[ Vendor · 19 CVEs ]
GNU
CVEs affecting GNU published in the last 30 days, plus any GNU CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-111167 | 15 Oct 2026 | CVSS 6.1 | GNU LibreDWGGNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerability in the AcDs decoder acds_private() that allows attackers to read… | |
| CVE-2026-103658 | 12 Oct 2026 | CVSS 5.9 | GNU AspellGNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader… | |
| CVE-2026-108976 | 11 Oct 2026 | CVSS 7.8 | GNU EmacsGNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of… | |
| CVE-2026-75820 | 6 Oct 2026 | CVSS 1.8 | GNU AspellGNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a… | |
| CVE-2026-75818 | 6 Oct 2026 | CVSS 1.8 | GNU AspellGNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly… | |
| CVE-2026-75819 | 6 Oct 2026 | CVSS 1.8 | GNU AspellGNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it… | |
| CVE-2026-97876 | 2 Oct 2026 | CVSS 6.4 | GNU grub2A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB… | |
| CVE-2026-100310 | 25 Sep 2026 | CVSS 7.0 | GNU libextractorGNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTOR_PREFIX environment variable without proper… | |
| CVE-2026-40553 | 13 Jul 2026 | CVSS 5.1 | GNU gawkBuffer overflow vulnerability has been found in "extension/readdir.c" program file of gawk (ftype() routine). This issue could be used to crash the… | |
| CVE-2026-40468 | 13 Jul 2026 | CVSS 2.1 | GNU gawkInteger overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating… | |
| CVE-2026-40467 | 13 Jul 2026 | CVSS 5.1 | GNU gawkUse After Free vulnerability has been found in "io.c" program file of gawk (do_getline_redir() routine). This issue may lead to a crash. It affects… | |
| CVE-2026-24061 | 21 Jan 2026 | CVSS 9.8 | GNU InetUtils Argument Injectiontelnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable. | ExploitedFix |
| CVE-2023-4911 | 3 Oct 2023 | CVSS 7.8 | GNU C Library Buffer OverflowA buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue… | ExploitedFix |
| CVE-2014-6278 | 30 Sep 2014 | CVSS 8.8 | GNU Bash OS Command InjectionGNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to… | ExploitedFix |
| CVE-2014-6278 | 30 Sep 2014 | CVSS 8.8 | GNU Bash OS Command InjectionGNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to… | ExploitedFix |
| CVE-2014-7169 | 25 Sep 2014 | CVSS 9.8 | GNU Bourne-Again Shell (Bash) Arbitrary Code ExecutionGNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which… | ExploitedFix |
| CVE-2014-7169 | 25 Sep 2014 | CVSS 9.8 | GNU Bourne-Again Shell (Bash) Arbitrary Code ExecutionGNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which… | ExploitedFix |
| CVE-2014-6271 | 24 Sep 2014 | CVSS 9.8 | GNU Bourne-Again Shell (Bash) Arbitrary Code ExecutionGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to… | ExploitedFix |
| CVE-2014-6271 | 24 Sep 2014 | CVSS 9.8 | GNU Bourne-Again Shell (Bash) Arbitrary Code ExecutionGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to… | ExploitedFix |