Known security vulnerabilities

CVE-2026-109618, CVE-2026-109619

CVSS 3.1: 9.8 actively exploited

Two memory flaws in PHP that can lead to remote code execution, actively exploited since October 2026.

CVE-2021-44228

CVSS 3.1: 10.0 actively exploited

Code execution through a single log message in Apache Log4j 2, rated CVSS 10.0.

CVE-2014-0160

CVSS 3.1: 7.5 actively exploited

The TLS heartbeat in OpenSSL 1.0.1 to 1.0.1f returned memory of the server process, private keys included.

CVE-2014-6271

CVSS 3.1: 9.8 actively exploited

Bash up to 4.3 ran commands hidden behind function definitions in environment variables.

CVE-2024-6387

CVSS 3.1: 8.1

A race condition in sshd from Portable OpenSSH 8.5p1 to 9.7p1 that can lead to root code execution.

CVE-2024-3094

CVSS 3.1: 10.0

Malicious code in the upstream tarballs of XZ Utils 5.6.0 and 5.6.1 that changes liblzma.

CVE-2023-44487

CVSS 3.1: 7.5 actively exploited

A denial-of-service attack on the HTTP/2 protocol that hits nginx, Node.js, Go, Tomcat and many more.

CVE-2023-4911

CVSS 3.1: 7.8 actively exploited

A buffer overflow in the dynamic loader of glibc that turns a local account into root.

CVE-2022-22965

CVSS 3.1: 9.8 actively exploited

Remote code execution through data binding in Spring MVC and Spring WebFlux on JDK 9 and later.

CVE-2022-0847

CVSS 3.1: 7.8 actively exploited

A local user writes into read-only files through the page cache and becomes root.

CVE-2021-3156

CVSS 3.1: 7.8 actively exploited

An off-by-one error in sudo that lets a local user become root through sudoedit.

CVE-2021-4034

CVSS 3.1: 7.8 actively exploited

pkexec from polkit executes environment variables as commands and makes any local account root.