Sudo

Every one of the 26 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line ar…CVE-2021-3156Sudo · CVSS 7.8 · 100% likely

   CWE-193

2. Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.CVE-2025-32463Sudo project · CVSS 9.3 · 56% likely

   CWE-829

3. In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invo…CVE-2019-14287Sudo Project · 64% likely

   CWE-755

4. In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a l…CVE-2023-22809Sudo Project · CVSS 7.8 · 55% likely

   CWE-269

5. In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting i…CVE-2019-18634Sudo Project · 19% likely

   CWE-787

6. Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and…CVE-2017-1000367Sudo Project · 8.1% likely

   CWE-362

7. Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.CVE-2025-32462Sudo project · CVSS 2.8 · 4.5% likely

   CWE-863

8. In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with an…CVE-2019-19232Sudo · 3.3% likely
9. In Sudo through 1.8.29, the fact that a user has been blocked (e.g., by using the ! character in the shadow file instead of a password hash) is not considered, allowing an attacke…CVE-2019-19234Sudo · 3.2% likely
10. Sudo before 1.9.13p2 has a double free in the per-command chroot feature.CVE-2023-27320Sudo Project · CVSS 7.2 · 1.7% likely

    CWE-415

11. sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is defined using multiple wildcards in /etc/sudoers, as demonst…CVE-2015-5602Sudo Project · 1.5% likely

    CWE-264

12. Sudo before 1.6.6 contains an off-by-one error that can result in a heap-based buffer overflow that may allow local users to gain root privileges via special characters in the -p…CVE-2002-0184Sudo Project · 1.2% likely

    CWE-131

13. selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a syml…CVE-2021-23240Sudo Project · 1.1% likely

    CWE-59

14. The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replaci…CVE-2021-23239Sudo Project · 1.0% likely

    CWE-59

15. Sudo before 1.9.13 does not escape control characters in sudoreplay output.CVE-2023-28487Sudo Project · 1.0% likely

    CWE-116

16. Sudo before 1.9.13 does not escape control characters in log messages.CVE-2023-28486Sudo Project · 0.9% likely

    CWE-116

17. Sudo: improper handling of ipa_hostname leads to privilege mismanagementCVE-2023-7090Sudo Project · CVSS 6.6 · 0.7% likely

    CWE-269

18. Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on not equaling an error value (…CVE-2023-42465Sudo Project · 0.6% likely
19. Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure…CVE-2017-1000368Sudo Project · 0.6% likely

    CWE-20

20. The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.CVE-2015-8239Sudo Project · 0.5% likely

    CWE-362

21. sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access (but not v…CVE-2014-9680Sudo Project · 0.5% likely

    CWE-200

22. sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C library function with a user supplied argume…CVE-2016-7076Sudo Project · CVSS 6.4 · 0.5% likely

    CWE-184

23. Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read.…CVE-2022-43995Sudo Project · CVSS 7.1 · 0.3% likely

    CWE-125

24. Sudo through 1.8.29 allows local users to escalate to root if they have write access to file descriptor 3 of the sudo process. This occurs because of a race condition between dete…CVE-2019-18684Sudo Project · 0.3% likely

    CWE-362

25. Sudo through 1.9.17p2 Intercept Policy Bypass via execveatCVE-2026-82474sudo-project · CVSS 7.8 · 0.2% likely

    CWE-693

26. In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to…CVE-2026-35535Sudo project · CVSS 7.4 · 0.2% likely

    CWE-271

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.