Virtualization
Vendor:
First CVE: Oct 20, 2009 · Active for 16 years
129
Total CVEs
More Total CVEs than 99% of tracked products
8.6
Avg CVEs / Year
Higher CVE frequency than 94% of tracked products
7.2
Avg CVSS
Higher Avg CVSS than 45% of tracked products
3.9%
KEV Rate
Higher KEV Rate than 97% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Virtualization over time
Volume of CVEsAvg CVSS Base Score
First CVE
Oct 20, 2009
16 years ago
Most Recent CVE
Sep 26, 2024
666 days ago
CVE Severity & Scoring
Virtualization129 CVEs
39%
48%
11%
All CVEs352,294 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local52 (40.3%)
Network61 (47.3%)
Unknown15 (11.6%)
Physical0 (0.0%)
Adjacent Network1 (0.8%)
Attack Complexity
Low98 (76.0%)
High16 (12.4%)
Unknown15 (11.6%)
User Interaction
None110 (85.3%)
Unknown15 (11.6%)
Required4 (3.1%)
Privileges Required
Low58 (45.0%)
High12 (9.3%)
None44 (34.1%)
Unknown15 (11.6%)
Top CVEs
Signals from CVEs in this product scope (129 CVEs).
129 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2014-6271CRITICAL GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a cra | Sep 24, 2014 | 9.8 | 99 | YES | YES |
CVE-2014-0160HIGH The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive inform | Apr 7, 2014 | 7.5 | 99 | YES | YES |
CVE-2023-4911HIGH A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to us | Oct 3, 2023 | 7.8 | 98 | YES | YES |
CVE-2014-7169CRITICAL GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to wri | Sep 25, 2014 | 9.8 | 98 | YES | YES |
CVE-2015-0235HIGH Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code | Jan 28, 2015 | 10.0 | 92 | NO | YES |
CVE-2021-3560HIGH It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be us | Feb 16, 2022 | 7.8 | 87 | YES | YES |
CVE-2019-14287HIGH In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invok | Oct 17, 2019 | 8.8 | 84 | NO | YES |
CVE-2022-0435HIGH A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is | Mar 25, 2022 | 8.8 | 67 | NO | NO |
CVE-2018-5390HIGH Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of | Aug 6, 2018 | 7.5 | 66 | NO | NO |
CVE-2018-3639MEDIUM Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthori | May 22, 2018 | 5.5 | 65 | NO | YES |
Exploit Exposure
Signals from CVEs in this product scope (129 CVEs).
CISA KEV
5 CVEs
3.9% of CVEs· 97th percentile
Metasploit
5 CVEs
3.9% of CVEs· 96th percentile
Nuclei
4 CVEs
3.1% of CVEs· 96th percentile
ExploitDB
11 CVEs
8.5% of CVEs· 89th percentile
Social Chatter
Signals from CVEs in this product scope (129 CVEs).
Media Mentions
Signals from CVEs in this product scope (129 CVEs).
Top CNAs Publishing CVEs For Virtualization
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 6.0 | 6 | 7.0 | 35.0% | 1 | 2 |
| 5.0 | 3 | 7.3 | 4.0% | 0 | 0 |
| 5 | 2 | 4.6 | 0.4% | 0 | 0 |
| 4.3 | 4 | 7.4 | 0.6% | 0 | 0 |
| 4.2 | 6 | 7.4 | 13.0% | 0 | 1 |
| 4.1 | 6 | 7.8 | 6.4% | 0 | 1 |
| 4.0 | 84 | 7.2 | 6.4% | 2 | 4 |
| 3.4 | 2 | 9.8 | 100.0% | 2 | 2 |
| 3.0 | 25 | 7.3 | 2.8% | 0 | 1 |