025-68613 n8n workflow expression injection remote code execution | Exploited High 8.8 | |
| 2026-02-20 | CVE-2025-49113 Roundcube Webmail post-auth RCE via PHP object deserialization | Roundcube Webmail | Exploited High 8.8 |
| 2026-01-26 | CVE-2018-14634 Linux kernel create_elf_tables() integer overflow (Mutagen Astronomy) | Linux kernel | Exploited High 7.8 |
| 2026-01-26 | CVE-2026-24061 GNU InetUtils telnetd authentication bypass via USER="-f root" | Exploited Critical 9.8 | |
| 2026-01-20 | CVE-2025-55130 Node.js permission model bypass via crafted relative symlinks | Node.js | Critical 9.1 |
| 2026-01-20 | CVE-2025-55131 Node.js Buffer.alloc may return non-zeroed memory with vm timeouts | Node.js | High 7.1 |
| 2026-01-20 | CVE-2025-59465 Node.js HTTP/2 server crash on malformed HEADERS frame | Node.js | High 7.5 |
| 2026-01-20 | CVE-2026-21637 Node.js TLS server crash when PSK, ALPN or SNI callbacks throw | Node.js | High 7.5 |
| 2026-01-12 | CVE-2025-8110 Gogs PutContents API symlink file overwrite leading to RCE | Exploited High 8.7 | |
| 2025-12-29 | CVE-2025-14847 MongoDB Server zlib header length confusion leaks heap memory | MongoDB Server | Exploited High 8.7 |
| 2025-12-25 | CVE-2025-68937 Forgejo template repository symlinks let users overwrite server files | Gitea / Forgejo | Critical 9.5 |
| 2025-12-11 | CVE-2025-58360 GeoServer unauthenticated XXE via WMS GetMap | Exploited Critical 9.8 | |
| 2025-12-05 | CVE-2025-55182 React Server Components pre-auth remote code execution (React2Shell) | Exploited Critical 10.0 | |
| 2025-11-21 | CVE-2025-41115 Grafana Enterprise SCIM numeric externalId lets a user impersonate admins | Critical 9.8 | |
| 2025-11-04 | CVE-2025-48703 CWP (CentOS Web Panel) pre-auth command injection in file manager | Exploited Critical 9.0 | |
| 2025-10-09 | CVE-2025-11539 Grafana Image Renderer /render/csv arbitrary file write leads to RCE | Critical 9.9 | |
| 2025-09-29 | CVE-2025-32463 sudo --chroot local root via user-controlled nsswitch.conf | Exploited High 7.8 | |
| 2025-09-04 | CVE-2025-38352 Linux kernel posix-cpu-timers race condition (local privilege escalation) | Linux kernel | Exploited High 7.8 |
| 2025-09-04 | CVE-2025-55190 Argo CD project API leaks repository credentials to low-privilege API tokens | Critical 9.9 | |
| 2025-08-01 | CVE-2025-6000 HashiCorp Vault audit device file write lets privileged operator run host code | Critical 9.1 | |
| 2025-07-22 | CVE-2025-54309 CrushFTP AS2 validation flaw gives admin access over HTTPS | Exploited Critical 9.8 | |
| 2025-06-17 | CVE-2023-0386 Linux kernel OverlayFS setuid copy-up privilege escalation | Linux kernel | Exploited High 7.8 |
| 2025-06-10 | CVE-2025-24016 Wazuh server unsafe deserialization remote code execution | Exploited Critical 9.9 | |
| 2025-06-09 | CVE-2025-32433 Erlang/OTP SSH server unauthenticated remote code execution | Erlang/OTP | Exploited Critical 10.0 |
| 2025-05-05 | CVE-2025-3248 Langflow unauthenticated code injection in /api/v1/validate/code | Exploited Critical 9.8 | |
| 2025-05-01 | CVE-2024-38475 Apache HTTP Server mod_rewrite output escaping flaw (file mapping) | Apache HTTP Server | Exploited Critical 9.1 |
| 2025-04-07 | CVE-2025-31161 CrushFTP authentication bypass in AWS4-HMAC (S3) authorization | Exploited Critical 9.8 | |
| 2025-04-01 | CVE-2025-24813 Apache Tomcat partial PUT path equivalence (RCE / file disclosure) | Apache Tomcat | Exploited Critical 9.8 |
| 2025-03-24 | CVE-2025-1974 ingress-nginx admission controller unauthenticated RCE (IngressNightmare) | Kubernetes | Critical 9.8 |
How this list is made
A vulnerability is listed when it affects software commonly run on Linux or Unix servers and it is in the CISA Known Exploited Vulnerabilities catalog, or has a CVSS score of 9.0 or more, or 7.0 or more for core components such as the kernel, OpenSSH, OpenSSL, glibc, PHP or Node.js. Fix status comes from the Debian, Ubuntu and Red Hat security trackers. Pages stay online after they drop off this list.
New to patching? Start with the emergency patching playbook.