GNU vulnerabilities

CVEs per yearBy the year they were published

1. 20191
2. 20191
3. 20191
4. 20191
5. 20221
6. 20233
7. 20243
8. 202667
9. 202661

Known exploitedNewest addition to KEV first

• CVE-2026-24061

  telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

  GNU · Inetutils

  ExploitedCritical9.8

Newest CVEs

• CVE-2026-118384

  GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c.

  GNU · mtools

  Medium6.1
• CVE-2026-111167

  GNU LibreDWG through 0.14.8612 Out-of-Bounds Read in acds_private AcDs Decoder

  GNU · LibreDWG

  Medium6.9
• CVE-2026-103658

  GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader.…

  GNU · Aspell

  Medium5.9
• CVE-2026-108976

  GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed…

  GNU · Emacs

  High7.8
• CVE-2026-75820

  Integer Truncation Leading to Heap Corruption in GNU Aspell

  GNU · Aspell

  Low1.8
• CVE-2026-75819

  Out-of-bounds Read in GNU Aspell

  GNU · Aspell

  Low1.8
• CVE-2026-75818

  Heap Buffer Overflow in GNU Aspell's prezip utility

  GNU · Aspell

  Low1.8
• CVE-2026-97876

  Bypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base address

  GNU · grub2

  Medium6.4
• CVE-2026-100310

  GNU libextractor before 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX

  GNU · libextractor

  High7.3
• CVE-2026-96269

  GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and…

  GNU · Emacs

  High7.5