EP
Product
Epiphany
14
CVEs
0
On KEV
8.1
Max CVSS
0
New 30D
Severity mix
Critical 0High 6Medium 5Low 0
Watch
Add Epiphany to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-6251 | 8.1 | Jan 14 | WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections Affected: through 3.31.4 |
| CVE-2023-26081 | 7.5 | Feb 20 | In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts Affected: before 43.1 |
| CVE-2022-29536 | 7.5 | Apr 20 | In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow (in ephy_string_shorten in the UI process) via a long page title Affected: before 41.4; 42.0 before 42.2 |
| CVE-2018-12016 | 7.5 | Jun 7 | libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via certain window.open and document.write… Affected: through 3.28.2.1 |
| CVE-2018-11396 | 7.5 | May 23 | ephy-session.c in libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via JavaScript code that… Affected: through 3.28.2.1 |
| CVE-2017-1000025 | 7.5 | Jul 17 | GNOME Web (Epiphany) 3.23 before 3.23.5, 3.22 before 3.22.6, 3.20 before 3.20.7, 3.18 before 3.18.11, and prior versions, is vulnerable to a password manager sweep attack… Affected: 3.18.0; 3.18.1; 3.18.2; 3.18.3; 3.18.4; 3.18.5; +25 more |
| CVE-2021-45088 | 6.1 | Dec 16 | XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an error page Affected: before 40.4; 41.0 before 41.1 |
| CVE-2021-45087 | 6.1 | Dec 16 | XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 when View Source mode or Reader mode is used, as demonstrated by a a page title Affected: before 40.4; 41.0 before 41.1 |
| CVE-2021-45086 | 6.1 | Dec 16 | XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name value in PDF.js Affected: before 40.4; 41.0 before 41.1 |
| CVE-2021-45085 | 6.1 | Dec 16 | XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an about: page, as demonstrated by ephy-about:overview when a user visits an XSS payload page often… Affected: before 40.4; 41.0 before 41.1 |
| CVE-2026-18487 | 5.4 | Aug 6 | Epiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host() Affected: 49.2 |
| CVE-2010-3312 | – | Oct 14 | Epiphany 2.28 and 2.29, when WebKit and LibSoup are used, unconditionally displays a closed-lock icon for any URL beginning with the https: substring, without any warning to the… Affected: 2.28; 2.29 |
| CVE-2008-5985 | – | Jan 28 | Untrusted search path vulnerability in the Python interface in Epiphany 2.22.3, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python… Affected: 2.22.3 |
| CVE-2005-0238 | – | May 2 | The International Domain Name (IDN) support in Epiphany allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL… Affected: All versions, or not specified |
Showing 14