GNU Project vulnerabilities

CVEs per yearBy the year they were published

1. 20172
2. 20234
3. 20252
4. 20261

Newest CVEs

• CVE-2026-109831

  UnRTF by GNU Project is vulnerable to out-of-bounds write. If a user opens an RTF file crafted by an attacker, it may lead to a denial-of-service (DoS)…

  GNU Project · UnRTF

  Medium5.1
• CVE-2025-62689

  NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of…

  GNU Project · GNU libbmicrohttpd

  High8.7
• CVE-2025-59777

  NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of…

  GNU Project · GNU libbmicrohttpd

  High8.7
• CVE-2022-28736

  There's a use-after-free vulnerability in grub_cmd_chainloader() function

  GNU Project · GNU GRUB

  Medium6.4
• CVE-2022-28735

  The GRUB2's shim_lock verifier allows non-kernel files to be loaded on shim-powered secure boot systems. Allowing such files to be loaded may lead to…

  GNU Project · GNU GRUB

  Medium6.7
• CVE-2022-28734

  Out-of-bounds write when handling split HTTP headers

  GNU Project · GNU GRUB

  High8.1
• CVE-2022-28733

  Integer underflow in grub_net_recv_ip4_packets

  GNU Project · GNU GRUB

  High8.1
• CVE-2017-13090

  GNU Wget: heap overflow in HTTP protocol handling

  GNU Project · Wget

  High8.8
• CVE-2017-13089

  GNU Wget: stack overflow in HTTP protocol handling

  GNU Project · Wget

  High8.8