Read the docs

OSGeo

Records62All Threatist records
Exploited (KEV)3In CISA KEV
CVSS critical18CVSS 9.0–10.0
CVSS high25CVSS 7.0–8.9

Exploited now

OSGeo records in CISA KEV
TI-2025-36149 OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability Priority CRITICAL 99KEV 2025-12-11TI-2024-24187 OSGeo GeoServer GeoTools Eval Injection Vulnerability Priority CRITICAL 100KEV 2024-07-15TI-2022-08629 OSGeo GeoServer JAI-EXT Code Injection Vulnerability Priority CRITICAL 100KEV 2024-06-26

Components

Products in the NVD configurations · select one to filter the records
Mapserver 22 records HIGH Geoserver 16 records CRITICAL Gdal 12 records HIGH Geonetwork 4 records HIGH Owslib 2 records MEDIUM Pywps 1 record LOW Shapelib 1 record MEDIUM

Records

12 records in Gdal · all components

TI-2026-36264 CVE-2026-49014 · GHSA-wphc-7cm7-8mf7

Stack-based buffer overflow in GDAL

Priority HIGH 69

In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00102 Published 2026-05-27 Fixed in 3.13.1 CWE-121
TI-2026-07126 CVE-2026-8088 · GHSA-j3f5-rw74-g4rv

OSGeo gdal GDapi.c GDfieldinfo out-of-bounds

Priority MEDIUM 55

A weakness has been identified in OSGeo gdal up to 3.13.0dev-4.

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00246 Published 2026-05-07 Fixed in 3.13.0RC1, 3.13.0 CWE-119
TI-2026-07125 CVE-2026-8087 · GHSA-h9rh-5ffh-h669

OSGeo gdal GDapi.c GDnentries heap-based overflow

Priority MEDIUM 55

A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4.

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00223 Published 2026-05-07 Fixed in 3.13.0RC1, 3.13.0 CWE-119
TI-2026-07124 CVE-2026-8086 · GHSA-72pg-5w29-wjx6

OSGeo gdal SWapi.c SWnentries heap-based overflow

Priority MEDIUM 55

A vulnerability was identified in OSGeo gdal up to 3.13.0dev-4.

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00237 Published 2026-05-07 Fixed in 3.12.4RC1 CWE-119
TI-2019-13090 CVE-2019-17546 · GHSA-24m4-fmx6-c2q6

tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other…

Priority MEDIUM 44

tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-si…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.03356 Published 2019-10-14 Partial fix CWE-190
TI-2019-15190 CVE-2019-25050 · GHSA-723m-9g33-2g82

netCDF in GDAL 2.4.2 through 3.0.4 has a stack-based buffer overflow in nc4_get_att…

Priority LOW 34

netCDF in GDAL 2.4.2 through 3.0.4 has a stack-based buffer overflow in nc4_get_att (called from nc4_get_att_tc and nc_get_att_text) and in uffd_cleanup (called from netCDFDataset::~netCDFDataset and netCDFDataset::~netC…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.0035 Published 2021-07-20 No fix listed CWE-787
TI-2021-20947 CVE-2021-45943 · GHSA-x54c-x29c-rpr5

GDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in…

Priority LOW 28

GDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in PCIDSK::CPCIDSKFile::ReadFromFile (called from PCIDSK::CPCIDSKSegment::ReadFromFile and PCIDSK::CPCIDSKBinarySegment::CPCIDSKBinarySegment).

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.0154 Published 2021-12-31 No fix listed CWE-787
Open these records in search →