[ Vendor · 10 CVEs ]
GNOME
CVEs affecting GNOME published in the last 30 days, plus any GNOME CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-111132 | 15 Oct 2026 | CVSS 6.1 | GNOME libgxpsGNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_start_element() that allows attackers to read past allocations via… | |
| CVE-2026-110777 | 14 Oct 2026 | CVSS 5.7 | GNOME evolution-data-serverA flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local… | |
| CVE-2026-91838 | 25 Sep 2026 | CVSS 7.8 | GNOME NetworkManager-sstpA flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by… | |
| CVE-2026-91839 | 25 Sep 2026 | CVSS 7.8 | GNOME NetworkManager-fortisslvpnA flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm-fortisslvpn-service improperly handles… | |
| CVE-2026-91840 | 25 Sep 2026 | CVSS 7.8 | GNOME NetworkManager-vpncA flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline… | |
| CVE-2026-91841 | 25 Sep 2026 | CVSS 7.8 | GNOME NetworkManager-vpncA flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a… | |
| CVE-2026-91837 | 25 Sep 2026 | CVSS 7.8 | GNOME NetworkManager-iodineA flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. A local unprivileged user can exploit a vulnerability in how the… | |
| CVE-2026-97222 | 25 Sep 2026 | CVSS 5.5 | GNOME GnumericA heap use-after-free flaw was found in Gnumeric. When a user opens a crafted Gnumeric workbook containing a malformed SheetObjectComponent element… | |
| CVE-2026-88924 | 10 Sep 2026 | CVSS 7.0 | GNOME gvfsA flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by… | |
| CVE-2026-84268 | 1 Sep 2026 | CVSS 8.8 | GNOME gvfsA flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a… |