Gnome vulnerabilities
63 CVEs and advisories name Gnome as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-66759Gimp: out-of-bounds read in file-icns plugin causes information disclosure or crash on crafted icns images
- CVE-2026-66757Gimp: signed integer overflow in file-sgi (sgi-lib) causes the plugin to crash on rle sgi images
- CVE-2026-66758Gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted fits images
- CVE-2026-16768Gdk-pixbuf: out-of-bounds read in ico parser
- CVE-2026-16615Librest: weak random number generation in pkce implementation
- CVE-2026-58016Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"
- CVE-2026-58015Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
- CVE-2026-58014Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"
- CVE-2026-58013Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"
- CVE-2026-58012Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()
- CVE-2026-58011Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime
- CVE-2026-58010Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()
- CVE-2026-6653libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling
- CVE-2026-2604Evolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handling
- CVE-2026-44931malcontent: Disk Space Exhaustion via Globally Accessible D-Bus API
- CVE-2020-37011Gnome Fonts Viewer 3.34.0 Heap Corruption
- CVE-2025-14512Glib: integer overflow in glib gio attribute escaping causes heap buffer overflow
- CVE-2025-14087Glib: glib: buffer underflow in gvariant parser leads to heap corruption
- CVE-2025-12105Libsoup: heap use-after-free in libsoup message queue handling during http/2 read completion
- CVE-2025-7424Libxslt: type confusion in xmlnode.psvi between stylesheet and source nodes
- CVE-2025-7425Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr
- CVE-2025-49795Libxml: null pointer dereference leads to denial of service (dos)
- CVE-2024-52531GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_parse_param_list_strict.
- CVE-2019-25085GNOME gvdb gvdb-builder.c gvdb_table_write_contents_async use after free
- CVE-2020-16125gdm3 would start gnome-initial-setup if it cannot contact accountservice
- CVE-2012-1096NetworkManager 0.9 and earlier allows local users to use other users' certificates or private keys when making a connection via the file pat
- CVE-2013-4166The gpg_ctx_add_recipient function in camel/camel-gpg-context.c in GNOME Evolution 3.8.4 and earlier and Evolution Data Server 3.9.5 and ear
- CVE-2019-1010238Gnome Pango 1.42 and later is affected by: Buffer Overflow.
- CVE-2011-1830Ekiga attempts to dlopen /tmp/ekiga_test.so
- CVE-2017-12164A flaw was discovered in gdm 3.24.1 where gdm greeter was no longer setting the ran_once boolean during autologin.