Enterprise Linux
Vendor:
First CVE: Jul 16, 1996 · Active for 30 years
2,197
Total CVEs
More Total CVEs than 100% of tracked products
84.5
Avg CVEs / Year
Higher CVE frequency than 100% of tracked products
6.5
Avg CVSS
Higher Avg CVSS than 29% of tracked products
1.2%
KEV Rate
Higher KEV Rate than 96% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Enterprise Linux over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jul 16, 1996
30 years ago
Most Recent CVE
Jul 8, 2026
16 days ago
CVE Severity & Scoring
Enterprise Linux2,197 CVEs
49%
35%
8%
All CVEs352,294 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local711 (32.4%)
Network975 (44.4%)
Unknown450 (20.5%)
Physical25 (1.1%)
Adjacent Network36 (1.6%)
Attack Complexity
Low1,471 (67.0%)
High276 (12.6%)
Unknown450 (20.5%)
User Interaction
None1,439 (65.5%)
Unknown450 (20.5%)
Required308 (14.0%)
Privileges Required
Low658 (29.9%)
High178 (8.1%)
None911 (41.5%)
Unknown450 (20.5%)
Top CVEs
Signals from CVEs in this product scope (2197 CVEs).
2,197 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-31431HIGH In the Linux kernel, the following vulnerability has been resolved:
crypto: algif_aead - Revert to operating out-of-place
This mostly reverts commit 72548b093ee3 except for the c | Apr 22, 2026 | 7.8 | 99 | YES | YES |
CVE-2014-6271CRITICAL GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a cra | Sep 24, 2014 | 9.8 | 99 | YES | YES |
CVE-2013-2251CRITICAL Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: p | Jul 20, 2013 | 9.8 | 99 | YES | YES |
CVE-2023-4911HIGH A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to us | Oct 3, 2023 | 7.8 | 98 | YES | YES |
CVE-2022-0847HIGH A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux ker | Mar 10, 2022 | 7.8 | 98 | YES | YES |
CVE-2021-4034HIGH A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as pri | Jan 28, 2022 | 7.8 | 98 | YES | YES |
CVE-2019-11043CRITICAL In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buff | Oct 28, 2019 | 9.8 | 98 | YES | YES |
CVE-2014-7169CRITICAL GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to wri | Sep 25, 2014 | 9.8 | 98 | YES | YES |
CVE-2023-44487HIGH The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through | Oct 10, 2023 | 7.5 | 97 | YES | YES |
CVE-2021-40438CRITICAL A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. | Sep 16, 2021 | 9.0 | 97 | YES | YES |
Exploit Exposure
Signals from CVEs in this product scope (2197 CVEs).
CISA KEV
26 CVEs
1.2% of CVEs· 96th percentile
Metasploit
24 CVEs
1.1% of CVEs· 96th percentile
Nuclei
13 CVEs
0.6% of CVEs· 96th percentile
ExploitDB
87 CVEs
4.0% of CVEs· 88th percentile
Social Chatter
Signals from CVEs in this product scope (2197 CVEs).
Media Mentions
Signals from CVEs in this product scope (2197 CVEs).
Top CNAs Publishing CVEs For Enterprise Linux
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| ws_4 | 2 | 6.0 | 1.4% | 0 | 0 |
| ws_3 | 1 | 4.9 | 0.4% | 0 | 0 |
| es_4 | 2 | 6.0 | 1.4% | 0 | 0 |
| es_3 | 1 | 4.9 | 0.4% | 0 | 0 |
| as_4 | 2 | 6.0 | 1.4% | 0 | 0 |
| as_3 | 1 | 4.9 | 0.4% | 0 | 0 |
| 9.8 | 1 | 7.5 | 1.3% | 0 | 0 |
| 9.2 | 1 | 6.7 | 0.8% | 0 | 0 |
| 9.1 | 1 | 7.8 | 0.2% | 0 | 0 |
| 9.0 | 475 | 6.5 | 2.8% | 6 | 7 |
| 8.7 | 1 | 7.8 | 0.2% | 0 | 0 |
| 8.6 | 1 | 7.5 | 1.4% | 0 | 0 |
| 8.5.0 | 1 | 9.8 | 1.6% | 0 | 0 |
| 8.4 | 5 | 6.0 | 16.7% | 0 | 0 |
| 8.3.0 | 1 | 2.7 | 1.1% | 0 | 0 |
| 8.3 | 2 | 7.7 | 1.5% | 0 | 0 |
| 8.2 | 1 | 7.5 | 81.7% | 0 | 0 |
| 8.1 | 4 | 6.0 | 0.6% | 0 | 0 |
| 8.0 | 989 | 6.5 | 4.3% | 13 | 22 |
| 7.7 | 4 | 6.7 | 12.6% | 0 | 0 |