Linux Foundation vulnerabilities
We track 111 vulnerabilities in Linux Foundation products across 44 products. 111 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on October 7, 2026.
Latest Linux Foundation vulnerabilities
- 9.1 Critical severity
argo-cd: Improper Restriction of Excessive Authentication Attempts
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effectively bypass the rate limit and brute force protections by exploiting the application's weak cache-based mechanism. Thi
- 7.5 High severity
onnx: Improper Limitation of a Pathname to a Restricted Directory
Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory. The vulnerability
- 7.5 High severity
backstage: Improper Limitation of a Pathname to a Restricted Directory
`@backstage/backend-common` is a common functionality library for backends for Backstage, an open platform for building developer portals. In `@backstage/backend-common` prior to versions 0.21.1, 0.20.2, and 0.19.10, paths checks with the `resolveSafeChildPath
- 9.8 Critical severity
poky: Improper Neutralization of Special Elements used in an OS Command
Yocto Project is an open source collaboration project that helps developers create custom Linux-based systems regardless of the hardware architecture. In Yocto Projects Bitbake before 2.6.2 (before and included Yocto Project 4.3.1), with the Toaster server (in
- 7.5 High severity
nkeys: Use of Hard-coded Cryptographic Key
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authen
- 7.5 High severity
MT5221, MT6781, MT6833, MT6853, MT6853T…: Reachable Assertion
In wlan firmware, there is a possible firmware assertion due to improper input handling. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07932637; Issue
- 7.8 High severity
EVE OS: Use of Hard-coded Credentials
Due to the implementation of "deriveVaultKey", prior to version 7.10, the generated vault key would always have the last 16 bytes predetermined to be "arfoobarfoobarfo". This issue happens because "deriveVaultKey" calls "retrieveCloudKey" (which will always re
- 9.9 Critical severity
EVE OS: Allocation of Resources Without Limits or Throttling
As noted in the “VTPM.md” file in the eve documentation, “VTPM is a server listening on port 8877 in EVE, exposing limited functionality of the TPM to the clients. VTPM allows clients to execute tpm2-tools binaries from a list of hardcoded options” The communi
- 8.8 High severity
EVE OS: Insufficiently Protected Credentials
On boot, the Pillar eve container checks for the existence and content of “/config/authorized_keys”. If the file is present, and contains a supported public key, the container will go on to open port 22 and enable sshd with the given keys as the authorized key
- 8.8 High severity
EVE OS: Insufficient Verification of Data Authenticity
In EVE OS, the “measured boot” mechanism prevents a compromised device from accessing the encrypted data located in the vault. As per the “measured boot” design, the PCR values calculated at different stages of the boot process will change if any of their resp
- 8.8 High severity
EVE OS: Use of a Broken or Risky Cryptographic Algorithm
Vault Key Sealed With SHA1 PCRs The measured boot solution implemented in EVE OS leans on a PCR locking mechanism. Different parts of the system update different PCR values in the TPM, resulting in a unique value for each PCR entry. These PCRs are then used in
- 8.8 High severity
EVE OS: Insufficiently Protected Credentials
PCR14 is not in the list of PCRs that seal/unseal the “vault” key, but due to the change that was implemented in commit “7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4”, fixing this issue alone would not solve the problem of the config partition not being measured c
- 7.5 High severity
MT6739, MT6895, MT6983, MT8167, MT8168…: Integer Overflow or Wraparound
In wlan firmware, there is possible system crash due to an uncaught exception. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07664711; Issue ID: ALPS07
- 7.5 High severity
MT6739, MT8167, MT8168, MT8321, MT8365…: Improper Handling of Exceptional Conditions
In wlan firmware, there is possible system crash due to an uncaught exception. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07664720; Issue ID: ALPS07
- 7.5 High severity
MT6739, MT8167, MT8321, MT8365, MT8385…: Integer Overflow or Wraparound
In wlan firmware, there is possible system crash due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07664731; Issue ID: ALPS0766
- 7.5 High severity
MT6739, MT8167, MT8168, MT8321, MT8365…: Integer Overflow or Wraparound
In wlan firmware, there is possible system crash due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07664735; Issue ID: ALPS0766
- 7.5 High severity
MT6739, MT8167, MT8321, MT8365, MT8385…: Integer Overflow or Wraparound
In wlan firmware, there is possible system crash due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07664741; Issue ID: ALPS0766
- 8.8 High severity
kubewarden: Improper Privilege Management
An Improper Privilege Management vulnerability in SUSE kubewarden allows attackers to read arbitrary secrets if they get access to the ServiceAccount kubewarden-controller This issue affects: SUSE kubewarden kubewarden-controller versions prior to 1.6.0.
- 8.8 High severity
open-feature-operator: Improper Privilege Management
The OpenFeature Operator allows users to expose feature flags to applications. Assuming the pre-existence of a vulnerability that allows for arbitrary code execution, an attacker could leverage the lax permissions configured on `open-feature-operator-controlle
- 7.0 High severity
Runc: Use of Incorrectly-Resolved Name or Reference
runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom i
- 7.5 High severity
Harbor: Missing Authentication for Critical Functionality
An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and private image repositories without authentication. NOTE: the vendor's position is that this "is clearly described in the documentation as a feature."
- 7.5 High severity
Mirage Firewall: Loop with Unreachable Exit Condition
qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows guest OS users to cause a denial of service (CPU consumption and loss of forwarding) via a crafted multicast UDP packet (IP address range of 224.0.0.0 through 239.255.255.255).
- 7.5 High severity
Opendaylight: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection issue was discovered in AAA in OpenDaylight (ODL) before 0.16.5. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/RoleStore.java deleteRole function is affected when the API interface /auth/v1/roles/ is used.
- 7.5 High severity
Opendaylight: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection issue was discovered in AAA in OpenDaylight (ODL) before 0.16.5. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/UserStore.java deleteUser function is affected when the API interface /auth/v1/users/ is used.
- 7.5 High severity
Opendaylight: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection issue was discovered in AAA in OpenDaylight (ODL) before 0.16.5. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/DomainStore.java deleteDomain function is affected for the /auth/v1/domains/ API interface.
- 7.4 High severity
func: Exposure of Sensitive Information to an Unauthorized Actor
knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a malicious or compromised third-party buildpack could expose their registry credentials or local docker socket to a malicious `li
- 7.5 High severity
Software for Open Networking in the Cloud…: Buffer Copy without Checking Size of Input
There is a vulnerability in DHCPv6 packet parsing code that could be explored by remote attacker to craft a packet that could cause buffer overflow in a memcpy call, leading to out-of-bounds memory write that would cause dhcp6relay to crash. Dhcp6relay is a cr
- 7.5 High severity
MT6761, MT6762, MT6765, MT6768, MT6779…: Improper Resource Shutdown or Release
In Wi-Fi driver, there is a possible way to disconnect Wi-Fi due to an improper resource release. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS0703060
- 9.1 Critical severity
Rocket Chip Generator: Use of a Broken or Risky Cryptographic Algorithm
Rocket-Chip commit 4f8114374d8824dfdec03f576a8cd68bebce4e56 was discovered to contain insufficient cryptography via the component /rocket/RocketCore.scala.
- 8.8 High severity
Nats-server: Missing Authorization
NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox accounts" feature.
- 7.8 High severity
Linux Kernel Integer Overflow Exploited
An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x