# cve.now: Fedora

The newest entries naming Fedora as an affected vendor (up to 200), of 90 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-94422](https://cve.now/CVE-2026-94422.md): xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape (CVSS 8.8)
- [CVE-2026-19816](https://cve.now/CVE-2026-19816.md): PackageKit: dnf5 backend ignores SIMULATE on RepoRemove (CVSS 7.1)
- [CVE-2026-19624](https://cve.now/CVE-2026-19624.md): NetworkManager-l2tp: local privilege escalation via ipsec.conf injection (CVSS 7.8)
- [CVE-2024-2746](https://cve.now/CVE-2024-2746.md): Incomplete fix for CVE-2024-1929 (CVSS 8.8)
- [CVE-2024-1929](https://cve.now/CVE-2024-1929.md): Local Root Exploit via Configuration Dictionary (CVSS 7.5)
- [CVE-2024-1930](https://cve.now/CVE-2024-1930.md): No Limit on Number of Open Sessions / Bad Session Close Behaviour (CVSS 6.5)
- [CVE-2023-4235](https://cve.now/CVE-2023-4235.md): Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the decode\_deliver\_report() function (CVSS 8.1)
- [CVE-2023-4234](https://cve.now/CVE-2023-4234.md): Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the decode\_submit\_report() function (CVSS 8.1)
- [CVE-2023-4233](https://cve.now/CVE-2023-4233.md): Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the sms\_decode\_address\_field() function (CVSS 8.1)
- [CVE-2023-4232](https://cve.now/CVE-2023-4232.md): Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the decode\_status\_report() function (CVSS 8.1)
- [CVE-2023-3966](https://cve.now/CVE-2023-3966.md): Openvswsitch: ovs-vswitch fails to recover after malformed geneve metadata packet (CVSS 7.5)
- [CVE-2024-1312](https://cve.now/CVE-2024-1312.md): Kernel: race condition leads to use after free during vma lock in lock\_vma\_under\_rcu (CVSS 5.1)
- [CVE-2021-4435](https://cve.now/CVE-2021-4435.md): Yarn: untrusted search path (CVSS 7.7)
- [CVE-2023-6780](https://cve.now/CVE-2023-6780.md): Glibc: integer overflow in \_\_vsyslog\_internal() (CVSS 5.3)
- [CVE-2023-6779](https://cve.now/CVE-2023-6779.md): Glibc: off-by-one heap-based buffer overflow in \_\_vsyslog\_internal() (CVSS 8.2)
- [CVE-2023-6246](https://cve.now/CVE-2023-6246.md): Glibc: heap-based buffer overflow in \_\_vsyslog\_internal() (CVSS 8.4)
- [CVE-2023-6258](https://cve.now/CVE-2023-6258.md): Pkcs11-provider: side-channel proofing pkcs#1 1.5 paths (CVSS 8.1)
- [CVE-2023-6200](https://cve.now/CVE-2023-6200.md): Kernel: icmpv6 router advertisement packets, aka linux tcp/ip remote code execution vulnerability (CVSS 7.5)
- [CVE-2023-6395](https://cve.now/CVE-2023-6395.md): Mock: privilege escalation for users that can access mock configuration (CVSS 6.7)
- [CVE-2023-7090](https://cve.now/CVE-2023-7090.md): Sudo: improper handling of ipa\_hostname leads to privilege mismanagement (CVSS 6.6)
- [CVE-2023-4255](https://cve.now/CVE-2023-4255.md): W3m: out-of-bounds write in function checktype() in etc.c (incomplete fix for cve-2022-38223) (CVSS 5.5)
- [CVE-2023-4256](https://cve.now/CVE-2023-4256.md): Tcpreplay: tcprewrite: double free in tcpedit\_dlt\_cleanup() in plugins/dlt\_plugins.c (CVSS 5.5)
- [CVE-2023-3430](https://cve.now/CVE-2023-3430.md): Openimageio: heap-buffer-overflow in file src/gif.imageio/gifinput.cpp (CVSS 7.5)
- [CVE-2023-6560](https://cve.now/CVE-2023-6560.md): Kernel: io\_uring out of boundary memory access in \_\_io\_uaddr\_map() (CVSS 5.5)
- [CVE-2023-5972](https://cve.now/CVE-2023-5972.md): Kernel: the nfta\_inner\_num and nfta\_expr\_name netlink attributes accessed without checking its presence in nft\_inner.c (CVSS 7.0)
- [CVE-2023-6238](https://cve.now/CVE-2023-6238.md): Kernel: nvme: memory corruption via unprivileged user passthrough (CVSS 6.7)
- [CVE-2023-6039](https://cve.now/CVE-2023-6039.md): Kernel: use-after-free in drivers/net/usb/lan78xx.c in lan78xx\_disconnect (CVSS 5.5)
- [CVE-2023-4154](https://cve.now/CVE-2023-4154.md): Samba: ad dc password exposure to privileged users and rodcs (CVSS 7.5)
- [CVE-2023-1194](https://cve.now/CVE-2023-1194.md): Use-after-free in parse\_lease\_state() (CVSS 7.1)
- [CVE-2022-4900](https://cve.now/CVE-2022-4900.md): Potential buffer overflow in php\_cli\_server\_startup\_workers (CVSS 6.2)
- [CVE-2023-38473](https://cve.now/CVE-2023-38473.md): Reachable assertion in avahi\_alternative\_host\_name (CVSS 6.2)
- [CVE-2023-38472](https://cve.now/CVE-2023-38472.md): Reachable assertion in avahi\_rdata\_parse (CVSS 6.2)
- [CVE-2023-38471](https://cve.now/CVE-2023-38471.md): Reachable assertion in dbus\_set\_host\_name (CVSS 6.2)
- [CVE-2023-38470](https://cve.now/CVE-2023-38470.md): Reachable assertion in avahi\_escape\_label (CVSS 6.2)
- [CVE-2023-38469](https://cve.now/CVE-2023-38469.md): Reachable assertion in avahi\_dns\_packet\_append\_record (CVSS 6.2)
- [CVE-2023-3164](https://cve.now/CVE-2023-3164.md): Heap-buffer-overflow in extractimagesection() (CVSS 5.5)
- [CVE-2023-1193](https://cve.now/CVE-2023-1193.md): Use-after-free in setup\_async\_work() (CVSS 6.5)
- [CVE-2023-1192](https://cve.now/CVE-2023-1192.md): Use-after-free in smb2\_is\_status\_io\_timeout() (CVSS 6.5)
- [CVE-2023-5349](https://cve.now/CVE-2023-5349.md): Draw while calling getdrawinfo() (CVSS 5.3)
- [CVE-2023-42752](https://cve.now/CVE-2023-42752.md): Kernel: integer overflow in igmpv3\_newpack leading to exploitable memory access (CVSS 5.5)
- [CVE-2023-5366](https://cve.now/CVE-2023-5366.md): Openvswitch don't match packets on nd\_target field (CVSS 7.1)
- [CVE-2022-4132](https://cve.now/CVE-2022-4132.md): Memory leak on tls connections (CVSS 5.9)
- [CVE-2023-3153](https://cve.now/CVE-2023-3153.md): Service monitor mac flow is not rate limited (CVSS 5.3)
- [CVE-2023-4156](https://cve.now/CVE-2023-4156.md): Heap out of bound read in builtin.c (CVSS 4.4)
- [CVE-2023-5158](https://cve.now/CVE-2023-5158.md): Possible dos from guest to host invringh\_kiov\_advance in vhost driver at drivers/vhost/vringh.c (CVSS 6.5)
- [CVE-2023-25584](https://cve.now/CVE-2023-25584.md): Out of bounds read in parse\_module function in bfd/vms-alpha.c (CVSS 6.3)
- [CVE-2023-25585](https://cve.now/CVE-2023-25585.md): Field \`file\_table\` of \`struct module \*module\` is uninitialized (CVSS 4.7)
- [CVE-2023-25586](https://cve.now/CVE-2023-25586.md): Local variable \`ch\_type\` in function \`bfd\_init\_section\_decompress\_status\` can be uninitialized (CVSS 4.7)
- [CVE-2023-25588](https://cve.now/CVE-2023-25588.md): Field \`the\_bfd\` of \`asymbol\` is uninitialized in function \`bfd\_mach\_o\_get\_synthetic\_symtab\` (CVSS 4.7)
- [CVE-2023-32611](https://cve.now/CVE-2023-32611.md): G\_variant\_byteswap() can take a long time with some non-normal inputs (CVSS 5.5)
- [CVE-2023-29499](https://cve.now/CVE-2023-29499.md): Gvariant offset table entry size is not checked in is\_normal() (CVSS 5.5)
- [CVE-2023-32665](https://cve.now/CVE-2023-32665.md): Gvariant deserialisation does not match spec for non-normal data (CVSS 5.5)
- [CVE-2023-2680](https://cve.now/CVE-2023-2680.md): Dma reentrancy issue (incomplete fix for cve-2021-3750) (CVSS 7.5)
- [CVE-2023-4155](https://cve.now/CVE-2023-4155.md): Sev-es / sev-snp vmgexit double fetch vulnerability (CVSS 5.3)
- [CVE-2023-3301](https://cve.now/CVE-2023-3301.md): Triggerable assertion due to race condition in hot-unplug (CVSS 5.6)
- [CVE-2023-4611](https://cve.now/CVE-2023-4611.md): Use after free race between mbind() and vma-locked page fault (CVSS 7.0)
- [CVE-2023-4569](https://cve.now/CVE-2023-4569.md): Kernel: information leak in nft\_set\_catchall\_flush in net/netfilter/nf\_tables\_api.c (CVSS 5.5)
- [CVE-2023-4394](https://cve.now/CVE-2023-4394.md): Memory leak in btrfs\_get\_dev\_args\_from\_path() (CVSS 6.7)
- [CVE-2023-4389](https://cve.now/CVE-2023-4389.md): Kernel: btrfs: double free in btrfs\_get\_root\_ref() (CVSS 7.0)
- [CVE-2023-4135](https://cve.now/CVE-2023-4135.md): Out-of-bounds read information disclosure vulnerability (CVSS 6.0)
- [CVE-2023-3180](https://cve.now/CVE-2023-3180.md): Heap buffer overflow in virtio\_crypto\_sym\_op\_helper() (CVSS 6.0)
- [CVE-2023-32248](https://cve.now/CVE-2023-32248.md): Tree connection null pointer dereference denial-of-service vulnerability (CVSS 7.5)
- [CVE-2023-32257](https://cve.now/CVE-2023-32257.md): Session race condition remote code execution vulnerability (CVSS 8.1)
- [CVE-2023-32252](https://cve.now/CVE-2023-32252.md): Session null pointer dereference denial-of-service vulnerability (CVSS 7.5)
- [CVE-2023-32258](https://cve.now/CVE-2023-32258.md): Session race condition remote code execution vulnerability (CVSS 8.1)
- [CVE-2023-1386](https://cve.now/CVE-2023-1386.md): Qemu: 9pfs: suid/sgid bits not dropped on file write (CVSS 3.3)
- [CVE-2023-32247](https://cve.now/CVE-2023-32247.md): Session setup memory exhaustion denial-of-service vulnerability (CVSS 7.5)
- [CVE-2023-3748](https://cve.now/CVE-2023-3748.md): Inifinite loop in babld message parsing may cause dos (CVSS 3.5)
- [CVE-2023-2860](https://cve.now/CVE-2023-2860.md): Out-of-bounds read when setting hmac data (CVSS 4.4)
- [CVE-2023-3863](https://cve.now/CVE-2023-3863.md): Use-after-free in nfc\_llcp\_find\_loca in net/nfc/llcp\_core.c (CVSS 6.4)
- [CVE-2023-3603](https://cve.now/CVE-2023-3603.md): Processing sftp server read may cause null dereference (CVSS 3.1)
- [CVE-2023-0160](https://cve.now/CVE-2023-0160.md): Possibility of deadlock in libbpf function sock\_hash\_delete\_elem (CVSS 4.7)
- [CVE-2023-38253](https://cve.now/CVE-2023-38253.md): W3m: out of bounds read in growbuf\_to\_str() at w3m/indep.c (CVSS 4.7)
- [CVE-2023-3618](https://cve.now/CVE-2023-3618.md): Segmentation fault in fax3encode in libtiff/tif\_fax3.c (CVSS 6.5)
- [CVE-2023-3354](https://cve.now/CVE-2023-3354.md): Improper i/o watch removal in tls handshake can lead to remote unauthenticated denial of service (CVSS 7.5)
- [CVE-2023-1672](https://cve.now/CVE-2023-1672.md): Race condition exists in the key generation and rotation functionality (CVSS 5.3)
- [CVE-2023-3269](https://cve.now/CVE-2023-3269.md): Distros-\[dirtyvma\] privilege escalation via non-rcu-protected vma traversal (CVSS 7.8)
- [CVE-2023-34432](https://cve.now/CVE-2023-34432.md): Heap-buffer-overflow in src/formats\_i.c (CVSS 7.8)
- [CVE-2023-34318](https://cve.now/CVE-2023-34318.md): Heap-buffer-overflow in src/hcom.c (CVSS 7.8)
- [CVE-2023-32627](https://cve.now/CVE-2023-32627.md): Floating point exception in src/voc.c (CVSS 6.2)
- [CVE-2023-26590](https://cve.now/CVE-2023-26590.md): Floating point exception in src/aiff.c (CVSS 6.2)
- [CVE-2023-32254](https://cve.now/CVE-2023-32254.md): Tree connection race condition remote code execution vulnerability (CVSS 9.8)
- [CVE-2023-32250](https://cve.now/CVE-2023-32250.md): Session race condition remote code execution vulnerability (CVSS 9.0)
- [CVE-2023-1183](https://cve.now/CVE-2023-1183.md): Arbitrary file write (CVSS 5.0)
- [CVE-2023-3338](https://cve.now/CVE-2023-3338.md): Crash due to a null pointer dereference in the dn\_nsp\_send function (CVSS 6.5)
- [CVE-2023-2908](https://cve.now/CVE-2023-2908.md): Libtiff: null pointer dereference in tif\_dir.c (CVSS 5.5)
- [CVE-2023-3355](https://cve.now/CVE-2023-3355.md): Null pointer dereference in submit\_lookup\_cmds() in drivers/gpu/drm/msm/msm\_gem\_submit.c (CVSS 4.7)
- [CVE-2016-4983](https://cve.now/CVE-2016-4983.md): A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files. (no CVSS)
- [CVE-2018-1111](https://cve.now/CVE-2018-1111.md): DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager i (CVSS 7.5)
- [CVE-2010-3872](https://cve.now/CVE-2010-3872.md): Httpd: mod\_fcgid: stack-based buffer overflow in fcgid\_header\_bucket\_read() in modules/fcgid/fcgid\_bucket.c (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/fedora
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.