# Fedoraproject vulnerabilities

> Fedoraproject has 5,392 published vulnerabilities across 22 products in our catalogue. 86 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Fedora, with 5,323. If you run Fedoraproject software, patch the exploited flaws first.

Canonical page: https://www.precursorintelligence.com/vendors/fedoraproject

## At a glance

- **Published vulnerabilities:** 5,392
- **Known to be exploited:** 86
- **Products:** 22
- **Versions:** 560
- **Most recently added to the known-exploited list:** [CVE-2022-0995](https://www.precursorintelligence.com/what-is/cve-2022-0995), 26 August 2026. We keep watching the list.

## Which Fedoraproject products have the most vulnerabilities?

- [Fedora](https://www.precursorintelligence.com/product/fedoraproject/fedora): 5,323 published vulnerabilities, 36 versions
- [Extra Packages for Enterprise Linux](https://www.precursorintelligence.com/product/fedoraproject/extra_packages_for_enterprise_linux): 76 published vulnerabilities, 3 versions
- [389 Directory Server](https://www.precursorintelligence.com/product/fedoraproject/389_directory_server): 39 published vulnerabilities, 185 versions
- [Sssd](https://www.precursorintelligence.com/product/fedoraproject/sssd): 17 published vulnerabilities, 112 versions
- [Fedora Core](https://www.precursorintelligence.com/product/fedoraproject/fedora_core): 8 published vulnerabilities, 7 versions
- [Coolkey](https://www.precursorintelligence.com/product/fedoraproject/coolkey): 1 published vulnerability, 1 version
- [Crypto-Utils](https://www.precursorintelligence.com/product/fedoraproject/crypto-utils): 1 published vulnerability, 1 version
- [Fedmsg](https://www.precursorintelligence.com/product/fedoraproject/fedmsg): 1 published vulnerability, 60 versions
- [Fedora Linux Kernel](https://www.precursorintelligence.com/product/fedoraproject/fedora_linux_kernel): 1 published vulnerability, 1 version
- [Unbound](https://www.precursorintelligence.com/product/fedoraproject/unbound): 1 published vulnerability, 0 versions

Each product page lists its own known-exploited flaws.

## Which Fedoraproject vulnerabilities are being exploited?

86 flaws are on the government list of vulnerabilities known to be exploited, newest first:

- [CVE-2022-0995](https://www.precursorintelligence.com/what-is/cve-2022-0995): Linux Kernel Out-of-Bounds Write Vulnerability. High, CVSS 7.8, chance of use in 30 days 8.9%, known exploited since 26 August 2026.
- [CVE-2022-0492](https://www.precursorintelligence.com/what-is/cve-2022-0492): Linux Kernel Improper Authentication Vulnerability. High, CVSS 7.8, chance of use in 30 days 5.5%, known exploited since 2 June 2026.
- [CVE-2021-30952](https://www.precursorintelligence.com/what-is/cve-2021-30952): Apple Multiple Products Integer Overflow or Wraparound Vulnerability. High, CVSS 7.8, chance of use in 30 days 7.0%, known exploited since 5 March 2026.
- [CVE-2019-5418](https://www.precursorintelligence.com/what-is/cve-2019-5418): Rails Ruby on Rails Path Traversal Vulnerability. High, CVSS 7.5, chance of use in 30 days 99%, known exploited since 7 July 2025.
- [CVE-2020-11023](https://www.precursorintelligence.com/what-is/cve-2020-11023): JQuery Cross-Site Scripting (XSS) Vulnerability. Medium, CVSS 6.9, chance of use in 30 days 85%, known exploited since 23 January 2025.
- [CVE-2020-13965](https://www.precursorintelligence.com/what-is/cve-2020-13965): Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability. Medium, CVSS 6.1, chance of use in 30 days 77%, known exploited since 26 June 2024.
- [CVE-2024-4577](https://www.precursorintelligence.com/what-is/cve-2024-4577): PHP-CGI OS Command Injection Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 12 June 2024.
- [CVE-2024-1086](https://www.precursorintelligence.com/what-is/cve-2024-1086): Linux Kernel Use-After-Free Vulnerability. High, CVSS 7.8, chance of use in 30 days 28%, known exploited since 30 May 2024.
- [CVE-2024-5274](https://www.precursorintelligence.com/what-is/cve-2024-5274): Google Chromium V8 Type Confusion Vulnerability. Critical, CVSS 9.6, chance of use in 30 days 7.5%, known exploited since 28 May 2024.
- [CVE-2024-4947](https://www.precursorintelligence.com/what-is/cve-2024-4947): Google Chromium V8 Type Confusion Vulnerability. Critical, CVSS 9.6, chance of use in 30 days 15%, known exploited since 20 May 2024.
- [CVE-2024-4761](https://www.precursorintelligence.com/what-is/cve-2024-4761): Google Chromium V8 Out-of-Bounds Memory Write Vulnerability. High, CVSS 8.8, chance of use in 30 days 11%, known exploited since 16 May 2024.
- [CVE-2024-4671](https://www.precursorintelligence.com/what-is/cve-2024-4671): Google Chromium Visuals Use-After-Free Vulnerability. Critical, CVSS 9.6, chance of use in 30 days 8.3%, known exploited since 13 May 2024.
- [CVE-2023-4762](https://www.precursorintelligence.com/what-is/cve-2023-4762): Google Chromium V8 Type Confusion Vulnerability. High, CVSS 8.8, chance of use in 30 days 41%, known exploited since 6 February 2024.
- [CVE-2024-0519](https://www.precursorintelligence.com/what-is/cve-2024-0519): Google Chromium V8 Out-of-Bounds Memory Access Vulnerability. High, CVSS 8.8, chance of use in 30 days 3.8%, known exploited since 17 January 2024.
- [CVE-2023-7024](https://www.precursorintelligence.com/what-is/cve-2023-7024): Google Chromium WebRTC Heap Buffer Overflow Vulnerability. High, CVSS 8.8, chance of use in 30 days 6.7%, known exploited since 2 January 2024.
- [CVE-2023-7101](https://www.precursorintelligence.com/what-is/cve-2023-7101): Spreadsheet::ParseExcel Remote Code Execution Vulnerability. High, CVSS 7.8, chance of use in 30 days 19%, known exploited since 2 January 2024.
- [CVE-2023-42917](https://www.precursorintelligence.com/what-is/cve-2023-42917): Apple Multiple Products WebKit Memory Corruption Vulnerability. High, CVSS 8.8, chance of use in 30 days 9.3%, known exploited since 4 December 2023.
- [CVE-2023-42916](https://www.precursorintelligence.com/what-is/cve-2023-42916): Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability. Medium, CVSS 6.5, chance of use in 30 days 18%, known exploited since 4 December 2023.
- [CVE-2023-6345](https://www.precursorintelligence.com/what-is/cve-2023-6345): Google Skia Integer Overflow Vulnerability. Critical, CVSS 9.6, chance of use in 30 days 16%, known exploited since 30 November 2023.
- [CVE-2023-4911](https://www.precursorintelligence.com/what-is/cve-2023-4911): GNU C Library Buffer Overflow Vulnerability. High, CVSS 7.8, chance of use in 30 days 64%, known exploited since 21 November 2023.
- [CVE-2023-5631](https://www.precursorintelligence.com/what-is/cve-2023-5631): Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability. Medium, CVSS 6.1, chance of use in 30 days 76%, known exploited since 26 October 2023.
- [CVE-2023-44487](https://www.precursorintelligence.com/what-is/cve-2023-44487): HTTP/2 Rapid Reset Attack Vulnerability. High, CVSS 7.5, chance of use in 30 days >99%, known exploited since 10 October 2023.
- [CVE-2023-5217](https://www.precursorintelligence.com/what-is/cve-2023-5217): Google Chromium libvpx Heap Buffer Overflow Vulnerability. High, CVSS 8.8, chance of use in 30 days 49%, known exploited since 2 October 2023.
- [CVE-2023-41993](https://www.precursorintelligence.com/what-is/cve-2023-41993): Apple Multiple Products WebKit Code Execution Vulnerability. High, CVSS 8.8, chance of use in 30 days 24%, known exploited since 25 September 2023.
- [CVE-2023-4863](https://www.precursorintelligence.com/what-is/cve-2023-4863): Google Chromium WebP Heap-Based Buffer Overflow Vulnerability. High, CVSS 8.8, chance of use in 30 days >99%, known exploited since 13 September 2023.
- [CVE-2023-38180](https://www.precursorintelligence.com/what-is/cve-2023-38180): Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability. High, CVSS 7.5, chance of use in 30 days 14%, known exploited since 9 August 2023.
- [CVE-2023-20867](https://www.precursorintelligence.com/what-is/cve-2023-20867): VMware Tools Authentication Bypass Vulnerability. Low, CVSS 3.9, chance of use in 30 days 14%, known exploited since 23 June 2023.
- [CVE-2021-44026](https://www.precursorintelligence.com/what-is/cve-2021-44026): Roundcube Webmail SQL Injection Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 70%, known exploited since 22 June 2023.
- [CVE-2020-35730](https://www.precursorintelligence.com/what-is/cve-2020-35730): Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability. Medium, CVSS 6.1, chance of use in 30 days 33%, known exploited since 22 June 2023.
- [CVE-2023-3079](https://www.precursorintelligence.com/what-is/cve-2023-3079): Google Chromium V8 Type Confusion Vulnerability. High, CVSS 8.8, chance of use in 30 days 38%, known exploited since 7 June 2023.
- [CVE-2021-45046](https://www.precursorintelligence.com/what-is/cve-2021-45046): Apache Log4j2 Deserialization of Untrusted Data Vulnerability. Critical, CVSS 9.0, chance of use in 30 days >99%, known exploited since 1 May 2023.
- [CVE-2023-2136](https://www.precursorintelligence.com/what-is/cve-2023-2136): Google Chrome Skia Integer Overflow Vulnerability. Critical, CVSS 9.6, chance of use in 30 days 5.7%, known exploited since 21 April 2023.
- [CVE-2023-2033](https://www.precursorintelligence.com/what-is/cve-2023-2033): Google Chromium V8 Type Confusion Vulnerability. High, CVSS 8.8, chance of use in 30 days 41%, known exploited since 17 April 2023.
- [CVE-2022-3038](https://www.precursorintelligence.com/what-is/cve-2022-3038): Google Chromium Network Service Use-After-Free Vulnerability. High, CVSS 8.8, chance of use in 30 days 25%, known exploited since 30 March 2023.
- [CVE-2021-39144](https://www.precursorintelligence.com/what-is/cve-2021-39144): XStream Remote Code Execution Vulnerability. High, CVSS 8.5, chance of use in 30 days 98%, known exploited since 10 March 2023.
- [CVE-2022-3075](https://www.precursorintelligence.com/what-is/cve-2022-3075): Google Chromium Mojo Insufficient Data Validation Vulnerability. Critical, CVSS 9.6, chance of use in 30 days 5.8%, known exploited since 8 September 2022.
- [CVE-2021-39226](https://www.precursorintelligence.com/what-is/cve-2021-39226): Grafana Authentication Bypass Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 25 August 2022.
- [CVE-2022-2294](https://www.precursorintelligence.com/what-is/cve-2022-2294): WebRTC Heap Buffer Overflow Vulnerability. High, CVSS 8.8, chance of use in 30 days 71%, known exploited since 25 August 2022.
- [CVE-2020-28949](https://www.precursorintelligence.com/what-is/cve-2020-28949): PEAR Archive\_Tar Deserialization of Untrusted Data Vulnerability. High, CVSS 7.8, chance of use in 30 days 85%, known exploited since 25 August 2022.
- [CVE-2020-36193](https://www.precursorintelligence.com/what-is/cve-2020-36193): PEAR Archive\_Tar Improper Link Resolution Vulnerability. High, CVSS 7.5, chance of use in 30 days 71%, known exploited since 25 August 2022.
- [CVE-2022-32893](https://www.precursorintelligence.com/what-is/cve-2022-32893): Apple iOS and macOS Out-of-Bounds Write Vulnerability. High, CVSS 8.8, chance of use in 30 days 9.9%, known exploited since 18 August 2022.
- [CVE-2022-2856](https://www.precursorintelligence.com/what-is/cve-2022-2856): Google Chromium Intents Insufficient Input Validation Vulnerability. Medium, CVSS 6.5, chance of use in 30 days 4.6%, known exploited since 18 August 2022.
- [CVE-2021-30533](https://www.precursorintelligence.com/what-is/cve-2021-30533): Google Chromium PopupBlocker Security Bypass Vulnerability. Medium, CVSS 6.5, chance of use in 30 days 17%, known exploited since 27 June 2022.
- [CVE-2021-1789](https://www.precursorintelligence.com/what-is/cve-2021-1789): Apple Multiple Products Type Confusion Vulnerability. High, CVSS 8.8, chance of use in 30 days 14%, known exploited since 4 May 2022.
- [CVE-2014-0160](https://www.precursorintelligence.com/what-is/cve-2014-0160): OpenSSL Information Disclosure Vulnerability. High, CVSS 7.5, chance of use in 30 days >99%, known exploited since 4 May 2022.
- [CVE-2022-0847](https://www.precursorintelligence.com/what-is/cve-2022-0847): Linux Kernel Privilege Escalation Vulnerability. High, CVSS 7.8, chance of use in 30 days 93%, known exploited since 25 April 2022.
- [CVE-2021-3156](https://www.precursorintelligence.com/what-is/cve-2021-3156): Sudo Heap-Based Buffer Overflow Vulnerability. High, CVSS 7.8, chance of use in 30 days >99%, known exploited since 6 April 2022.
- [CVE-2020-7247](https://www.precursorintelligence.com/what-is/cve-2020-7247): OpenSMTPD Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 99%, known exploited since 25 March 2022.
- [CVE-2012-1823](https://www.precursorintelligence.com/what-is/cve-2012-1823): PHP-CGI Query String Parameter Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 25 March 2022.
- [CVE-2019-11043](https://www.precursorintelligence.com/what-is/cve-2019-11043): PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability. High, CVSS 8.7, chance of use in 30 days >99%, known exploited since 25 March 2022.
- [CVE-2019-16928](https://www.precursorintelligence.com/what-is/cve-2019-16928): Exim Out-of-bounds Write Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 42%, known exploited since 3 March 2022.
- [CVE-2020-1938](https://www.precursorintelligence.com/what-is/cve-2020-1938): Apache Tomcat Improper Privilege Management Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 3 March 2022.
- [CVE-2016-5195](https://www.precursorintelligence.com/what-is/cve-2016-5195): Linux Kernel Race Condition Vulnerability. High, CVSS 7.0, chance of use in 30 days 84%, known exploited since 3 March 2022.
- [CVE-2022-23134](https://www.precursorintelligence.com/what-is/cve-2022-23134): Zabbix Frontend Improper Access Control Vulnerability. Low, CVSS 3.7, chance of use in 30 days 95%, known exploited since 22 February 2022.
- [CVE-2020-13671](https://www.precursorintelligence.com/what-is/cve-2020-13671): Drupal core Un-restricted Upload of File. High, CVSS 8.8, chance of use in 30 days 35%, known exploited since 18 January 2022.
- [CVE-2021-44228](https://www.precursorintelligence.com/what-is/cve-2021-44228): Apache Log4j2 Remote Code Execution Vulnerability. Critical, CVSS 10.0, chance of use in 30 days >99%, known exploited since 10 December 2021.
- [CVE-2019-13272](https://www.precursorintelligence.com/what-is/cve-2019-13272): Linux Kernel Improper Privilege Management Vulnerability. High, CVSS 7.8, chance of use in 30 days 52%, known exploited since 10 December 2021.
- [CVE-2021-40438](https://www.precursorintelligence.com/what-is/cve-2021-40438): Apache HTTP Server-Side Request Forgery (SSRF). Critical, CVSS 9.0, chance of use in 30 days >99%, known exploited since 1 December 2021.
- [CVE-2021-22204](https://www.precursorintelligence.com/what-is/cve-2021-22204): ExifTool Remote Code Execution Vulnerability. Medium, CVSS 6.8, chance of use in 30 days >99%, known exploited since 17 November 2021.
- [CVE-2021-42013](https://www.precursorintelligence.com/what-is/cve-2021-42013): Apache HTTP Server Path Traversal Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 3 November 2021.
- [CVE-2021-1870](https://www.precursorintelligence.com/what-is/cve-2021-1870): Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 7.7%, known exploited since 3 November 2021.
- [CVE-2019-5544](https://www.precursorintelligence.com/what-is/cve-2019-5544): VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 97%, known exploited since 3 November 2021.
- [CVE-2020-16846](https://www.precursorintelligence.com/what-is/cve-2020-16846): SaltStack Salt Shell Injection Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 3 November 2021.
- [CVE-2021-1871](https://www.precursorintelligence.com/what-is/cve-2021-1871): Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 7.0%, known exploited since 3 November 2021.
- [CVE-2021-30633](https://www.precursorintelligence.com/what-is/cve-2021-30633): Google Chromium Indexed DB API Use-After-Free Vulnerability. Critical, CVSS 9.6, chance of use in 30 days 33%, known exploited since 3 November 2021.
- [CVE-2021-37973](https://www.precursorintelligence.com/what-is/cve-2021-37973): Google Chromium Portals Use-After-Free Vulnerability. Critical, CVSS 9.6, chance of use in 30 days 12%, known exploited since 3 November 2021.
- [CVE-2020-15999](https://www.precursorintelligence.com/what-is/cve-2020-15999): Google Chrome FreeType Heap Buffer Overflow Vulnerability. Critical, CVSS 9.6, chance of use in 30 days 64%, known exploited since 3 November 2021.
- [CVE-2020-6418](https://www.precursorintelligence.com/what-is/cve-2020-6418): Google Chromium V8 Type Confusion Vulnerability. High, CVSS 8.8, chance of use in 30 days 79%, known exploited since 3 November 2021.
- [CVE-2020-16009](https://www.precursorintelligence.com/what-is/cve-2020-16009): Google Chromium V8 Type Confusion Vulnerability. High, CVSS 8.8, chance of use in 30 days 48%, known exploited since 3 November 2021.
- [CVE-2021-21224](https://www.precursorintelligence.com/what-is/cve-2021-21224): Google Chromium V8 Type Confusion Vulnerability. High, CVSS 8.8, chance of use in 30 days 84%, known exploited since 3 November 2021.
- [CVE-2021-38003](https://www.precursorintelligence.com/what-is/cve-2021-38003): Google Chromium V8 Memory Corruption Vulnerability. High, CVSS 8.8, chance of use in 30 days 39%, known exploited since 3 November 2021.
- [CVE-2021-37975](https://www.precursorintelligence.com/what-is/cve-2021-37975): Google Chromium V8 Use-After-Free Vulnerability. High, CVSS 8.8, chance of use in 30 days 35%, known exploited since 3 November 2021.
- [CVE-2021-30858](https://www.precursorintelligence.com/what-is/cve-2021-30858): Apple iOS, iPadOS, macOS Use-After-Free Vulnerability. High, CVSS 8.8, chance of use in 30 days 13%, known exploited since 3 November 2021.
- [CVE-2021-30632](https://www.precursorintelligence.com/what-is/cve-2021-30632): Google Chromium V8 Out-of-Bounds Write Vulnerability. High, CVSS 8.8, chance of use in 30 days 63%, known exploited since 3 November 2021.
- [CVE-2021-30554](https://www.precursorintelligence.com/what-is/cve-2021-30554): Google Chromium WebGL Use-After-Free Vulnerability. High, CVSS 8.8, chance of use in 30 days 7.4%, known exploited since 3 November 2021.
- [CVE-2021-30551](https://www.precursorintelligence.com/what-is/cve-2021-30551): Google Chromium V8 Type Confusion Vulnerability. High, CVSS 8.8, chance of use in 30 days 65%, known exploited since 3 November 2021.
- [CVE-2021-21220](https://www.precursorintelligence.com/what-is/cve-2021-21220): Google Chromium V8 Improper Input Validation Vulnerability. High, CVSS 8.8, chance of use in 30 days 70%, known exploited since 3 November 2021.
- [CVE-2021-21206](https://www.precursorintelligence.com/what-is/cve-2021-21206): Google Chromium Blink Use-After-Free Vulnerability. High, CVSS 8.8, chance of use in 30 days 9.3%, known exploited since 3 November 2021.
- [CVE-2021-21193](https://www.precursorintelligence.com/what-is/cve-2021-21193): Google Chromium Blink Use-After-Free Vulnerability. High, CVSS 8.8, chance of use in 30 days 9.9%, known exploited since 3 November 2021.
- [CVE-2021-21166](https://www.precursorintelligence.com/what-is/cve-2021-21166): Google Chromium Race Condition Vulnerability. High, CVSS 8.8, chance of use in 30 days 24%, known exploited since 3 November 2021.
- [CVE-2021-21148](https://www.precursorintelligence.com/what-is/cve-2021-21148): Google Chromium V8 Heap Buffer Overflow Vulnerability. High, CVSS 8.8, chance of use in 30 days 20%, known exploited since 3 November 2021.
- [CVE-2019-0211](https://www.precursorintelligence.com/what-is/cve-2019-0211): Apache HTTP Server Privilege Escalation Vulnerability. High, CVSS 7.8, chance of use in 30 days 65%, known exploited since 3 November 2021.
- [CVE-2021-41773](https://www.precursorintelligence.com/what-is/cve-2021-41773): Apache HTTP Server Path Traversal Vulnerability. High, CVSS 7.5, chance of use in 30 days >99%, known exploited since 3 November 2021.
- [CVE-2021-37976](https://www.precursorintelligence.com/what-is/cve-2021-37976): Google Chromium Information Disclosure Vulnerability. Medium, CVSS 6.5, chance of use in 30 days 20%, known exploited since 3 November 2021.
- [CVE-2021-38000](https://www.precursorintelligence.com/what-is/cve-2021-38000): Google Chromium Intents Improper Input Validation Vulnerability. Medium, CVSS 6.1, chance of use in 30 days 4.9%, known exploited since 3 November 2021.
- [CVE-2020-1472](https://www.precursorintelligence.com/what-is/cve-2020-1472): Microsoft Netlogon Privilege Escalation Vulnerability. Medium, CVSS 5.5, chance of use in 30 days >99%, known exploited since 3 November 2021.

## Which Fedoraproject flaws are most likely to be used?

Ranked by the latest exploit-likelihood forecast (the chance each flaw is used in an attack in the next 30 days):

- [CVE-2014-3566](https://www.precursorintelligence.com/what-is/cve-2014-3566): >99%, Low (CVSS 3.4)
- [CVE-2014-0160](https://www.precursorintelligence.com/what-is/cve-2014-0160): >99%, High (CVSS 7.5), known exploited
- [CVE-2012-1823](https://www.precursorintelligence.com/what-is/cve-2012-1823): >99%, Critical (CVSS 9.8), known exploited
- [CVE-2014-0195](https://www.precursorintelligence.com/what-is/cve-2014-0195): >99%, Medium (CVSS 6.8)
- [CVE-2018-1111](https://www.precursorintelligence.com/what-is/cve-2018-1111): 98%, High (CVSS 7.5)
- [CVE-2016-9299](https://www.precursorintelligence.com/what-is/cve-2016-9299): 97%, Critical (CVSS 9.8)
- [CVE-2014-0224](https://www.precursorintelligence.com/what-is/cve-2014-0224): 95%, High (CVSS 7.4)
- [CVE-2014-0221](https://www.precursorintelligence.com/what-is/cve-2014-0221): 88%, Medium (CVSS 4.3)
- [CVE-2013-2028](https://www.precursorintelligence.com/what-is/cve-2013-2028): 87%, High (CVSS 7.5)

## All Fedoraproject products we track

17 products with at least one tracked version, most vulnerabilities first:

- [Fedora](https://www.precursorintelligence.com/product/fedoraproject/fedora): 5,323 vulnerabilities, 36 versions
- [Extra Packages for Enterprise Linux](https://www.precursorintelligence.com/product/fedoraproject/extra_packages_for_enterprise_linux): 76 vulnerabilities, 3 versions
- [389 Directory Server](https://www.precursorintelligence.com/product/fedoraproject/389_directory_server): 39 vulnerabilities, 185 versions
- [Sssd](https://www.precursorintelligence.com/product/fedoraproject/sssd): 17 vulnerabilities, 112 versions
- [Fedora Core](https://www.precursorintelligence.com/product/fedoraproject/fedora_core): 8 vulnerabilities, 7 versions
- [Coolkey](https://www.precursorintelligence.com/product/fedoraproject/coolkey): 1 vulnerability, 1 version
- [Crypto-Utils](https://www.precursorintelligence.com/product/fedoraproject/crypto-utils): 1 vulnerability, 1 version
- [Fedmsg](https://www.precursorintelligence.com/product/fedoraproject/fedmsg): 1 vulnerability, 60 versions
- [Fedora Linux Kernel](https://www.precursorintelligence.com/product/fedoraproject/fedora_linux_kernel): 1 vulnerability, 1 version
- [Arm Installer](https://www.precursorintelligence.com/product/fedoraproject/arm_installer): 1 vulnerability, 1 version
- [Supybot-Fedora](https://www.precursorintelligence.com/product/fedoraproject/supybot-fedora): 1 vulnerability, 17 versions
- [389 Administration Server](https://www.precursorintelligence.com/product/fedoraproject/389_administration_server): 1 vulnerability, 1 version
- [Python-Fedora](https://www.precursorintelligence.com/product/fedoraproject/python-fedora): 1 vulnerability, 1 version
- [Selinux-Policy](https://www.precursorintelligence.com/product/fedoraproject/selinux-policy): 1 vulnerability, 2 versions
- [Spin-Kickstarts](https://www.precursorintelligence.com/product/fedoraproject/spin-kickstarts): 1 vulnerability, 67 versions
- [Mirrormanager](https://www.precursorintelligence.com/product/fedoraproject/mirrormanager): 0 vulnerabilities, 64 versions
- [Fedora Extra Packages for Enterprise Linux](https://www.precursorintelligence.com/product/fedoraproject/fedora_extra_packages_for_enterprise_linux): 0 vulnerabilities, 1 version

## Questions

### How many vulnerabilities does Fedoraproject have?

Our catalogue lists 5,392 published vulnerabilities across 22 products and 560 versions from Fedoraproject. The most recent Fedoraproject flaw added to the known-exploited list is CVE-2022-0995, on 26 August 2026.

### Which Fedoraproject vulnerabilities are being exploited?

86 Fedoraproject vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2022-0995, CVE-2022-0492 and CVE-2021-30952. The full list is on this page.

### Which Fedoraproject product has the most vulnerabilities?

Fedora, with 5,323 published vulnerabilities. Its own page lists the ones known to be exploited.

### How do I get alerts for new Fedoraproject vulnerabilities?

Create a Precursor Intelligence account and track the Fedoraproject products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.

## Running Fedoraproject?

Precursor Intelligence keeps checking for you:

- **Tell us what you run.** Pick your software from a list, or let us work it out from your website.
- **We match it to every flaw.** Over 400,000 published flaws, checked against your list.
- **Ranked by real-world risk.** Every flaw gets a 0 to 100 risk score, kept up to date, led by evidence criminals are using it.
- **Told as soon as we know.** An alert by email, in the app or by webhook to your own tools.

Start free (no card, nothing to install): https://www.precursorintelligence.com/register
Book a demo: https://www.precursorintelligence.com/contact