Fedoraproject vulnerabilities85 known to be exploited.
Fedoraproject has 5,392 published vulnerabilities across 22 products in our catalogue. 85 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Fedora, with 5,323. If you run Fedoraproject software, patch the exploited flaws first.
The most recent Fedoraproject flaw added to the known-exploited list is CVE-2022-0492, on 2 June 2026. We keep watching the known-exploited list.
Which Fedoraproject products have the most vulnerabilities?
Fedora leads with 5,323 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Fedoraproject vulnerabilities are being exploited?
85 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 7.8Linux Kernel Improper Authentication Vulnerability
Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.
- 7.8Apple Multiple Products Integer Overflow or Wraparound Vulnerability
Apple tvOS, macOS, Safari, iPadOS and watchOS contain an integer overflow or wraparound vulnerability due to the processing of maliciously crafted web content that may lead to arbitrary code execution.
- 7.5Rails Ruby on Rails Path Traversal Vulnerability
Rails Ruby on Rails contains a path traversal vulnerability in Action View.
- 6.9JQuery Cross-Site Scripting (XSS) Vulnerability
JQuery contains a persistent cross-site scripting (XSS) vulnerability.
- 6.1Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML attachment.
- 9.8PHP-CGI OS Command Injection Vulnerability
PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution.
- 7.8Linux Kernel Use-After-Free Vulnerability
Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation.
- 9.6Google Chromium V8 Type Confusion Vulnerability
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page.
Which Fedoraproject flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- >99%
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle...
- >99%
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via...
- >99%
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote...
- >99%CVE-2014-0195Medium
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows...
- 97%CVE-2016-9299Critical
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.
- 95%CVE-2014-0224High
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master...
- 94%CVE-2018-1111High
DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP client.
- 88%CVE-2014-0221Medium
The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a...
- 88%CVE-2017-11610High
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to...
All Fedoraproject products we track.
17 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- Fedorafedora5,323 vulnerabilities36 versions
- Extra Packages for Enterprise Linuxextra_packages_for_enterprise_linux76 vulnerabilities3 versions
- 389 Directory Server389_directory_server39 vulnerabilities185 versions
- Sssdsssd17 vulnerabilities112 versions
- Fedora Corefedora_core8 vulnerabilities7 versions
- 389 Administration Server389_administration_server1 vulnerability1 version
- Arm Installerarm_installer1 vulnerability1 version
- Coolkeycoolkey1 vulnerability1 version
- Crypto-Utilscrypto-utils1 vulnerability1 version
- Fedmsgfedmsg1 vulnerability60 versions
- Fedora Linux Kernelfedora_linux_kernel1 vulnerability1 version
- Python-Fedorapython-fedora1 vulnerability1 version
- Selinux-Policyselinux-policy1 vulnerability2 versions
- Spin-Kickstartsspin-kickstarts1 vulnerability67 versions
- Supybot-Fedorasupybot-fedora1 vulnerability17 versions
- Fedora Extra Packages for Enterprise Linuxfedora_extra_packages_for_enterprise_linux0 vulnerabilities1 version
- Mirrormanagermirrormanager0 vulnerabilities64 versions
This directory lists the 17 Fedoraproject products with at least one tracked version, of 22 in our catalogue.
Running Fedoraproject? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.
- Matched to
- Fedoraproject on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 5,392 published vulnerabilities across 22 products and 560 versions from Fedoraproject. The most recent Fedoraproject flaw added to the known-exploited list is CVE-2022-0492, on 2 June 2026.
85 Fedoraproject vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2022-0492, CVE-2021-30952 and CVE-2019-5418. The full list is on this page.
Fedora, with 5,323 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a EdgeProtect account and track the Fedoraproject products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.