GN
Vendor
Gnome
408
CVEs
0
On KEV
9
New 30D
Products
LI9.8
Libsoup
Gnome
35 CVEs0 on KEV6 new
EV7.5
evolution-data-server
GNOME
6 CVEs0 on KEV1 new
LI7.8
libgsf
GNOME
4 CVEs0 on KEV1 new
LI7.5
libgxps
GNOME
4 CVEs0 on KEV1 new
GL9.8
glib
GNOME
33 CVEs0 on KEV0 new
EV9.8
Evolution
Gnome
21 CVEs0 on KEV0 new
GD9.8
gdk-pixbuf
GNOME
21 CVEs0 on KEV0 new
GD–
Gdm
Gnome
15 CVEs0 on KEV0 new
GT9.8
Gtk
Gnome
15 CVEs0 on KEV0 new
EP8.1
Epiphany
GNOME
14 CVEs0 on KEV0 new
GI7.8
GIMP
GNOME
12 CVEs0 on KEV0 new
NE7.5
Networkmanager
Gnome
12 CVEs0 on KEV0 new
GD8.8
Gdkpixbuf
Gnome
11 CVEs0 on KEV0 new
GN8.1
Gnome-shell
Gnome
11 CVEs0 on KEV0 new
SC–
Screensaver
Gnome
11 CVEs0 on KEV0 new
GD7.8
Gnome Display Manager
Gnome
10 CVEs0 on KEV0 new
GV8.8
gvfs
GNOME
10 CVEs0 on KEV0 new
LI8.8
Librsvg
Gnome
10 CVEs0 on KEV0 new
EV7.8
Evince
Gnome
7 CVEs0 on KEV0 new
PA9.8
Pango
Gnome
6 CVEs0 on KEV0 new
GP–
Gpdf
Gnome
5 CVEs0 on KEV0 new
LI7.8
Libcroco
Gnome
5 CVEs0 on KEV0 new
GK7.8
Gnome Keyring
Gnome
4 CVEs0 on KEV0 new
GN5.5
Gnumeric
GNOME
4 CVEs0 on KEV0 new
NA7.8
Nautilus
Gnome
4 CVEs0 on KEV0 new
BA7.5
Balsa
Gnome
3 CVEs0 on KEV0 new
DI7.8
Dia
GNOME
3 CVEs0 on KEV0 new
FI4.3
File-roller
Gnome
3 CVEs0 on KEV0 new
GT7.8
Gthumb
Gnome
3 CVEs0 on KEV0 new
GT9.8
Gtk-vnc
Gnome
3 CVEs0 on KEV0 new
LI9.8
libxml2
GNOME
3 CVEs0 on KEV0 new
LO8.1
Localsearch
Gnome
3 CVEs0 on KEV0 new
YE7.4
Yelp
Gnome
3 CVEs0 on KEV0 new
CC5.5
Control Center
Gnome
2 CVEs0 on KEV0 new
DH–
Dwarf Http Server
Gnome
2 CVEs0 on KEV0 new
EM–
Empathy
Gnome
2 CVEs0 on KEV0 new
EO–
Eog
Gnome
2 CVEs0 on KEV0 new
GC7.8
Gcab
Gnome
2 CVEs0 on KEV0 new
GE5.5
Gedit
Gnome
2 CVEs0 on KEV0 new
GN5.5
Gnome-autoar
Gnome
2 CVEs0 on KEV0 new
GO–
Gnome Online Accounts
Gnome
2 CVEs0 on KEV0 new
GN–
Gnome-terminal
Gnome
2 CVEs0 on KEV0 new
GT–
Gtkhtml
Gnome
2 CVEs0 on KEV0 new
LD–
Libgtop Daemon
Gnome
2 CVEs0 on KEV0 new
LI7.5
librest
GNOME
2 CVEs0 on KEV0 new
LI–
Libsocialweb
Gnome
2 CVEs0 on KEV0 new
NE7.8
NetworkManager-vpnc
GNOME
2 CVEs0 on KEV0 new
PM–
Power Manager
Gnome
2 CVEs0 on KEV0 new
RH–
Rhythmbox
Gnome
2 CVEs0 on KEV0 new
SH7.5
Shotwell
Gnome
2 CVEs0 on KEV0 new
AN7.5
Anjuta
Gnome
1 CVEs0 on KEV0 new
AT–
At-spi2-atk
Gnome
1 CVEs0 on KEV0 new
BN–
Batalla Naval
Gnome
1 CVEs0 on KEV0 new
BO–
Bonobo
Gnome
1 CVEs0 on KEV0 new
BY–
Byzanz
Gnome
1 CVEs0 on KEV0 new
CA7.5
Caribou
Gnome
1 CVEs0 on KEV0 new
DH–
Dhcdbd
Gnome
1 CVEs0 on KEV0 new
EK–
Ekiga
Gnome
1 CVEs0 on KEV0 new
ES–
Esound
Gnome
1 CVEs0 on KEV0 new
EV7.3
Evolution-data-server3
Gnome
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116124 New | LI libgsf GNOME | 6.3 | Oct 26 | GNOME libgsf OLE2 gsf-infile-msole.c ole_info_read_metabat heap-based overflow |
| CVE-2026-111132 | LI libgxps GNOME | 6.1 | Oct 15 | GNOME libgxps through 0.3.2 Heap Out-of-Bounds Read via path_geometry_start_element |
| CVE-2026-110777 | EV evolution-data-server GNOME | 5.7 | Oct 14 | Evolution-data-server: local file disclosure via attach file:// uris |
| CVE-2026-102560 | LI Libsoup Gnome | 9.8 | Sep 29 | Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth |
| CVE-2026-102559 | LI Libsoup Gnome | 8.6 | Sep 29 | Libsoup: libsoup: heap buffer overflow during websocket client-frame masking |
| CVE-2026-102558 | LI Libsoup Gnome | 8.6 | Sep 29 | Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth |
| CVE-2026-102555 | LI Libsoup Gnome | 8.2 | Sep 29 | Libsoup: libsoup: heap buffer overflow via uninitialized length in data-uri base64 decoding |
| CVE-2026-102557 | LI Libsoup Gnome | 8.6 | Sep 29 | Libsoup: libsoup: heap buffer overflow during websocket message reassembly |
| CVE-2026-102556 | LI Libsoup Gnome | 8.6 | Sep 29 | Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion |
| CVE-2026-91841 | NE NetworkManager-vpnc GNOME | 7.8 | Sep 25 | Networkmanager-vpnc: networkmanager-vpnc: incomplete fix for cve-2018-10900 allows root privilege escalation via ca-file path newline injection |
| CVE-2026-91840 | NE NetworkManager-vpnc GNOME | 7.8 | Sep 25 | Networkmanager-vpnc: networkmanager-vpnc: local privilege escalation to root via newline injection in vpn username |
| CVE-2026-91839 | NE NetworkManager-fortisslvpn GNOME | 7.8 | Sep 25 | Networkmanager-fortisslvpn: networkmanager-fortisslvpn: local privilege escalation to root via crlf injection in vpn profile credentials |
| CVE-2026-91838 | NE NetworkManager-sstp GNOME | 7.8 | Sep 25 | Networkmanager-sstp: networkmanager-sstp: local privilege escalation to root via shell injection in vpn profile fields |
| CVE-2026-91837 | NE NetworkManager-iodine GNOME | 7.8 | Sep 25 | Networkmanager-iodine: networkmanager-iodine: local privilege escalation to root via nameserver option injection |
| CVE-2026-97222 | GN Gnumeric GNOME | 5.5 | Sep 25 | Gnumeric: gnumeric: heap use-after-free when opening a malformed workbook |
| CVE-2026-92248 | GI GIMP GNOME | 7.8 | Sep 15 | Gimp: integer overflow when generating a thumbnail preview for a psd file |
| CVE-2026-88924 | GV gvfs GNOME | 7.0 | Sep 10 | Gvfs: gvfs-admin socket ownership race permits local root |
| CVE-2026-84270 | GV gvfs GNOME | 4.3 | Sep 1 | Gvfs: mtp: out-of-bounds read in do_read() |
| CVE-2026-84269 | GV gvfs GNOME | 6.5 | Sep 1 | Gvfs: afp: heap-based buffer overflow in dsi read path |
| CVE-2026-84267 | GV gvfs GNOME | 4.3 | Sep 1 | Gvfs: sftp: uninitialized heap disclosure in read_string() |
| CVE-2026-84268 | GV gvfs GNOME | 8.8 | Sep 1 | Gvfs: sftp: heap-based buffer overflow in read_reply() |
| CVE-2026-82343 | GI GIMP GNOME | 6.1 | Aug 28 | Gimp: heap out-of-bounds read and stack out-of-bounds access in psd loader from channel-count handling |
| CVE-2026-82330 | GI GIMP GNOME | 6.1 | Aug 28 | Gimp: heap out-of-bounds read in pvr vq (compressed) decoder due to missing bounds check |
| CVE-2026-82328 | GI GIMP GNOME | 6.1 | Aug 28 | Gimp: heap out-of-bounds read in ico loader via unvalidated used_clrs palette count |
| CVE-2026-82324 | GI GIMP GNOME | 6.1 | Aug 28 | Gimp: heap out-of-bounds reads in iff/ilbm loader from ham row size mismatch and nplanes=0 |
| CVE-2026-77652 | DI Dia GNOME | 7.8 | Aug 26 | Dia: dia: heap buffer overflow in wpg colormap parser via out-of-bounds palette index |
| CVE-2026-79902 | GI GIMP GNOME | 5.5 | Aug 26 | Gimp: stack vla size underflow denial of service in seattle |
| CVE-2026-77658 | DI Dia GNOME | 7.8 | Aug 26 | Dia: dia: stack buffer overflow in bus object via unvalidated handle count in project files |
| CVE-2026-80101 | GI GIMP GNOME | 4.4 | Aug 25 | Gimp: multiple heap out-of-bounds reads in xwd loader from unrelated width and bytes-per-line validation |
| CVE-2026-78475 | GI GIMP GNOME | 6.1 | Aug 24 | Gimp: unbounded stack vla and 21-byte stack over-read in pix (esm) loader |
| CVE-2026-78465 | GI GIMP GNOME | 7.0 | Aug 24 | Gimp: integer overflow in pcx loader (planes=4) leads to heap overflow on 32-bit |
| CVE-2026-18487 | EP Epiphany GNOME | 5.4 | Aug 6 | Epiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host() |
| CVE-2026-66759 | GI GIMP GNOME | 7.1 | Jul 27 | Gimp: out-of-bounds read in file-icns plugin causes information disclosure or crash on crafted icns images |
| CVE-2026-66757 | GI GIMP GNOME | 5.5 | Jul 27 | Gimp: signed integer overflow in file-sgi (sgi-lib) causes the plugin to crash on rle sgi images |
| CVE-2026-66758 | GI GIMP GNOME | 7.8 | Jul 27 | Gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted fits images |
| CVE-2026-66337 | LI Libsoup Gnome | 6.5 | Jul 24 | Libsoup: libsoup: heap buffer over-read via integer underflow in soup_filter_input_stream_read_until() |
| CVE-2026-66338 | LI Libsoup Gnome | 7.2 | Jul 24 | Libsoup: libsoup: http request smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked() |
| CVE-2026-66339 | LI Libsoup Gnome | 6.5 | Jul 24 | Libsoup: libsoup: proxy credentials leak to destination server via proxy-authorization header in connect tunnels |
| CVE-2026-16768 | GD gdk-pixbuf GNOME | 5.3 | Jul 23 | Gdk-pixbuf: out-of-bounds read in ico parser |
| CVE-2026-16615 | LI librest GNOME | 6.8 | Jul 22 | Librest: weak random number generation in pkce implementation |
| CVE-2026-12548 | LI Libsoup Gnome | 4.2 | Jul 21 | Libsoup: heap out-of-bounds read in libsoup due to integer truncation |
| CVE-2026-58016 | GL GLib GNOME | 9.1 | Jun 30 | Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml" |
| CVE-2026-58015 | GL GLib GNOME | 7.5 | Jun 30 | Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive |
| CVE-2026-58014 | GL GLib GNOME | 8.6 | Jun 30 | Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" |
| CVE-2026-58013 | GL GLib GNOME | 8.2 | Jun 30 | Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" |
| CVE-2026-58012 | GL GLib GNOME | 8.2 | Jun 30 | Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() |
| CVE-2026-58011 | GL GLib GNOME | 7.5 | Jun 30 | Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime |
| CVE-2026-58010 | GL GLib GNOME | 8.2 | Jun 30 | Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal() |
| CVE-2026-13601 | YE Yelp Gnome | 6.5 | Jun 29 | Yelp: yelp-xsl: overly permissive content security policy in yelp allows host file disclosure from flatpak applications |
| CVE-2026-12549 | LI Libsoup Gnome | 4.8 | Jun 22 | Libsoup: incomplete fix for cve-2026-2443: range suffix overflow in libsoup soupserver |
| CVE-2026-6653 | LI libxml2 GNOME | 9.8 | Jun 22 | libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling |
| CVE-2026-2604 | ED Evolution Data Server GNOME | 5.6 | Jun 16 | Evolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handling |
| CVE-2026-1767 | LO Localsearch Gnome | 8.1 | Jun 16 | Localsearch: tracker-miners: gnome localsearch mp3 extractor: heap buffer overflow leading to denial of service or information disclosure via malformed mp3 id3 tags |
| CVE-2026-1766 | LO Localsearch Gnome | 6.1 | Jun 16 | Localsearch: tracker-miners: gnome localsearch mp3 extractor: denial of service and information disclosure via malformed mp3 files. |
| CVE-2026-1764 | LO Localsearch Gnome | 5.6 | Jun 16 | Localsearch: tracker-miners: gnome localsearch mp3 extractor: heap buffer overflow leads to denial of service or information disclosure when parsing mp3 files |
| CVE-2026-44931 | MA malcontent gnome | 5.1 | May 13 | malcontent: Disk Space Exhaustion via Globally Accessible D-Bus API |
| CVE-2026-2708 | LI Libsoup Gnome | 5.3 | Apr 23 | Libsoup: libsoup: http request smuggling via duplicate content-length headers |
| CVE-2026-5201 | GD Gdk-pixbuf Gnome | 7.5 | Mar 31 | Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image |
| CVE-2026-5119 | LI Libsoup Gnome | 8.2 | Mar 30 | Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment |
| CVE-2026-2436 | LI Libsoup Gnome | 8.2 | Mar 26 | Libsoup: libsoup: denial of service via use-after-free in soupserver during tls handshake |