Fedoraproject - vulnerabilities (CVEs)

5456 CVEs in 23 products, 10 in the last 30 days, newest from 2026-10-06.

Products

Fedora - 5368 CVEs
Extra Packages For Enterprise Linux - 77 CVEs
389 Directory Server - 39 CVEs
Sssd - 36 CVEs
Fedora Core - 8 CVEs
389 Administration Server - 1 CVEs
Anaconda - 1 CVEs
Arm Installer - 1 CVEs
Commons - 1 CVEs
Coolkey - 1 CVEs
Crypto-utils - 1 CVEs
Fedmsg - 1 CVEs
Fedora Linux Kernel - 1 CVEs
Python-fedora - 1 CVEs
Sectool - 1 CVEs
Selinux-policy - 1 CVEs
Spin-kickstarts - 1 CVEs
Supybot-fedora - 1 CVEs
Unbound - 1 CVEs
Atomic - 0 CVEs
Fedora Extra Packages For Enterprise Linux - 0 CVEs
Mirrormanager - 0 CVEs
Rpm Sequoia - 0 CVEs

Newest CVEs of Fedoraproject

CVE-2026-104045 - CVSS 4.7 (medium), 2026-10-06: A flaw was found in SSSD. A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs responder between asynchronous…
CVE-2026-104046 - CVSS 6.2 (medium), 2026-10-06: A flaw was found in SSSD (System Security Services Daemon). When Identity Provider (IdP) authentication is enabled, pre-authentication requests retain state…
CVE-2026-104048 - CVSS 8.1 (high), 2026-10-06: A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain…
CVE-2026-104047 - CVSS 5.3 (medium), 2026-10-06: A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query…
CVE-2026-88252 - CVSS 5.5 (medium), 2026-10-06: A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system handles…
CVE-2026-104040 - CVSS 6.1 (medium), 2026-10-06: A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before…
CVE-2026-104032 - CVSS 5.5 (medium), 2026-10-06: A flaw was found in SSSD. An unprivileged local user can repeatedly request master automount map updates through the autofs responder due to missing…
CVE-2026-104031 - CVSS 5.5 (medium), 2026-10-06: A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request processing is not…
CVE-2026-104029 - CVSS 5.5 (medium), 2026-10-05: A flaw was found in SSSD. A local attacker can exploit this vulnerability by sending a specially crafted request to the autofs responder UNIX socket. Due to…
CVE-2026-104030 - CVSS 5.5 (medium), 2026-10-05: A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service (DoS) by submitting a specially crafted passkey authentication…
CVE-2026-90462 - CVSS 5.4 (medium), 2026-09-22: A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `lockout`, a fail-open condition in the…
CVE-2026-90996 - CVSS 5.5 (medium), 2026-09-14: A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS)…
CVE-2026-90995 - CVSS 5.5 (medium), 2026-09-14: A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules)…
CVE-2026-77118 - CVSS 8.4 (high), 2026-08-20: A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pcd.c), the Huffman delta loop advances its output…
CVE-2026-68743 - CVSS 7.1 (high), 2026-08-04: A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer…
CVE-2026-68744 - CVSS 3.3 (low), 2026-08-04: A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink…
CVE-2026-68742 - CVSS 5.5 (medium), 2026-08-03: A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the remaining packet…
CVE-2026-12610 - CVSS 6.4 (medium), 2026-06-30: A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer…
CVE-2026-54230 - CVSS 7.8 (high), 2026-06-13: A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell…
CVE-2026-54231 - CVSS 5.5 (medium), 2026-06-13: A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log…
CVE-2026-6245 - CVSS 5.5 (medium), 2026-04-15: A flaw was found in the System Security Services Daemon (SSSD). The pam_passkey_child_read_data() function within the PAM passkey responder fails to properly…
CVE-2026-35093 - CVSS 8.8 (high), 2026-04-01: A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can…
CVE-2026-35094 - CVSS 5.5 (medium), 2026-04-01: A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can exploit a dangling pointer vulnerability.…
CVE-2023-4134 - CVSS 5.5 (medium), 2024-11-14: A use-after-free vulnerability was found in the cyttsp4_core driver in the Linux kernel. This issue occurs in the device cleanup routine due to a possible…
CVE-2024-3056 - CVSS 7.7 (high), 2024-08-02: A flaw was found in Podman. This issue may allow an attacker to create a specially crafted container that, when configured to share the same IPC with at least…
CVE-2024-6290 - CVSS 8.8 (high), 2024-06-24: Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…
CVE-2024-6291 - CVSS 8.8 (high), 2024-06-24: Use after free in Swiftshader in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML…
CVE-2024-6292 - CVSS 8.8 (high), 2024-06-24: Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…
CVE-2024-6293 - CVSS 8.8 (high), 2024-06-24: Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…
CVE-2024-38276 - CVSS 8.8 (high), 2024-06-18: Incorrect CSRF token checks resulted in multiple CSRF risks.