WE
Product
WebKitGTK
On CISA KEVExploited in the wildRansomware-linked
133
CVEs
15
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 11High 73Medium 35Low 2
Watch
Add WebKitGTK to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-1870 In wildKEV | 9.8 | Apr 2 | Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability Affected: before 2.30.6 |
| CVE-2020-13753 | 10.0 | Jul 14 | The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl Affected: before 2.28.3 |
| CVE-2025-43343 | 9.8 | Sep 15 | The issue was addressed with improved memory handling Affected: before 2.50.1 |
| CVE-2025-43342 | 9.8 | Sep 15 | A correctness issue was addressed with improved checks Affected: before 2.48.7 |
| CVE-2023-40397 | 9.8 | Sep 6 | The issue was addressed with improved checks Affected: before 2.40.5 |
| CVE-2020-10018 | 9.8 | Mar 2 | WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4 (which are the versions right before 2.28.0) contains a memory corruption issue (use-after-free) that may lead to arbitrary… Affected: before 2.28.0 |
| CVE-2019-8375 | 9.8 | Feb 24 | The UIProcess subsystem in WebKit, as used in WebKitGTK through 2.23.90 and WebKitGTK+ through 2.22.6 and other products, does not prevent the script dialog size from exceeding… Affected: through 2.23.90 |
| CVE-2018-12911 | 9.8 | Jul 19 | WebKitGTK+ 2.20.3 has an off-by-one error, with a resultant out-of-bounds write, in the get_simple_globs functions in ThirdParty/xdgmime/src/xdgmimecache.c and… Affected: 2.20.3 |
| CVE-2017-1000121 | 9.8 | Nov 1 | The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate message size metadata, allowing a compromised secondary process to trigger an… Affected: before 2.16.3 |
| CVE-2010-4197 | 9.8 | Nov 6 | Use-after-free vulnerability in WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, allows remote attackers to cause a denial of… Affected: before 1.2.6 |
| CVE-2010-4204 | 9.8 | Nov 5 | WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, accesses a frame object after this object has been destroyed, which allows remote… Affected: before 1.2.6 |
Showing 11