Linuxfoundation
Page 2 of 6 — Linuxfoundation CVEs from a corpus of 557, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-29185 | Low | 2.7 | 2026-03-07 | Backstage is an open framework for building developer portals. Prior to version 1.20.1, a vulnerability in the SCM URL parsing used by Backstage integrations a… |
CVE-2026-29184 | Low | 2.0 | 2026-03-07 | Backstage is an open framework for building developer portals. Prior to version 3.1.4, a malicious scaffolder template can bypass the log redaction mechanism t… |
CVE-2026-20435 | Medium | 4.6 | 2026-03-02 | In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local information disclosure, if an attacker has p… |
CVE-2026-27969 | High | 8.8 | 2026-02-26 | Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storag… |
CVE-2026-27965 | Critical | 9.9 | 2026-02-26 | Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storag… |
CVE-2026-27571 | Medium | 5.9 | 2026-02-24 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling of NATS messages handles compressed mes… |
CVE-2026-27134 | High | 8.1 | 2026-02-21 | Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In versions 0.49.0 through 0.50.0, when… |
CVE-2026-27133 | Medium | 5.9 | 2026-02-20 | Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 to before 0.50.1, when a cha… |
CVE-2026-25996 | Critical | 9.8 | 2026-02-12 | Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. String fields fro… |
CVE-2026-25804 | Critical | 9.1 | 2026-02-06 | Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to versions 2.3.2 and 2.4.3, Antrea's network policy priority assignment sys… |
CVE-2026-25153 | High | 7.7 | 2026-01-30 | Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In ver… |
CVE-2026-25152 | Medium | 5.3 | 2026-01-30 | Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In ver… |
CVE-2026-24905 | High | 7.8 | 2026-01-29 | Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. The `ig` binary p… |
CVE-2026-24835 | High | 7.1 | 2026-01-28 | Podman Desktop is a graphical tool for developing on containers and Kubernetes. A critical authentication bypass vulnerability in Podman Desktop prior to versi… |
CVE-2026-24747 | High | 8.8 | 2026-01-27 | PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `weights_only` unpickler allows an attacker… |
CVE-2026-24408 | Unrated | | 2026-01-26 | sigstore-python is a Python tool for generating and verifying Sigstore signatures. Prior to version 4.2.0, the sigstore-python OAuth authentication flow is sus… |
CVE-2026-24003 | Medium | 4.3 | 2026-01-26 | EVerest is an EV charging software stack. In versions up to and including 2025.12.1, it is possible to bypass the sequence state verification including authent… |
CVE-2026-24124 | Critical | 9.8 | 2026-01-22 | Dragonfly is an open source P2P-based file distribution and image acceleration system. In versions 2.4.1-rc.0 and below, the Job API endpoints (/api/v1/jobs) l… |
CVE-2026-24117 | Medium | 5.3 | 2026-01-22 | Rekor is a software supply chain transparency log. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary internal services because /api/v1/index… |
CVE-2026-23831 | Medium | 5.3 | 2026-01-22 | Rekor is a software supply chain transparency log. In versions 1.4.3 and below, the entry implementation can panic on attacker-controlled input when canonicali… |
CVE-2026-24048 | Low | 3.5 | 2026-01-21 | Backstage is an open framework for building developer portals, and @backstage/backend-defaults provides the default implementations and setup for a standard Ba… |
CVE-2026-23955 | Medium | 4.2 | 2026-01-21 | EVerest is an EV charging software stack. Prior to version 2025.9.0, in several places, integer values are concatenated to literal strings when throwing errors… |
CVE-2025-68141 | High | 7.4 | 2026-01-21 | EVerest is an EV charging software stack. Prior to version 2025.10.0, during the deserialization of a `DC_ChargeLoopRes` message that includes Receipt as well… |
CVE-2025-68140 | Medium | 4.3 | 2026-01-21 | EVerest is an EV charging software stack. Prior to version 2025.9.0, once the validity of the received V2G message has been verified, it is checked whether the… |
CVE-2025-68139 | Medium | 4.3 | 2026-01-21 | EVerest is an EV charging software stack. In all versions up to and including 2025.12.1, the default value for `terminate_connection_on_failed_response` is `Fa… |
CVE-2025-68138 | Medium | 4.7 | 2026-01-21 | EVerest is an EV charging software stack, and EVerest libocpp is a C++ implementation of the Open Charge Point Protocol. In libocpp prior to version 0.30.1, po… |
CVE-2025-68137 | High | 8.3 | 2026-01-21 | EVerest is an EV charging software stack. Prior to version 2025.10.0, an integer overflow occurring in `SdpPacket::parse_header()` allows the current buffer le… |
CVE-2025-68136 | High | 7.4 | 2026-01-21 | EVerest is an EV charging software stack. Prior to version 2025.10.0, once the module receives a SDP request, it creates a whole new set of objects like `Sessi… |
CVE-2025-68135 | Medium | 6.5 | 2026-01-21 | EVerest is an EV charging software stack. Prior to version 2025.10.0, C++ exceptions are not properly handled for and by the `TbdController` loop, leading to i… |
CVE-2025-68134 | High | 7.4 | 2026-01-21 | EVerest is an EV charging software stack. Prior to version 2025.10.0, the use of the `assert` function to handle errors frequently causes the module to crash… |
CVE-2025-68132 | Medium | 4.6 | 2026-01-21 | EVerest is an EV charging software stack. Prior to version 2025.12.0, `is_message_crc_correct` in the DZG_GSH01 powermeter SLIP parser reads `vec[vec.size()-1]… |
CVE-2025-68133 | High | 7.4 | 2026-01-21 | EVerest is an EV charging software stack. In versions 2025.9.0 and below, an attacker can exhaust the operating system's memory and cause the module to termina… |
CVE-2026-22772 | Medium | 5.8 | 2026-01-12 | Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.5, Fulcio's metaRegex() function us… |
CVE-2025-61916 | High | 7.9 | 2026-01-05 | Spinnaker is an open source, multi-cloud continuous delivery platform. Versions prior to 2025.1.6, 2025.2.3, and 2025.3.0 are vulnerable to server-side request… |
CVE-2025-69261 | High | 7.5 | 2025-12-30 | WasmEdge is a WebAssembly runtime. Prior to version 0.16.0-alpha.3, a multiplication in `WasmEdge/include/runtime/instance/memory.h` can wrap, causing `checkAc… |
CVE-2025-65566 | High | 7.5 | 2025-12-18 | A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. When the UPF receives a PFCP Ses… |
CVE-2025-67508 | High | 8.4 | 2025-12-12 | gardenctl is a command-line client for the Gardener which configures access to clusters and cloud provider CLI tools. When using non‑POSIX shells such as Fish… |
CVE-2025-67499 | Medium | 6.6 | 2025-12-10 | The CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the container. Versions 1.6.0 through 1.8.0 inadvertently… |
CVE-2025-66623 | High | 7.4 | 2025-12-05 | Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 and prior to 0.49.1, in some… |
CVE-2025-66564 | High | 7.5 | 2025-12-04 | Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits (via a call to string… |
CVE-2025-66506 | High | 7.5 | 2025-12-04 | Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.ex… |
CVE-2025-20765 | Medium | 4.7 | 2025-12-02 | In aee daemon, there is a possible system crash due to a race condition. This could lead to local denial of service if a malicious actor has already obtained t… |
CVE-2025-63396 | Low | 3.3 | 2025-11-12 | An issue was discovered in PyTorch v2.5 and v2.7.1. Omission of profiler.stop() can cause torch.profiler.profile (PythonTracer) to crash or hang during finaliz… |
CVE-2025-64329 | Medium | 5.5 | 2025-11-07 | containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2… |
CVE-2025-52881 | High | 7.5 | 2025-11-06 | runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc… |
CVE-2025-52565 | High | 7.5 | 2025-11-06 | runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4… |
CVE-2025-31133 | High | 7.8 | 2025-11-06 | runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 an… |
CVE-2024-25621 | High | 7.3 | 2025-11-06 | containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through… |
CVE-2025-20747 | Medium | 6.7 | 2025-11-04 | In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious acto… |
CVE-2025-20746 | Medium | 6.7 | 2025-11-04 | In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious acto… |
CVE-2025-20730 | Medium | 6.7 | 2025-11-04 | In preloader, there is a possible escalation of privilege due to an insecure default value. This could lead to local escalation of privilege if a malicious act… |
CVE-2025-55560 | High | 7.5 | 2025-09-25 | An issue in pytorch v2.7.0 can lead to a Denial of Service (DoS) when a PyTorch model consists of torch.Tensor.to_sparse() and torch.Tensor.to_dense() and is c… |
CVE-2025-55558 | High | 7.5 | 2025-09-25 | A buffer overflow occurs in pytorch v2.7.0 when a PyTorch model consists of torch.nn.Conv2d, torch.nn.functional.hardshrink, and torch.Tensor.view-torch.mv() a… |
CVE-2025-55557 | High | 7.5 | 2025-09-25 | A Name Error occurs in pytorch v2.7.0 when a PyTorch model consists of torch.cummin and is compiled by Inductor, leading to a Denial of Service (DoS). |
CVE-2025-55554 | Medium | 5.3 | 2025-09-25 | pytorch v2.8.0 was discovered to contain an integer overflow in the component torch.nan_to_num-.long(). |
CVE-2025-55553 | High | 7.5 | 2025-09-25 | A syntax error in the component proxy_tensor.py of pytorch v2.7.0 allows attackers to cause a Denial of Service (DoS). |
CVE-2025-55552 | High | 7.5 | 2025-09-25 | pytorch v2.8.0 was discovered to display unexpected behavior when the components torch.rot90 and torch.randn_like are used together. |
CVE-2025-55551 | High | 7.5 | 2025-09-25 | An issue in the component torch.linalg.lu of pytorch v2.8.0 allows attackers to cause a Denial of Service (DoS) when performing a slice operation. |
CVE-2025-46153 | Medium | 5.3 | 2025-09-25 | PyTorch before 3.7.0 has a bernoulli_p decompose function in decompositions.py even though it lacks full consistency with the eager CPU implementation, negativ… |
CVE-2025-46152 | Medium | 5.3 | 2025-09-25 | In PyTorch before 2.7.0, bitwise_right_shift produces incorrect output for certain out-of-bounds values of the "other" argument. |
CVE-2025-46150 | Medium | 5.3 | 2025-09-25 | In PyTorch before 2.7.0, when torch.compile is used, FractionalMaxPool2d has inconsistent results. |
CVE-2025-46149 | Medium | 5.3 | 2025-09-25 | In PyTorch before 2.7.0, when inductor is used, nn.Fold has an assertion error. |
CVE-2025-46148 | Medium | 5.3 | 2025-09-25 | In PyTorch through 2.6.0, when eager is used, nn.PairwiseDistance(p=2) produces incorrect results. |
CVE-2025-59410 | Low | 3.7 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the code in the scheduler for downloading a tiny file is… |
CVE-2025-59354 | Medium | 5.3 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the DragonFly2 uses a variety of hash functions, includi… |
CVE-2025-59353 | High | 7.5 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, a peer can obtain a valid TLS certificate for arbitrary… |
CVE-2025-59352 | Critical | 9.8 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the gRPC API and HTTP APIs allow peers to send requests… |
CVE-2025-59351 | Medium | 5.3 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the first return value of a function is dereferenced eve… |
CVE-2025-59350 | Medium | 5.3 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the access control mechanism for the Proxy feature uses… |
CVE-2025-59349 | Low | 3.3 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, DragonFly2 uses the os.MkdirAll function to create certa… |
CVE-2025-59348 | High | 7.5 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the processPieceFromSource method does not update the st… |
CVE-2025-59347 | Medium | 6.5 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The Manager disables TLS certificate verification in HTT… |
CVE-2025-59346 | Medium | 5.3 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Versions prior to 2.1.0 contain a server-side request forgery (SSRF) vul… |
CVE-2025-59345 | Critical | 9.1 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The /api/v1/jobs and /preheats endpoints in Manager web… |
CVE-2025-20705 | High | 7.8 | 2025-09-01 | In monitor_hang, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already… |
CVE-2025-20696 | Medium | 6.8 | 2025-08-04 | In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical acc… |
CVE-2025-53012 | High | 7.5 | 2025-08-01 | MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, nested impor… |
CVE-2025-53011 | High | 7.5 | 2025-08-01 | MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, when parsing… |
CVE-2025-53010 | High | 7.5 | 2025-08-01 | MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, when parsing… |
CVE-2025-53009 | High | 7.5 | 2025-08-01 | MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In versions 1.39.2 and below, w… |
CVE-2025-51480 | High | 8.8 | 2025-07-22 | Path Traversal vulnerability in onnx.external_data_helper.save_external_data in ONNX 1.17.0 allows attackers to overwrite arbitrary files by supplying crafted… |
CVE-2025-20693 | Medium | 6.5 | 2025-07-08 | In wlan STA driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote (proximal/adjacent) information disclosu… |
CVE-2025-5150 | Medium | 6.3 | 2025-05-25 | A vulnerability was found in docarray up to 0.40.1. It has been rated as critical. Affected by this issue is the function __getitem__ of the file /docarray/dat… |
CVE-2025-47291 | High | 7.5 | 2025-05-21 | containerd is an open-source container runtime. A bug was found in the containerd's CRI implementation where containerd, starting in version 2.0.1 and prior to… |
CVE-2025-47290 | Medium | 5.9 | 2025-05-20 | containerd is a container runtime. A time-of-check to time-of-use (TOCTOU) vulnerability was found in containerd v2.1.0. While unpacking an image during an ima… |
CVE-2025-32434 | Critical | 9.8 | 2025-04-18 | PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In ve… |
CVE-2025-3730 | Low | 3.3 | 2025-04-16 | A vulnerability, which was classified as problematic, was found in PyTorch 2.6.0. Affected is the function torch.nn.functional.ctc_loss of the file aten/src/AT… |
CVE-2025-20656 | Medium | 6.8 | 2025-04-07 | In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical acc… |
CVE-2025-3136 | Low | 3.3 | 2025-04-03 | A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0. This issue affects the function torch.cuda.memory.caching_allocator_dele… |
CVE-2025-3121 | Low | 3.3 | 2025-04-02 | A vulnerability classified as problematic has been found in PyTorch 2.6.0. Affected is the function torch.jit.jit_module_from_flatbuffer. The manipulation lead… |
CVE-2025-3001 | Medium | 5.3 | 2025-03-31 | A vulnerability classified as critical was found in PyTorch 2.6.0. This vulnerability affects the function torch.lstm_cell. The manipulation leads to memory co… |
CVE-2025-3000 | Medium | 5.3 | 2025-03-31 | A vulnerability classified as critical has been found in PyTorch 2.6.0. This affects the function torch.jit.script. The manipulation leads to memory corruption… |
CVE-2025-2999 | Medium | 5.3 | 2025-03-31 | A vulnerability was found in PyTorch 2.6.0. It has been rated as critical. Affected by this issue is the function torch.nn.utils.rnn.unpack_sequence. The manip… |
CVE-2025-2998 | Medium | 5.3 | 2025-03-31 | A vulnerability was found in PyTorch 2.6.0. It has been declared as critical. Affected by this vulnerability is the function torch.nn.utils.rnn.pad_packed_sequ… |
CVE-2025-2953 | Low | 3.3 | 2025-03-30 | A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0+cu124. Affected by this issue is the function torch.mkldnn_max_pool2d. Th… |
CVE-2024-53351 | Critical | 9.8 | 2025-03-21 | Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalation of privileges. |
CVE-2024-53349 | High | 7.4 | 2025-03-21 | Insecure permissions in kuadrant v0.11.3 allow attackers to gain access to the service account's token, leading to escalation of privileges via the secretes co… |
CVE-2024-40635 | Medium | 4.6 | 2025-03-17 | containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User… |
CVE-2025-2149 | Low | 2.5 | 2025-03-10 | A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function nnq_Sigmoid of the component Quantiz… |
CVE-2025-2148 | Medium | 5.0 | 2025-03-10 | A vulnerability was found in PyTorch 2.6.0+cu124. It has been declared as critical. Affected by this vulnerability is the function torch.ops.profiler._call_end… |