Gnu - vulnerabilities (CVEs)
1261 CVEs in 137 products, 8 in the last 30 days, newest from 2026-10-28.
Products
- Binutils - 288 CVEs
- Glibc - 163 CVEs
- Libredwg - 101 CVEs
- Gnutls - 74 CVEs
- Grub2 - 48 CVEs
- Mailman - 47 CVEs
- Emacs - 42 CVEs
- Wget - 24 CVEs
- Tar - 20 CVEs
- Bash - 18 CVEs
- Pspp - 16 CVEs
- Cpio - 15 CVEs
- Libextractor - 15 CVEs
- Patch - 15 CVEs
- Gcc - 14 CVEs
- Recutils - 14 CVEs
- Gzip - 13 CVEs
- Libtasn1 - 13 CVEs
- Coreutils - 12 CVEs
- Groff - 10 CVEs
- Libiberty - 10 CVEs
- Privacy Guard - 10 CVEs
- Gdb - 9 CVEs
- Screen - 9 CVEs
- Adns - 8 CVEs
- Inetutils - 8 CVEs
- Mailutils - 8 CVEs
- Gnump3d - 7 CVEs
- Aspell - 6 CVEs
- Cfengine - 6 CVEs
- Elfutils - 6 CVEs
- Libidn - 6 CVEs
- Libmicrohttpd - 6 CVEs
- Nano - 6 CVEs
- Radius - 6 CVEs
- A2ps - 5 CVEs
- Enscript - 5 CVEs
- Libcdio - 5 CVEs
- Org Mode - 5 CVEs
- Osip - 5 CVEs
- Savane - 5 CVEs
- Sharutils - 5 CVEs
- Bison - 4 CVEs
- Cflow - 4 CVEs
- Chess - 4 CVEs
- Ed - 4 CVEs
- Fribidi - 4 CVEs
- Gawk - 4 CVEs
- Guix - 4 CVEs
- Hurd - 4 CVEs
- Inet - 4 CVEs
- Libidn2 - 4 CVEs
- Eglibc - 3 CVEs
- Fileutils - 3 CVEs
- Fingerd - 3 CVEs
- Gnash - 3 CVEs
- Gnats - 3 CVEs
- Gnu Sasl - 3 CVEs
- Gnubiff - 3 CVEs
- Less - 3 CVEs
- Phpbook - 3 CVEs
- Sed - 3 CVEs
- Wget2 - 3 CVEs
- Zebra - 3 CVEs
- Anubis - 2 CVEs
- Automake - 2 CVEs
- Cvs - 2 CVEs
- Findutils - 2 CVEs
- Gettext - 2 CVEs
- Global - 2 CVEs
- Gnu Scientific Library - 2 CVEs
- Gnu Screen - 2 CVEs
- Gnupg - 2 CVEs
- Gpgme - 2 CVEs
- Grep - 2 CVEs
- Grub - 2 CVEs
- Guile - 2 CVEs
- Gv - 2 CVEs
- Indent - 2 CVEs
- Libgcrypt - 2 CVEs
- Libtool - 2 CVEs
- Lsh - 2 CVEs
- M4 - 2 CVEs
- Parallel - 2 CVEs
- Texinfo - 2 CVEs
- Xemacs - 2 CVEs
- Binutils Gold - 1 CVEs
- C Library - 1 CVEs
- Classpath - 1 CVEs
- Data Display Debugger - 1 CVEs
- Diffutils - 1 CVEs
- Escript - 1 CVEs
- Exosip - 1 CVEs
- Finger Service - 1 CVEs
- Flash Player - 1 CVEs
- Flim - 1 CVEs
- G++ - 1 CVEs
- Gama - 1 CVEs
- Gimp - 1 CVEs
- Gnu Patch - 1 CVEs
- Gnulib - 1 CVEs
- Gnumail - 1 CVEs
- Gnumeric - 1 CVEs
- Gnusound - 1 CVEs
- Grub 2 - 1 CVEs
- Grub Legacy - 1 CVEs
- Guixsd - 1 CVEs
- Ibackup - 1 CVEs
- Iceweasel - 1 CVEs
- Ksymoops - 1 CVEs
- Libc - 1 CVEs
- Libgfortran - 1 CVEs
- Libopts - 1 CVEs
- Libssp - 1 CVEs
- Libtool-ltdl - 1 CVEs
- Make - 1 CVEs
- Mtools - 1 CVEs
- Ncurses - 1 CVEs
- Punbb - 1 CVEs
- Queue - 1 CVEs
- Readline - 1 CVEs
- Realtime Linux Security Module - 1 CVEs
- Rush - 1 CVEs
- Sasl - 1 CVEs
- Sccs - 1 CVEs
- Serveez - 1 CVEs
- Tramp - 1 CVEs
- Userv - 1 CVEs
- Aspell Dictionary - 0 CVEs
- Bc - 0 CVEs
- Gnutls Libtasn1 - 0 CVEs
- Icecat - 0 CVEs
- Libgomp - 0 CVEs
- Libunistring - 0 CVEs
- Lightning - 0 CVEs
- Rsync - 0 CVEs
- Zlib - 0 CVEs
Newest CVEs of Gnu
- CVE-2026-118384 - CVSS 6.1 (medium), 2026-10-28: GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.
- CVE-2026-111167 - CVSS 6.9 (medium), 2026-10-15: GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerability in the AcDs decoder acds_private() that allows attackers to read beyond a…
- CVE-2026-103658 - CVSS 5.9 (medium), 2026-10-12: GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader.…
- CVE-2026-108976 - CVSS 7.8 (high), 2026-10-11: GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed…
- CVE-2026-75820 - CVSS 1.8 (low), 2026-10-06: GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal…
- CVE-2026-75819 - CVSS 1.8 (low), 2026-10-06: GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset…
- CVE-2026-75818 - CVSS 1.8 (low), 2026-10-06: GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check…
- CVE-2026-97876 - CVSS 6.4 (medium), 2026-10-02: A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while…
- CVE-2026-100310 - CVSS 7.3 (high), 2026-09-25: GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTOR_PREFIX environment variable without proper privilege…
- CVE-2026-96269 - CVSS 7.5 (high), 2026-09-22: GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and…
- CVE-2026-91782 - CVSS 4.8 (medium), 2026-09-15: A vulnerability was detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_allocate_dynrelocs of the file bfd/elfxx-x86.c of…
- CVE-2026-91781 - CVSS 4.8 (medium), 2026-09-15: A security vulnerability has been detected in GNU Binutils 2.47. Affected is the function elf_x86_64_common_section_index of the file bfd/elf64-x86-64.c of…
- CVE-2026-91780 - CVSS 4.8 (medium), 2026-09-15: A weakness has been identified in GNU Binutils 2.47. This impacts the function elf_link_add_object_symbols of the file bfd/elflink.c. Executing a manipulation…
- CVE-2026-91779 - CVSS 4.8 (medium), 2026-09-15: A security flaw has been discovered in GNU Binutils 2.47. This affects the function _bfd_elf_eh_frame_section_offset of the file bfd/elf-eh-frame.c of the…
- CVE-2026-91752 - CVSS 8.7 (high), 2026-09-15: GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the process_star_office function that sizes a variable-length stack array…
- CVE-2026-90831 - CVSS 5.3 (medium), 2026-09-14: A vulnerability was detected in GNU Binutils 2.47. The affected element is the function _bfd_elf_strtab_delref of the file bfd/elf-strtab.c of the component…
- CVE-2026-90830 - CVSS 5.3 (medium), 2026-09-14: A security vulnerability has been detected in GNU Binutils 2.47. Impacted is the function _bfd_write_merged_section of the file bfd/merge.c of the component…
- CVE-2026-90829 - CVSS 5.3 (medium), 2026-09-14: A weakness has been identified in GNU Binutils 2.47. This issue affects the function bfd_elf_set_group_contents of the file bfd/elf.c of the component…
- CVE-2026-90828 - CVSS 6.6 (medium), 2026-09-14: A security flaw has been discovered in GNU Binutils 2.47. This vulnerability affects the function elf_orphan_compatible of the file ld/ldelf.c of the…
- CVE-2026-90804 - CVSS 6.1 (medium), 2026-09-14: A vulnerability was detected in GNU Binutils 2.47. Affected by this issue is the function _bfd_elf_write_section_eh_frame of the file bfd/elf-eh-frame.c of…
- CVE-2026-90803 - CVSS 6.8 (medium), 2026-09-14: A security vulnerability has been detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_64_relocate_section of the file…
- CVE-2026-90802 - CVSS 4.8 (medium), 2026-09-14: A weakness has been identified in GNU Binutils 2.47. Affected is the function bfd_putl64 of the file bfd/libbfd.c of the component ld. This manipulation…
- CVE-2026-90801 - CVSS 6.6 (medium), 2026-09-14: A security flaw has been discovered in GNU Binutils 2.47. This impacts the function cache_bwrite of the file bfd/cache.c of the component ld. The manipulation…
- CVE-2026-90622 - CVSS 4.8 (medium), 2026-09-14: A security flaw has been discovered in GNU libredwg 0.13.4. This impacts the function DWG_TABLE of the file src/dwg.spec of the component Layer Encoding.…
- CVE-2026-16599 - CVSS 5.1 (medium), 2026-08-25: GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge…
- CVE-2026-77219 - CVSS 7.1 (high), 2026-08-21: GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a…
- CVE-2026-66486 - CVSS 4.6 (medium), 2026-08-10: GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it,…
- CVE-2026-66485 - CVSS 4.6 (medium), 2026-08-10: GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory…
- CVE-2026-66484 - CVSS 4.6 (medium), 2026-08-10: GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the…
- CVE-2026-71394 - CVSS 5.3 (medium), 2026-08-10: GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c. Due to an incorrect comparison variable in the…
