Gnome vulnerabilities
63 CVEs and advisories name Gnome as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-118599epiphany: TAR-based .xpi with hard links can overwrite user files during WebExtension install
- CVE-2026-118598epiphany: clipboard/website-data permission prompt incorrectly grants camera and microphone access
- CVE-2026-115683epiphany: TLS certificate warning bypass via race in tlsErrorPage message handler
- CVE-2026-116124GNOME libgsf OLE2 gsf-infile-msole.c ole_info_read_metabat heap-based overflow
- CVE-2026-111132GNOME libgxps through 0.3.2 Heap Out-of-Bounds Read via path_geometry_start_element
- CVE-2026-110777Evolution-data-server: local file disclosure via attach file:// uris
- CVE-2026-91841Networkmanager-vpnc: networkmanager-vpnc: incomplete fix for cve-2018-10900 allows root privilege escalation via ca-file path newline injection
- CVE-2026-91840Networkmanager-vpnc: networkmanager-vpnc: local privilege escalation to root via newline injection in vpn username
- CVE-2026-91839Networkmanager-fortisslvpn: networkmanager-fortisslvpn: local privilege escalation to root via crlf injection in vpn profile credentials
- CVE-2026-91838Networkmanager-sstp: networkmanager-sstp: local privilege escalation to root via shell injection in vpn profile fields
- CVE-2026-91837Networkmanager-iodine: networkmanager-iodine: local privilege escalation to root via nameserver option injection
- CVE-2026-97222Gnumeric: gnumeric: heap use-after-free when opening a malformed workbook
- CVE-2026-92248Gimp: integer overflow when generating a thumbnail preview for a psd file
- CVE-2026-88924Gvfs: gvfs-admin socket ownership race permits local root
- CVE-2026-84270Gvfs: mtp: out-of-bounds read in do_read()
- CVE-2026-84269Gvfs: afp: heap-based buffer overflow in dsi read path
- CVE-2026-84267Gvfs: sftp: uninitialized heap disclosure in read_string()
- CVE-2026-84268Gvfs: sftp: heap-based buffer overflow in read_reply()
- CVE-2026-82343Gimp: heap out-of-bounds read and stack out-of-bounds access in psd loader from channel-count handling
- CVE-2026-82330Gimp: heap out-of-bounds read in pvr vq (compressed) decoder due to missing bounds check
- CVE-2026-82328Gimp: heap out-of-bounds read in ico loader via unvalidated used_clrs palette count
- CVE-2026-82324Gimp: heap out-of-bounds reads in iff/ilbm loader from ham row size mismatch and nplanes=0
- CVE-2026-77652Dia: dia: heap buffer overflow in wpg colormap parser via out-of-bounds palette index
- CVE-2026-79902Gimp: stack vla size underflow denial of service in seattle
- CVE-2026-77658Dia: dia: stack buffer overflow in bus object via unvalidated handle count in project files
- CVE-2026-80101Gimp: multiple heap out-of-bounds reads in xwd loader from unrelated width and bytes-per-line validation
- CVE-2026-78475Gimp: unbounded stack vla and 21-byte stack over-read in pix (esm) loader
- CVE-2026-78465Gimp: integer overflow in pcx loader (planes=4) leads to heap overflow on 32-bit
- CVE-2026-18487Epiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host()
- CVE-2026-18358Gnome-remote-desktop: gnome-remote-desktop system-mode rdp server missing connection throttling allows unauthenticated denial of service