How many CVEs does Linux Foundation have?

Linux Foundation has 579 published CVE records since 2011, including 230 in the last two years.

How many Linux Foundation CVEs are in CISA KEV?

Yes — 4 of Linux Foundation's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which Linux Foundation products have the most CVEs?

The Linux Foundation products with the most published CVEs are yocto, nats-server, pytorch, everest, harbor.

What are the most common weakness types in Linux Foundation CVEs?

Linux Foundation's CVEs most often map to these CWE weakness types: CWE-787 (Out-of-bounds Write), CWE-476 (NULL Pointer Dereference), CWE-400 (Uncontrolled Resource Consumption), CWE-125 (Out-of-bounds Read).

How many critical Linux Foundation vulnerabilities are there?

Linux Foundation has 54 critical and 218 high-severity CVEs.

What is the average severity of Linux Foundation CVEs?

The average CVSS base score across Linux Foundation's scored CVEs is 6.8.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

579 CVEs

4 in CISA KEV

Linux Foundation Vulnerabilities

Name: Linux Foundation vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for Linux Foundation.

579

Total CVEs

Published

4

In CISA KEV

Exploited in the wild

92

Public exploits

PoC or exploit code

6.8

Avg CVSS

2011–2026

Overview

Linux Foundation has 579 published CVE records since 2011, of which 4 are in CISA's Known Exploited Vulnerabilities catalog and 92 have a known public exploit. The average CVSS base score across scored CVEs is 6.8.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Linux Foundation products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on Linux Foundation's vulnerability posture, as a share of its 579 published CVEs.

Average CVSS: 6.8
Critical / high: 47%
Actively exploited (KEV): 1%
Public exploit available: 16%
Patch available: 74%

Severity and exploitation

How the CVSS severity of Linux Foundation's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical54

High218

Medium288

Low19

In CISA’s Known Exploited Vulnerabilities catalog

4

4 of Linux Foundation's CVEs are confirmed exploited in the wild.

Public exploits

92

92 of Linux Foundation's CVEs have a known public exploit available.

Most affected products

The Linux Foundation products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in Linux Foundation CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish Linux Foundation CVE records.

Disclosure activity by year

How many Linux Foundation CVEs were published each year.

2019

25

2020

43

2021

35

2022

43

2023

110

2024

68

2025

104

2026

126

Latest Linux Foundation CVEs

The most recently disclosed vulnerabilities affecting Linux Foundation.

NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled
CWE-248
High · CVSS 7.5
EPSS 0.6%2026-07-08
NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions
CWE-863
Medium · CVSS 5.4
EPSS 0.3%2026-07-08
NATS Server: Remote crash via integer overflow in Connz pagination
CWE-190
High · CVSS 7.7
EPSS 0.6%2026-07-08
NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory
CWE-400
High · CVSS 7.5
EPSS 0.7%2026-07-08
NATS Server: MQTT retained and QoS replay bypass subscribe deny filters
CWE-863
Medium · CVSS 4.3
EPSS 0.3%2026-07-08
NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217)
CWE-863
Medium · CVSS 4.3
EPSS 0.3%2026-07-08
NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check
CWE-863
Medium · CVSS 5.3
EPSS 0.3%2026-07-08
NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection
CWE-74
High · CVSS 7.1
EPSS 0.4%2026-07-08
NATS Server: Pre-auth server crash via double INFO in leafnode handshake
CWE-476
High · CVSS 7.5
EPSS 0.7%2026-07-08
NATS Server: Subscribe Authz Bypass via Wildcard-Overlap
CWE-285
Medium · CVSS 6.5
EPSS 0.5%2026-07-08
NATS Server: Route API Auth Bypass
CWE-287
High · CVSS 8.8
EPSS 0.4%2026-07-08
NATS Server: Queue Subscribe Authz Bypass
CWE-285
Medium · CVSS 6.5
EPSS 0.5%2026-07-08

Track new Linux Foundation CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor Linux Foundation CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

FreeBSD603 CVEs Symantec598 CVEs itsourcecode589 CVEs openclaw588 CVEs JetBrains580 CVEs TP-Link570 CVEs TYPO3565 CVEs zohocorp562 CVEs

Browse all vendors

Frequently asked questions

Common questions about Linux Foundation vulnerabilities.

How many CVEs does Linux Foundation have?: Linux Foundation has 579 published CVE records since 2011, including 230 in the last two years.
How many Linux Foundation CVEs are in CISA KEV?: Yes — 4 of Linux Foundation's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which Linux Foundation products have the most CVEs?: The Linux Foundation products with the most published CVEs are yocto, nats-server, pytorch, everest, harbor.
What are the most common weakness types in Linux Foundation CVEs?: Linux Foundation's CVEs most often map to these CWE weakness types: CWE-787 (Out-of-bounds Write), CWE-476 (NULL Pointer Dereference), CWE-400 (Uncontrolled Resource Consumption), CWE-125 (Out-of-bounds Read).
Are there public exploits for Linux Foundation vulnerabilities?: Yes — 92 of Linux Foundation's CVEs have a known public exploit.
How many critical Linux Foundation vulnerabilities are there?: Linux Foundation has 54 critical and 218 high-severity CVEs.
What is the average severity of Linux Foundation CVEs?: The average CVSS base score across Linux Foundation's scored CVEs is 6.8.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Linux Foundation vulnerabilities

Monitor new Linux Foundation vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing