Skip to content
Noroxi

linuxfoundation records

604 published records for vendor linuxfoundation. 1 of them have been exploited in the wild (listed in CISA KEV) and 4 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
1 · 0.2%
Weaponized
4 · 0.7%
Pre-auth RCE
27
With a fix record
59.8%
Median publish → KEV
15 days

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

604 records
  • CVE-2026-45321
    69This week

    Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

    CriticalCVSS 9.6KEVWeaponizedEPSS 3%

    tanstack · tanstack/arktype-adapterMay 12, 2026

  • CVE-2019-5736
    64This week

    runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequen

    HighCVSS 8.6WeaponizedEPSS 98%

    docker · dockerFeb 11, 2019

  • CVE-2022-46770
    60This week

    qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows guest OS users to cause a denial of service (CPU consumpt

    HighCVSS 7.5WeaponizedEPSS 23%

    linuxfoundation · mirage firewallDec 7, 2022

  • CVE-2023-27584
    49Plan

    Dragonfly2 vulnerable to hard coded cyptographic key

    CriticalCVSS 9.8Proof of conceptEPSS 33%

    linuxfoundation · dragonflySep 19, 2024

  • CVE-2021-23450
    48Plan

    All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.

    CriticalCVSS 9.8No exploitEPSS 30%

    linuxfoundation · dojoDec 17, 2021

  • CVE-2010-5325
    41Plan

    Heap-based buffer overflow in the unhtmlify function in foomatic-rip in foomatic-filters before 4.0.6 allows remote attackers to cause a den

    CriticalCVSS 9.8No exploitEPSS 5%

    redhat · enterprise linux desktopApr 15, 2016

  • CVE-2024-21626
    40Plan

    runc container breakout through process.cwd trickery and leaked fds

    HighCVSS 8.6WeaponizedEPSS 18%

    linuxfoundation · runcJan 31, 2024

  • CVE-2019-1010245
    40Plan

    The Linux Foundation ONOS SDN Controller 1.15 and earlier versions is affected by: Improper Input Validation.

    CriticalCVSS 9.8No exploitEPSS 3%

    linuxfoundation · open network operating systemJul 19, 2019

  • CVE-2021-43832
    40Plan

    Improper Access Control in spinnaker

    CriticalCVSS 9.8No exploitEPSS 2%

    linuxfoundation · spinnakerJan 4, 2022

  • CVE-2020-26892
    40Plan

    The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled.

    CriticalCVSS 9.8No exploitEPSS 2%

    linuxfoundation · nats-serverNov 6, 2020

  • CVE-2023-35926
    40Plan

    Insecure sandbox in Backstage Scaffolder plugin

    CriticalCVSS 9.9No exploitEPSS 1%

    linuxfoundation · backstageJun 22, 2023

  • CVE-2020-27847
    40Plan

    A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation.

    CriticalCVSS 9.8No exploitEPSS 1%

    linuxfoundation · dexMay 28, 2021

  • CVE-2019-1010234
    40Plan

    The Linux Foundation ONOS 1.15.0 and ealier is affected by: Improper Input Validation.

    CriticalCVSS 9.8No exploitEPSS 1%

    linuxfoundation · open network operating systemJul 22, 2019

  • CVE-2022-35942
    40Plan

    loopback-connector-postgresql Vulnerable to Improper Sanitization of `contains` Filter

    CriticalCVSS 10.0No exploitEPSS 0%

    linuxfoundation · loopback-connector-postgresqlAug 12, 2022

  • CVE-2024-48063
    39Monitor

    In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE.

    CriticalCVSS 9.8No exploitEPSS 1%

    linuxfoundation · pytorchOct 29, 2024

  • CVE-2021-39228
    39Monitor

    Memory Safety Issue when using patch or merge on state and assign the result back to state

    CriticalCVSS 9.8No exploitEPSS 1%

    linuxfoundation · tremorSep 17, 2021

  • CVE-2022-45907
    39Monitor

    In PyTorch before trunk/89695, torch.jit.annotations.parse_type_line can cause arbitrary code execution because eval is used unsafely.

    CriticalCVSS 9.8No exploitEPSS 1%

    linuxfoundation · pytorchNov 25, 2022

  • CVE-2021-45701
    39Monitor

    An issue was discovered in the tremor-script crate before 0.11.6 for Rust.

    CriticalCVSS 9.8No exploitEPSS 1%

    linuxfoundation · tremor-scriptDec 26, 2021

  • CVE-2024-25626
    39Monitor

    Yocto Project Security Advisory - BitBake/Toaster

    CriticalCVSS 9.8No exploitEPSS 1%

    linuxfoundation · yoctoFeb 19, 2024

  • CVE-2026-104252
    39Monitor

    Vitess vttablet /twopcz reflected XSS

    CriticalCVSS 9.8No exploitEPSS 1%

    linuxfoundation · vitessOct 13, 2026

  • CVE-2022-28357
    39Monitor

    NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management accou

    CriticalCVSS 9.8No exploitEPSS 1%

    linuxfoundation · nats-serverSep 18, 2023

  • CVE-2020-6174
    39Monitor

    TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.

    CriticalCVSS 9.8No exploitEPSS 0%

    linuxfoundation · the update frameworkFeb 5, 2020

  • CVE-2024-24421
    39Monitor

    A type confusion in the nas_message_decode function of Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows

    CriticalCVSS 9.8No exploitEPSS 0%

    linuxfoundation · magmaJan 21, 2025

  • CVE-2021-32163
    39Monitor

    Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via case-sensitive JWT authorization.

    CriticalCVSS 9.8No exploitEPSS 0%

    linuxfoundation · modular open smart networkFeb 17, 2023

  • CVE-2026-29186
    39Monitor

    @backstage/plugin-techdocs-node: TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution

    CriticalCVSS 9.8No exploitEPSS 0%

    linuxfoundation · backstage plugin-techdocs-nodeMar 7, 2026