GNU vulnerabilities

CVEs per yearBy the year they were published

1. 20194
2. 20221
3. 20233
4. 20243
5. 202560
6. 202668

Known exploitedNewest addition to KEV first

• CVE-2026-24061

  telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

  GNU · Inetutils

  ExploitedCritical9.8

Newest CVEs

• CVE-2026-118384

  GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c.

  GNU · mtools

  Medium6.1
• CVE-2026-111167

  GNU LibreDWG through 0.14.8612 Out-of-Bounds Read in acds_private AcDs Decoder

  GNU · LibreDWG

  Medium6.9
• CVE-2026-103658

  GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader.…

  GNU · Aspell

  Medium5.9
• CVE-2026-108976

  GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed…

  GNU · Emacs

  High7.8
• CVE-2026-75820

  Integer Truncation Leading to Heap Corruption in GNU Aspell

  GNU · Aspell

  Low1.8
• CVE-2026-75819

  Out-of-bounds Read in GNU Aspell

  GNU · Aspell

  Low1.8
• CVE-2026-75818

  Heap Buffer Overflow in GNU Aspell's prezip utility

  GNU · Aspell

  Low1.8
• CVE-2026-97876

  Bypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base address

  GNU · grub2

  Medium6.4
• CVE-2026-100310

  GNU libextractor before 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX

  GNU · libextractor

  High7.3
• CVE-2026-96269

  GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and…

  GNU · Emacs

  High7.5