Ubuntu
Vendor:
First CVE: Jul 16, 1996 · Active for 30 years
4,196
Total CVEs
More Total CVEs than 79% of tracked products
174.8
Avg CVEs / Year
Higher CVE frequency than 62% of tracked products
6.7
Avg CVSS
Higher Avg CVSS than 71% of tracked products
1.1%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Ubuntu over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jul 16, 1996
30 years ago
Most Recent CVE
Jul 8, 2026
20 days ago
CVE Severity & Scoring
Ubuntu4,196 CVEs
47%
39%
8%
All CVEs352,785 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local942 (22.4%)
Network1,945 (46.4%)
Unknown1,216 (29.0%)
Physical50 (1.2%)
Adjacent Network43 (1.0%)
Attack Complexity
Low2,573 (61.3%)
High407 (9.7%)
Unknown1,216 (29.0%)
User Interaction
None2,077 (49.5%)
Unknown1,216 (29.0%)
Required903 (21.5%)
Privileges Required
Low758 (18.1%)
High221 (5.3%)
None2,001 (47.7%)
Unknown1,216 (29.0%)
Top CVEs
Signals from CVEs in this product scope (4196 CVEs).
4,196 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-31431HIGH In the Linux kernel, the following vulnerability has been resolved:
crypto: algif_aead - Revert to operating out-of-place
This mostly reverts commit 72548b093ee3 except for the c | Apr 22, 2026 | 7.8 | 99 | YES | YES |
CVE-2020-1472CRITICAL An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protoc | Aug 17, 2020 | 10.0 | 99 | YES | YES |
CVE-2020-7247CRITICAL smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP sessio | Jan 29, 2020 | 9.8 | 99 | YES | YES |
CVE-2017-12617HIGH When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation | Oct 4, 2017 | 8.1 | 99 | YES | YES |
CVE-2014-6271CRITICAL GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a cra | Sep 24, 2014 | 9.8 | 99 | YES | YES |
CVE-2014-0160HIGH The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive inform | Apr 7, 2014 | 7.5 | 99 | YES | YES |
CVE-2023-4911HIGH A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to us | Oct 3, 2023 | 7.8 | 98 | YES | YES |
CVE-2021-4034HIGH A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as pri | Jan 28, 2022 | 7.8 | 98 | YES | YES |
CVE-2020-11651CRITICAL An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a re | Apr 30, 2020 | 9.8 | 98 | YES | YES |
CVE-2019-11043CRITICAL In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buff | Oct 28, 2019 | 9.8 | 98 | YES | YES |
Exploit Exposure
Signals from CVEs in this product scope (4196 CVEs).
CISA KEV
46 CVEs
1.1% of CVEs· Bottom 1%
Metasploit
80 CVEs
1.9% of CVEs· Bottom 1%
Nuclei
22 CVEs
0.5% of CVEs· Bottom 1%
ExploitDB
243 CVEs
5.8% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (4196 CVEs).
Media Mentions
Signals from CVEs in this product scope (4196 CVEs).
Top CNAs Publishing CVEs For Ubuntu
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 9.10 | 128 | 6.6 | 8.3% | 4 | 24 |
| 9.0.4 | 2 | 1.9 | 0.3% | 0 | 0 |
| 9.04 | 108 | 6.4 | 9.3% | 2 | 20 |
| 8.1.0 | 1 | 1.9 | 0.4% | 0 | 0 |
| 8.10 | 100 | 6.5 | 9.4% | 1 | 18 |
| 8.0.4_lts | 1 | 1.9 | 0.4% | 0 | 0 |
| 8.04 | 238 | 6.5 | 9.4% | 4 | 37 |
| 7.10 | 90 | 6.8 | 10.8% | 0 | 12 |
| 7.04 | 79 | 7.0 | 11.8% | 0 | 10 |
| 7.0 | 1 | 3.3 | 0.1% | 0 | 0 |
| 6.8 | 3 | 4.0 | 0.1% | 0 | 0 |
| 6.17 | 1 | 3.3 | 0.1% | 0 | 0 |
| 6.10 | 72 | 6.7 | 12.2% | 0 | 8 |
| 6.06_lts | 6 | 6.4 | 2.3% | 0 | 0 |
| 6.06 | 246 | 6.5 | 10.6% | 3 | 45 |
| 5.10 | 46 | 6.8 | 10.7% | 0 | 8 |
| 5.04 | 32 | 6.0 | 8.1% | 0 | 4 |
| 4.10 | 22 | 6.1 | 5.1% | 0 | 1 |
| 4.1 | 46 | 6.6 | 4.4% | 0 | 6 |
| 26.04 | 9 | 5.3 | 0.1% | 0 | 0 |