Guacamole (Apache) - vulnerabilities (CVEs)
13 CVEs, 0 in the last 30 days, 75 known versions, newest CVE from 2025-07-02. Vendor: Apache.
CVEs of Guacamole
- CVE-2024-35164 - CVSS 7.5 (high), 2025-07-02: The terminal emulator of Apache Guacamole 1.5.5 and older does not properly validate console codes received from servers via text-based protocols like SSH. If…
- CVE-2023-43826 - CVSS 8.8 (high), 2023-12-19: Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in integer overflow. If a user connects to…
- CVE-2023-30576 - CVSS 8.1 (high), 2023-06-07: Apache Guacamole 0.9.10 through 1.5.1 may continue to reference a freed RDP audio input buffer. Depending on timing, this may allow an attacker to execute…
- CVE-2023-30575 - CVSS 7.5 (high), 2023-06-07: Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths of instruction elements sent during the Guacamole protocol handshake, potentially…
- CVE-2021-43999 - CVSS 8.8 (high), 2022-01-11: Apache Guacamole 1.2.0 and 1.3.0 do not properly validate responses received from a SAML identity provider. If SAML support is enabled, this may allow a…
- CVE-2021-41767 - CVSS 6.5 (medium), 2022-01-11: Apache Guacamole 1.3.0 and older may incorrectly include a private tunnel identifier in the non-private details of some REST responses. This may allow an…
- CVE-2020-11997 - CVSS 4.3 (medium), 2021-01-19: Apache Guacamole 1.2.0 and earlier do not consistently restrict access to connection history based on user visibility. If multiple users share access to the…
- CVE-2020-9498 - CVSS 6.7 (medium), 2020-07-02: Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious…
- CVE-2020-9497 - CVSS 4.4 (medium), 2020-07-02: Apache Guacamole 1.1.0 and older do not properly validate datareceived from RDP servers via static virtual channels. If a userconnects to a malicious or…
- CVE-2019-19603 - CVSS 7.5 (high), 2019-12-09: SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash.
- CVE-2018-1340 - CVSS 7.5 (high), 2019-02-07: Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's session token. This cookie lacked the "secure" flag, which could allow an…
- CVE-2017-3158 - CVSS 8.1 (high), 2018-01-18: A race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data to overlap. Such…
- CVE-2016-1566 - CVSS 5.4 (medium), 2017-02-02: Cross-site scripting (XSS) vulnerability in the file browser in Guacamole 0.9.8 and 0.9.9, when file transfer is enabled to a location shared by multiple…
