Priority HIGH 82
A flaw was found in GNOME Maps, which is vulnerable to a code injection attack via its service.json configuration file.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00979 · Published 2024-11-17 · No fix listed CWE-79
Priority HIGH 76
A flaw was found in GLib.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.00558 · Published 2026-06-30 · Partial fix · 2.88.1, 2.80.4-12.el10_2.21 +94 CWE-193
Priority HIGH 72
A flaw was found in GLib.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00474 · Published 2026-06-30 · Partial fix · 2.86.5, 2.88.1 +87 CWE-125
Priority HIGH 72
A flaw was found in libsoup, a library for handling HTTP requests.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0088 · Published 2026-03-17 · Partial fix · 3.6.5-3.el10_1.11, 3.6.5-3.el10_2.11 +1 CWE-416
Priority HIGH 72
An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf).
CVSS 3.1HIGH 8.4· Local · No auth · No interaction · EPSS 0.00458 · Published 2024-10-03 · No fix listed CWE-190
Priority HIGH 72
An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Structured File Library (libgsf) version v1.14.52.
CVSS 3.1HIGH 8.4· Local · No auth · No interaction · EPSS 0.00403 · Published 2024-10-03 · No fix listed CWE-190
Priority HIGH 72
In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01228 · Published 2023-02-20 · No fix listed CWE-668
Priority HIGH 72
Gnome Fonts Viewer 3.34.0 contains a heap corruption vulnerability that allows attackers to trigger an out-of-bounds write by crafting a malicious TTF font file.
CVSS 4.0HIGH 8.4· Local · No auth · User interaction · EPSS 0.00446 · Published 2026-01-29 · Fix deferred CWE-787
Priority HIGH 70
GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_parse_param_list_strict.
CVSS 3.1HIGH 8.4· Local · No auth · No interaction · EPSS 0.0068 · Published 2024-11-11 · Partial fix · 3.6.1 CWE-787
Priority HIGH 69
A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00202 · Published 2026-08-26 · No fix listed CWE-121
Priority HIGH 69
A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00212 · Published 2026-08-26 · No fix listed CWE-122
Priority HIGH 69
A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management.
CVSS 3.1HIGH 7.8· Local · No auth · No interaction · EPSS 0.00444 · Published 2025-07-10 · Partial fix · 2.15.2, 1.1.39-8.el10_0 +42 CWE-416
Priority HIGH 69
CSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via crafted .tsv file when creating a new record.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00587 · Published 2023-09-14 · No fix listed CWE-74
Priority HIGH 69
In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory corruption (in ani_load_chunk in io-ani.c) when parsing chunks in a crafted .ani file.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00415 · Published 2024-01-26 · Partial fix CWE-787
Priority HIGH 69
The cr_tknzr_parse_rgb function in cr-tknzr.c in libcroco 0.6.11 and 0.6.12 has an "outside the range of representable values of type long" undefined behavior issue, which might allow remote attackers to cause a denial o…
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.01966 · Published 2017-04-19 · No fix listed CWE-119
Priority HIGH 66
A flaw was found in the admin backend of gvfs.
CVSS 3.1HIGH 7.0· Local · Low privileges · No interaction · EPSS 0.00223 · Published 2026-09-10 · Partial fix · 1.62.0, 1.60.3 +7 CWE-367
Priority HIGH 66
A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only.
CVSS 3.1HIGH 7.0· Local · No auth · User interaction · EPSS 0.00281 · Published 2026-08-24 · Will not fix CWE-190
Priority HIGH 66
A flaw was found in GLib.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00543 · Published 2025-07-28 · Fixed in 2.84.1 CWE-94
Priority HIGH 66
A flaw was found in Yelp.
CVSS 3.1HIGH 7.4· Network · No auth · User interaction · EPSS 0.13121 · Published 2025-04-03 · Partial fix · 42.2-8, 2:3.28.1-3.el8_10.1 +9 CWE-601
Priority HIGH 66
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with…
CVSS 3.0HIGH 7.8· Local · No auth · User interaction · EPSS 0.51076 · Published 2017-09-05 · Fixed
Priority HIGH 65
A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page.
CVSS 3.1MEDIUM 6.8· Network · No auth · User interaction · EPSS 0.0022 · Published 2026-10-30 · Fixed in 51.1 CWE-367
Priority MEDIUM 64
A flaw was found in the file-icns plugin in GIMP.
CVSS 3.1HIGH 7.1· Local · No auth · User interaction · EPSS 0.00305 · Published 2026-07-27 · Fixed in 2:3.0.4-4.el9_8.9 CWE-125
Priority MEDIUM 64
A flaw was found in libsoup.
CVSS 3.1HIGH 7.0· Network · No auth · No interaction · EPSS 0.00876 · Published 2025-04-03 · Partial fix · 3.6.5, 3.6.5-3.el10_0 +10 CWE-125
Priority MEDIUM 63
A flaw was found in gdk-pixbuf.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00405 · Published 2026-07-23 · Fix deferred CWE-125
Priority MEDIUM 62
A flaw was found in the AFP backend in gvfs.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00302 · Published 2026-09-01 · Partial fix · 1.60.2 CWE-122
Load more
THREATIST.IORead the docs