Vendor
Linuxfoundation vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 35 vulnerabilities in Linuxfoundation: 0 in the last 7 days and 5 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-106563, was published on 7 October 2026. Nothing in the last four weeks, down from 5 vulnerabilities in the four before. 4 technologies have a page of their own.
- Last 7 days
- 0
- Last 90 days
- 5
- Critical, all time
- 4
- Exploited in the wild
- 0
About Linuxfoundation
Non-profit organization that supports the development and adoption of open source software and standards.
Linuxfoundation technologies
Latest Linuxfoundation vulnerabilities
- CVE-2026-106563: Backstage improper entity validation in Kubernetes services endpointmediumCVSS 5.3EPSS 0.2%
- CVE-2026-106562: Backstage incorrect authorization in search engine permission filteringmediumCVSS 4.3EPSS 0.2%
- CVE-2026-106561: Backstage Kubernetes plugin sensitive information disclosure in resource queriesmediumCVSS 5EPSS 0.2%
- CVE-2026-106560: Backstage plugin-scaffolder-backend-module-confluence-to-markdown path traversalhighCVSS 7.1EPSS 0.3%
- CVE-2026-106559: Backstage Confluence to Markdown scaffolder input validation bypassmediumCVSS 6.3EPSS 0.3%
- CVE-2026-73563: Backstage plugin-auth-backend OAuth redirect_uri allowlist bypassmediumCVSS 4.7EPSS 0.3%
- CVE-2026-37532: Automotive Grade Linux agl-service-can-low-level heap over-read in isotp-chighCVSS 7.1
- CVE-2026-37531: Automotive Grade Linux app-framework-main Zip Slip in widget installercriticalCVSS 9.8EPSS 0.1%
- CVE-2026-37530: Automotive Grade Linux agl-service-can-low-level stack overflow in uds-chighCVSS 7.5EPSS 0.0%
- CVE-2026-37526: Automotive Grade Linux afb-daemon improper access control in supervision sockethighCVSS 7.8EPSS 0.0%
- CVE-2026-37525: Automotive Grade Linux afb-daemon privilege escalation in supervision Do commandhighCVSS 7.8EPSS 0.0%
- CVE-2026-40938: Tekton Pipelines argument injection in Git resolver revision parameterhighCVSS 7.5EPSS 0.9%
- CVE-2026-40924: Tekton Pipelines DoS via unbounded memory allocation in HTTP resolvermediumCVSS 6.5EPSS 0.5%
- CVE-2026-40923: Tekton Pipelines path traversal in VolumeMount validationmediumCVSS 5.4EPSS 0.3%
- CVE-2026-40161: Tekton Pipelines credential exfiltration in Git resolver API modehighCVSS 7.7EPSS 0.4%
- CVE-2026-25542: Tekton Pipelines regex bypass in trusted resources verificationmediumCVSS 6.5EPSS 0.4%
- CVE-2026-32613: Spinnaker is an open source, multi-cloud continuous delivery platform. Echo like some other services, uses SPeL (Spring…criticalCVSS 9.9EPSS 0.5%
- CVE-2026-32604: Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and pathscriticalCVSS 9.9EPSS 0.6%
- CVE-2026-39984: Sigstore Timestamp Authority has Improper Certificate Validation in verifiermediumCVSS 5.5EPSS 0.1%
- CVE-2026-34045: Podman Desktop DoS and information disclosure in WebView serverhighCVSS 8.2EPSS 0.4%
- CVE-2026-35167: Kedro path traversal in versioned dataset loadinghighCVSS 7.1EPSS 0.4%
- CVE-2026-34447: ONNX symlink traversal in external data loadingmediumCVSS 5.5EPSS 0.3%
- CVE-2026-33701: OpenTelemetry Java Instrumentation RCE via Unsafe Deserialization in RMIcriticalCVSS 9.8EPSS 1.1%
- CVE-2026-29773: Kubewarden incorrect authorization in deprecated host-callback APIsmediumCVSS 4.3EPSS 0.3%
- CVE-2026-29186: Backstage TechDocs arbitrary code execution via MkDocs configuration bypasshighCVSS 7.7EPSS 0.9%
Most severe Linuxfoundation vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-32604: Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and pathscriticalCVSS 9.9EPSS 0.6%
- CVE-2026-32613: Spinnaker is an open source, multi-cloud continuous delivery platform. Echo like some other services, uses SPeL (Spring…criticalCVSS 9.9EPSS 0.5%
- CVE-2026-33701: OpenTelemetry Java Instrumentation RCE via Unsafe Deserialization in RMIcriticalCVSS 9.8EPSS 1.1%
- CVE-2026-37531: Automotive Grade Linux app-framework-main Zip Slip in widget installercriticalCVSS 9.8EPSS 0.1%
- CVE-2025-67508: GO-2025-4232 - gardenctl is vulnerable to Command Injection when used with non‑POSIX shells in…highCVSS 8.4EPSS 0.2%
- CVE-2026-34045: Podman Desktop DoS and information disclosure in WebView serverhighCVSS 8.2EPSS 0.4%
- CVE-2026-27134: Strimzi Kafka Operator improper authentication in mTLS CA chain validationhighCVSS 8.1EPSS 0.3%
- CVE-2025-61916: Spinnaker vulnerable to SSRF due to improper restrictions on http from user inputhighCVSS 7.9EPSS 0.2%
- CVE-2026-37526: Automotive Grade Linux afb-daemon improper access control in supervision sockethighCVSS 7.8EPSS 0.0%
- CVE-2026-37525: Automotive Grade Linux afb-daemon privilege escalation in supervision Do commandhighCVSS 7.8EPSS 0.0%
Vulnerabilities per week
Nothing in the last four weeks, down from 5 vulnerabilities in the four before. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 5 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Linuxfoundation vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/linuxfoundation)<a href="https://junglewise.ai/threats/vendors/linuxfoundation"><img src="https://junglewise.ai/threats/vendors/linuxfoundation/badge.svg" alt="Linuxfoundation vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/linuxfoundation.json, and this page as text at https://junglewise.ai/threats/vendors/linuxfoundation.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Linuxfoundation vulnerabilities", https://junglewise.ai/threats/vendors/linuxfoundation, 12 November 2026.