Ubuntu Linux vulnerabilitiesAnd the versions its exploited flaws hit.
Ubuntu Linux is made by Canonical. We track 4,170 published vulnerabilities in it, across 76 versions. 46 of them are on the list of flaws known to be exploited, the newest added on 2 June 2026. If you run Ubuntu Linux, check your version against the exploited flaws below and patch those first.
The most recent Ubuntu Linux flaw added to the known-exploited list is CVE-2022-0492, on 2 June 2026. We keep watching the known-exploited list.
Which versions of Ubuntu Linux do the exploited flaws hit?
Each exploited flaw lists the versions it affects, usually as ranges. "before 18.04" means every version up to, but not including, 18.04. Find your version, then patch.
- CVE-2022-0492Exploited list, 2 Jun 2026
Linux Kernel Improper Authentication Vulnerability
14.0416.0418.0420.0422.04 - CVE-2026-31431Exploited list, 1 May 2026
Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability
14.0416.0418.0420.0422.0424.0425.10 - CVE-2018-14634Exploited list, 26 Jan 2026
Linux Kernel Integer Overflow Vulnerability
12.0414.04 - CVE-2025-32463Exploited list, 29 Sep 2025
Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
22.0424.0424.1025.04 - CVE-2016-3714Exploited list, 9 Sep 2024
ImageMagick Improper Input Validation Vulnerability
12.0414.0415.1016.04 - CVE-2022-2586Exploited list, 26 Jun 2024
Linux Kernel Use-After-Free Vulnerability
14.0416.0418.0420.0422.04 - CVE-2023-4911Exploited list, 21 Nov 2023
GNU C Library Buffer Overflow Vulnerability
22.0423.04 - CVE-2016-8735Exploited list, 12 May 2023
Apache Tomcat Remote Code Execution Vulnerability
16.04 - CVE-2010-3904Exploited list, 12 May 2023
Linux Kernel Improper Input Validation Vulnerability
6.068.049.049.1010.0410.10 - CVE-2021-3560Exploited list, 12 May 2023
Red Hat Polkit Incorrect Authorization Vulnerability
20.04 - CVE-2016-3427Exploited list, 12 May 2023
Oracle Java SE and JRockit Unspecified Vulnerability
12.0414.0415.1016.04 - CVE-2014-0196Exploited list, 12 May 2023
Linux Kernel Race Condition Vulnerability
10.0412.0412.1013.1014.04 - CVE-2021-3493Exploited list, 20 Oct 2022
Linux Kernel Privilege Escalation Vulnerability
before 18.04before 20.1018.04.1 to before 20.04 - CVE-2021-4034Exploited list, 27 Jun 2022
Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
14.0416.0418.0420.0421.10 - CVE-2016-1646Exploited list, 8 Jun 2022
Google Chromium V8 Out-of-Bounds Read Vulnerability
14.0415.1016.04 - CVE-2013-0422Exploited list, 25 May 2022
Oracle JRE Remote Code Execution Vulnerability
12.10 - CVE-2010-0840Exploited list, 25 May 2022
Oracle JRE Unspecified Vulnerability
8.048.109.049.10 - CVE-2013-2423Exploited list, 25 May 2022
Oracle JRE Unspecified Vulnerability
12.10 - CVE-2014-3153Exploited list, 25 May 2022
Linux Kernel Privilege Escalation Vulnerability
12.0414.04 - CVE-2015-4495Exploited list, 25 May 2022
Mozilla Firefox Security Feature Bypass Vulnerability
12.0414.0415.04 - CVE-2014-0160Exploited list, 4 May 2022
OpenSSL Information Disclosure Vulnerability
12.0412.1013.10 - CVE-2013-1690Exploited list, 28 Mar 2022
Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability
12.0412.1013.04 - CVE-2020-7247Exploited list, 25 Mar 2022
OpenSMTPD Remote Code Execution Vulnerability
18.0419.10 - CVE-2010-4345Exploited list, 25 Mar 2022
Exim Privilege Escalation Vulnerability
6.068.049.1010.0410.10 - CVE-2010-4344Exploited list, 25 Mar 2022
Exim Heap-Based Buffer Overflow Vulnerability
6.068.049.10 - CVE-2017-12617Exploited list, 25 Mar 2022
Apache Tomcat Remote Code Execution Vulnerability
12.0416.0417.1018.04 - CVE-2019-11043Exploited list, 25 Mar 2022
PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability
12.0414.0416.0418.0419.0419.10 - CVE-2011-3544Exploited list, 3 Mar 2022
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
10.0410.1011.0411.10 - CVE-2013-1675Exploited list, 3 Mar 2022
Mozilla Firefox Information Disclosure Vulnerability
12.0412.1013.04
1 more exploited flaw names Ubuntu Linux without a version of its own, for example as the system other affected software runs on. It is in the list below.
Showing the 30 most recently added of 46 exploited flaws. The full list is below.
Which Ubuntu Linux vulnerabilities are being exploited?
46 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 7.8Linux Kernel Improper Authentication Vulnerability
Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.
- 7.8Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability
Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.
- 7.8Linux Kernel Integer Overflow Vulnerability
Linux Kernel contains an integer overflow vulnerability in the create_elf_tables() function which could allow an unprivileged local user with access to SUID (or otherwise privileged) binary to escalate their...
- 9.3Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Sudo contains an inclusion of functionality from untrusted control sphere vulnerability.
- 8.4ImageMagick Improper Input Validation Vulnerability
ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders.
- 5.3Linux Kernel Use-After-Free Vulnerability
Linux Kernel contains a use-after-free vulnerability in the nft_object, allowing local attackers to escalate privileges.
- 7.8GNU C Library Buffer Overflow Vulnerability
GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.
- 9.8Apache Tomcat Remote Code Execution Vulnerability
Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports.
Which Ubuntu Linux flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- >99%
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by...
- >99%
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via...
- >99%
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown...
- 99%CVE-2011-3192High
The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses...
- 97%
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a...
- 97%
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect...
- 97%CVE-2006-3747High
Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to...
- 96%
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and...
- 95%CVE-2006-3918Medium
http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an...
Running Ubuntu Linux? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.
- Matched to
- Ubuntu Linux on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 4,170 published vulnerabilities listed under the name Ubuntu Linux, across 76 versions. The most recent Ubuntu Linux flaw added to the known-exploited list is CVE-2022-0492, on 2 June 2026.
46 are on the list of flaws known to be exploited. The most recently added are CVE-2022-0492, CVE-2026-31431 and CVE-2018-14634.
Each flaw names its own versions, usually as ranges. The newest, CVE-2022-0492, affects 14.04, 16.04, 18.04, 20.04 and more. The versions for every exploited flaw are listed on this page.
Create a EdgeProtect account and track Ubuntu Linux. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.