CVE database for Linux servers

Curated vulnerabilities affecting the software you run on production servers — with remediation steps per distro, WAF mitigations, and Defensia detection mapping.

Measured, not republished

CVEs our agents measured being exploited →

Everything below is someone else's list. This one is ours: exploitation we recorded against production Linux servers, with the dates we saw it.

Actively exploited now

Exploited CVEs ordered by when we published them — newest first, so the latest critical vulnerabilities surface regardless of their CVSS score.

CVE-2026-111497criticalCVSS 9.822 Oct 2026Node.js · A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli ve…

CVE-2026-109618criticalCVSS 9.821 Oct 2026PHP · PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort ha…

CVE-2026-109619highCVSS 8.121 Oct 2026PHP · PHP has various global state that temporarily points into request memory. In some scenario…

CVE-2026-60137mediumCVSS 5.917 Jul 2026WordPress · WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly…

CVE-2019-16928criticalCVSS 1027 Sept 2019Exim · Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-…

CVE-2021-40438criticalCVSS 9.516 Sept 2021Apache · A crafted request uri-path can cause mod_proxy to forward the request to an origin server …

In the CISA KEV catalogue

CVEs the US cybersecurity agency lists as known to be exploited. Published by CISA and republished here — not our own measurement.

CVE-2021-41773criticalCVSS 105 Oct 2021Apache · A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An a…

CVE-2021-42013criticalCVSS 107 Oct 2021Apache · It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient…

CVE-2022-0543criticalCVSS 1018 Feb 2022Redis · It was discovered, that redis, a persistent key-value database, due to a packaging issue, …

CVE-2010-4344criticalCVSS 1014 Dec 2010Exim · Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 …

CVE-2021-44228criticalCVSS 1010 Dec 2021Log4j · Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.…

CVE-2018-6789criticalCVSS 108 Feb 2018Exim · An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1…

CVE-2019-10149criticalCVSS 105 Jun 2019Exim · A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipie…

CVE-2019-16928criticalCVSS 1027 Sept 2019Exim · Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-…

CVE-2025-49113criticalCVSS 9.92 Jun 2025PHP · Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by au…

CVE-2012-1823criticalCVSS 9.811 May 2012PHP · sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI …

CVE-2026-63030criticalCVSS 9.817 Jul 2026WordPress · WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoi…

CVE-2026-33017criticalCVSS 9.820 Mar 2026Python · Langflow is a tool for building and deploying AI-powered agents and workflows. In versions…

CVE-2024-36401criticalCVSS 9.81 Jul 2024Geoserver · GeoServer is an open source server that allows users to share and edit geospatial data. Pr…

CVE-2026-109618criticalCVSS 9.821 Oct 2026PHP · PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort ha…

CVE-2026-111497criticalCVSS 9.822 Oct 2026Node.js · A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli ve…

CVE-2024-4577criticalCVSS 9.89 Jun 2024PHP · In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using A…

CVE-2026-48907criticalCVSS 9.85 Jun 2026PHP · A vulnerability in the JCE editor extension for Joomla allows the creation of new editor p…

CVE-2026-48908criticalCVSS 9.820 Jun 2026PHP · A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbit…

CVE-2026-48939criticalCVSS 9.820 Jun 2026PHP · A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files …

CVE-2025-39682criticalCVSS 9.85 Sept 2025Kernel · In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of …

CVE database for Linux servers

CVEs our agents measured being exploited →

Actively exploited now

In the CISA KEV catalogue

By software

Kernel

PHP

Python

Docker

Apache

Traefik

PostgreSQL

MariaDB

MySQL

Node.js

Dovecot

OpenSSH

Exim

Nginx

Redis

Caddy

HAProxy

WordPress

Vite

Fortiproxy

Kibana

Log4j

Geoserver