EM
Product
Emacs
42
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 2High 15Medium 6Low 1
Watch
Add Emacs to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-14482 | 8.8 | Sep 14 | GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that… Affected: through 25.2 |
| CVE-2026-108976 | 7.8 | Oct 11 | GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs Affected: before 31.2 |
| CVE-2024-53920 | 7.8 | Nov 27 | In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp… Affected: before 30.1 |
| CVE-2024-30202 | 7.8 | Mar 25 | In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode Affected: before 29.3 |
| CVE-2023-2491 | 7.8 | May 17 | A flaw was found in the Emacs text editor Affected: 26.1-9.el8; 27.2-8.el9 |
| CVE-2023-27986 | 7.8 | Mar 9 | emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto: URI with unescaped double-quote characters Affected: 28.1 through 28.2 |
| CVE-2023-27985 | 7.8 | Mar 9 | emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto: URI Affected: 28.1 through 28.2 |
| CVE-2022-48339 | 7.8 | Feb 20 | An issue was discovered in GNU Emacs through 28.2 Affected: through 28.2 |
| CVE-2022-45939 | 7.8 | Nov 28 | GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function… Affected: through 28.2 |
| CVE-2026-96269 | 7.5 | Sep 22 | GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions Affected: 28.1 through 31.1 |
| CVE-2014-9483 | 7.5 | Aug 28 | Emacs 24.4 allows remote attackers to bypass security restrictions Affected: 24.4 |
| CVE-2022-48338 | 7.3 | Feb 20 | An issue was discovered in GNU Emacs through 28.2 Affected: through 28.2 |
| CVE-2026-77219 | 7.1 | Aug 21 | GNU Emacs < 31.0.91 Heap Over-Read via PBM/PPM/PGM Image Loader Affected: before 31.0.91 |
| CVE-2026-6861 | 7.1 | Apr 22 | Emacs: emacs: memory corruption vulnerability when processing svg css Affected: 28.1 through 30.2 |
| CVE-2024-30205 | 7.1 | Mar 25 | In Emacs before 29.3, Org mode considers contents of remote files to be trusted Affected: before 29.3 |
Showing 15