linuxfoundation has 61 CVEs on record between 2020 and 2026. Disclosure cadence is accelerating: 27 in the last 90 days against 11 in the 90 before. The busiest recent month was October 2026 with 24. The median CVSS is 7.5 (high), with 4 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-863 (10) and CWE-200 (6). Most affected products: nats-server (16), backstage_plugin-techdocs-node (8), backstage/plugin-scaffolder-backend (7).
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 27 prev 11
Weakness classes
Products
- nats-server 16
- backstage_plugin-techdocs-node 8
- backstage/plugin-scaffolder-backend 7
- backstage_plugin-catalog-backend 3
- runc 3
- backstage 2
61
Total CVEs
4
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-33701Critical· 9.8OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java66CVE-2024-21626High· 8.6runc is a CLI tool for spawning and running containers on Linux according to the OCI specification63CVE-2026-46680High· 7.8containerd is an open-source container runtime55CVE-2025-31133High· 7.8runc is a CLI tool for spawning and running containers according to the OCI specification55CVE-2026-106501Critical· 9.6Backstage is an open framework for building developer portals53
linuxfoundation vulnerabilities
CVEs affecting linuxfoundation, newest first. Open any entry for full detail, references, and exploit status.
61 CVEsRSS