en
GNU is a global free software project and operating-system initiative. Its core mission is to provide a Unix-compatible system and reusable software packages that preserve users' freedom to run, study, modify, and share software. The project includes widely used command-line tools, libraries, compilers, editors, and development utilities maintained through an open community.
As of 09/14/2026, GNU recorded 28 security vulnerabilities in the last 90 days across 13 products, including 0 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Emacs had the most security vulnerabilities in the GNU ecosystem, with 5 vulnerabilities—approximately 17.86% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-16599Denial of Service in GNU wget | Exploitation statusNot known exploited | FixYes | Affected productwget | Published08/25/2026 | SeverityMedium |
CVE-2026-77219GNU Emacs < 31.0.91 Heap Over-Read via PBM/PPM/PGM Image Loader | Exploitation statusNot known exploited | FixYes | Affected productEmacs | Published08/21/2026 | SeverityMedium |
CVE-2026-66486Improper Output Encoding in GNU cpio | Exploitation statusNot known exploited | FixYes | Affected productcpio | Published08/10/2026 | SeverityMedium |
CVE-2026-66485Uncontrolled Memory Allocation in GNU cpio | Exploitation statusNot known exploited | FixYes | Affected productcpio | Published08/10/2026 | SeverityMedium |
CVE-2026-66484Path Traversal in GNU cpio | Exploitation statusNot known exploited | FixYes | Affected productcpio | Published08/10/2026 | SeverityMedium |
CVE-2026-71394Heap Use of Uninitialized Memory in GNU Emacs for Android | Exploitation statusNot known exploited | FixYes | Affected productEmacs | Published08/10/2026 | SeverityMedium |
CVE-2026-71393Heap Buffer Overflow in GNU Emacs for Android | Exploitation statusNot known exploited | FixYes | Affected productEmacs | Published08/10/2026 | SeverityMedium |
CVE-2026-71392Integer Overflow in GNU Emacs for Android | Exploitation statusNot known exploited | FixYes | Affected productEmacs | Published08/10/2026 | SeverityMedium |
CVE-2026-71391Off-by-One Error in GNU Emacs for Android | Exploitation statusNot known exploited | FixYes | Affected productEmacs | Published08/10/2026 | SeverityMedium |
CVE-2026-18477Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape | Exploitation statusNot known exploited | FixNot confirmed | Affected productRed Hat Enterprise Linux 10 | Published08/03/2026 | SeverityMedium |
CVE-2026-18508Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite | Exploitation statusNot known exploited | FixNot confirmed | Affected productRed Hat Enterprise Linux 10 | Published08/03/2026 | SeverityMedium |
CVE-2026-56390Arbitrary Output Location Change in GNU Bison | Exploitation statusNot known exploited | FixYes | Affected productBison | Published07/29/2026 | SeverityMedium |
CVE-2026-56389Arbitrary Command Execution in GNU Bison | Exploitation statusNot known exploited | FixYes | Affected productBison | Published07/29/2026 | SeverityMedium |
CVE-2026-56392Heap-based Buffer Overflow in GNU coreutils | Exploitation statusNot known exploited | FixYes | Affected productcoreutils | Published07/24/2026 | SeverityLow |
CVE-2026-56391Out‑of‑bounds Read in GNU coreutils | Exploitation statusNot known exploited | FixYes | Affected productcoreutils | Published07/24/2026 | SeverityMedium |
CVE-2026-53910Heap-based Buffer Overflow in GNU diffutils | Exploitation statusNot known exploited | FixYes | Affected productdiffutils | Published07/22/2026 | SeverityLow |
CVE-2026-40553Stack-based buffer overflow in gawk | Exploitation statusNot known exploited | FixYes | Affected productgawk | Published07/13/2026 | SeverityMedium |
CVE-2026-40469Heap buffer overflow in gawk | Exploitation statusNot known exploited | FixYes | Affected productgawk | Published07/13/2026 | SeverityMedium |
CVE-2026-40468Heap buffer overflow in gawk | Exploitation statusNot known exploited | FixYes | Affected productgawk | Published07/13/2026 | SeverityLow |
CVE-2026-40467Use after free in gawk | Exploitation statusNot known exploited | FixYes | Affected productgawk | Published07/13/2026 | SeverityMedium |
CVE-2026-15520GNU LibreDWG R2004 Section Decompression decode.c decompress_R2004_section heap-based overflow | Exploitation statusPublic exploit | FixYes | Affected productLibreDWG | Published07/13/2026 | SeverityMedium |
CVE-2026-15184GNU LibreDWG DWG File dwg.c dwg_next_entity null pointer dereference | Exploitation statusPublic exploit | FixYes | Affected productLibreDWG | Published07/09/2026 | SeverityMedium |
CVE-2026-15182GNU LibreDWG BMP Image dwg.c dwg_bmp heap-based overflow | Exploitation statusPublic exploit | FixYes | Affected productLibreDWG | Published07/09/2026 | SeverityMedium |
CVE-2026-56289Loop with Unreachable Exit Condition in GNU patch | Exploitation statusNot known exploited | FixYes | Affected productpatch | Published07/09/2026 | SeverityMedium |
CVE-2026-56288NULL Pointer Dereference in GNU patch | Exploitation statusNot known exploited | FixYes | Affected productpatch | Published07/09/2026 | SeverityMedium |
CVE-2026-58472GNU Wget 1.25.0 Heap Buffer Overflow via HTML Attribute Encoding | Exploitation statusNot known exploited | FixYes | Affected productwget | Published07/07/2026 | SeverityMedium |
CVE-2026-58471GNU Wget 1.25.0 Heap Buffer Overflow via convert_fname() in url.c | Exploitation statusNot known exploited | FixYes | Affected productwget | Published07/07/2026 | SeverityMedium |
CVE-2026-58470GNU Wget 1.25.0 Integer Overflow via Content-Range Header Parsing | Exploitation statusNot known exploited | FixYes | Affected productwget | Published07/07/2026 | SeverityMedium |
CVE-2026-58469GNU Wget 1.25.0 Heap Buffer Underread via Metalink URL Parsing | Exploitation statusNot known exploited | FixYes | Affected productwget | Published07/07/2026 | SeverityHigh |
CVE-2026-41992Global Buffer Overflow in GNU gzip | Exploitation statusNot known exploited | FixYes | Affected productgzip | Published06/29/2026 | SeverityMedium |
CVE-2026-41991Predictable Temporary File in GNU gzip | Exploitation statusNot known exploited | FixYes | Affected productgzip | Published06/29/2026 | SeverityLow |
CVE-2026-9153Arbitrary File Read in Rapid7 InsightConnect Sed Plugin | Exploitation statusNot known exploited | FixYes | Affected productInsightConnect Sed Plugin | Published06/25/2026 | SeverityMedium |
CVE-2026-9154Arbitrary File Write in Rapid7 InsightConnect Sed Plugin | Exploitation statusNot known exploited | FixYes | Affected productInsightConnect Sed Plugin | Published06/25/2026 | SeverityHigh |
CVE-2026-9155OS Command Injection in Rapid7 InsightConnect Sed Plugin via expression parameter. | Exploitation statusNot known exploited | FixYes | Affected productInsightConnect Sed Plugin | Published06/25/2026 | SeverityHigh |
CVE-2026-57053 | Exploitation statusNot known exploited | FixYes | Affected productlibidn | Published06/23/2026 | SeverityMedium |
CVE-2026-56968 | Exploitation statusNot known exploited | FixYes | Affected productGNU SASL | Published06/23/2026 | SeverityLow |
CVE-2026-56355 | Exploitation statusNot known exploited | FixYes | Affected productSavane | Published06/20/2026 | SeverityLow |
CVE-2026-9605GNU libredwg Dwgbmp Utility bits.c bit_read_RC heap-based overflow | Exploitation statusPublic exploit | FixYes | Affected productLibreDWG | Published05/26/2026 | SeverityMedium |
CVE-2026-9530GNU LibreDWG Dwgbmp Utility decode.c read_2004_compressed_section out-of-bounds | Exploitation statusPublic exploit | FixYes | Affected productLibreDWG | Published05/26/2026 | SeverityMedium |
CVE-2026-9529GNU LibreDWG Dwggrep Utility dwggrep.c match_BLOCK_HEADER null pointer dereference | Exploitation statusPublic exploit | FixNot confirmed | Affected productLibreDWG | Published05/26/2026 | SeverityMedium |
CVE-2026-9504GNU LibreDWG Dwggrep Utility dwggrep.c bit_convert_TU out-of-bounds | Exploitation statusPublic exploit | FixYes | Affected productLibreDWG | Published05/25/2026 | SeverityMedium |
CVE-2026-9503GNU LibreDWG DWG File decode.c dwg_next_entity null pointer dereference | Exploitation statusPublic exploit | FixYes | Affected productLibreDWG | Published05/25/2026 | SeverityMedium |
CVE-2026-9502GNU LibreDWG Dwgread Utility decode.c decompress_R2004_section heap-based overflow | Exploitation statusPublic exploit | FixYes | Affected productLibreDWG | Published05/25/2026 | SeverityMedium |
CVE-2026-9501GNU LibreDWG Dwgread Utility decode.c decompress_R2004_section assertion | Exploitation statusPublic exploit | FixYes | Affected productLibreDWG | Published05/25/2026 | SeverityMedium |
CVE-2026-9500GNU LibreDWG Dwgread Utility decode.c read_2004_compressed_section heap-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productLibreDWG | Published05/25/2026 | SeverityMedium |
CVE-2026-48829 | Exploitation statusNot known exploited | FixYes | Affected productGNU SASL | Published05/24/2026 | SeverityHigh |
CVE-2026-42009Gnutls: gnutls: denial of service via dtls packet reordering vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productRed Hat Enterprise Linux 10 | Published05/18/2026 | SeverityHigh |
CVE-2026-42010Gnutls: gnutls: authentication bypass via nul character in username | Exploitation statusNot known exploited | FixNot confirmed | Affected productRed Hat Enterprise Linux 10 | Published05/07/2026 | SeverityHigh |
CVE-2026-33845Gnutls: gnutls: denial of service via dtls zero-length fragment | Exploitation statusNot known exploited | FixYes | Affected productRed Hat Enterprise Linux 10 | Published04/30/2026 | SeverityHigh |
CVE-2026-3832Gnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp response | Exploitation statusPublic exploit | FixYes | Affected productRed Hat Enterprise Linux 10 | Published04/30/2026 | SeverityLow |
CVE-2026-3833Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison | Exploitation statusPublic exploit | FixYes | Affected productRed Hat Enterprise Linux 10 | Published04/30/2026 | SeverityMedium |
CVE-2026-1858wget2 Improper Certificate Validation | Exploitation statusNot known exploited | FixYes | Affected productwget2 | Published04/29/2026 | SeverityMedium |
CVE-2026-6238Buffer overread in ns_printrrf with corrupted RDATA field | Exploitation statusNot known exploited | FixNot confirmed | Affected productglibc | Published04/28/2026 | SeverityMedium |
CVE-2026-40556 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/28/2026 | SeverityUnknown |
CVE-2026-5435Potential buffer overflow in ns_sprintrrf TSIG handling path | Exploitation statusNot known exploited | FixNot confirmed | Affected productglibc | Published04/28/2026 | SeverityHigh |
CVE-2026-6861Emacs: emacs: memory corruption vulnerability when processing svg css | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published04/22/2026 | SeverityMedium |
CVE-2026-6846Binutils: binutils: arbitrary code execution via malformed xcoff object file processing | Exploitation statusNot known exploited | FixYes | Affected productRed Hat Hardened Images | Published04/22/2026 | SeverityHigh |
CVE-2026-6844Binutils: binutils: denial of service vulnerabilities in readelf via crafted elf files | Exploitation statusNot known exploited | FixNot confirmed | Affected productRed Hat Enterprise Linux 10 | Published04/22/2026 | SeverityMedium |
CVE-2026-6843Nano: nano: format string vulnerability leads to denial of service | Exploitation statusNot known exploited | FixNot confirmed | Affected productRed Hat Enterprise Linux 10 | Published04/22/2026 | SeverityMedium |
CVE-2026-6845Binutils: binutils: denial of service via crafted elf file | Exploitation statusNot known exploited | FixNot confirmed | Affected productRed Hat Hardened Images | Published04/22/2026 | SeverityMedium |
CVE-2026-5450scanf %mc off-by-one heap buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productglibc | Published04/20/2026 | SeverityCritical |
CVE-2026-5928Potential buffer under-read in ungetwc | Exploitation statusPublic exploit | FixYes | Affected productglibc | Published04/20/2026 | SeverityHigh |
CVE-2026-5958Race Condition in GNU Sed | Exploitation statusNot known exploited | FixYes | Affected productSed | Published04/20/2026 | SeverityLow |
CVE-2026-1584Gnutls: gnutls: remote denial of service via crafted clienthello with invalid psk binder | Exploitation statusNot known exploited | FixNot confirmed | Affected productRed Hat Hardened Images | Published04/09/2026 | SeverityHigh |
CVE-2026-5704Tar: tar: hidden file injection via crafted archives | Exploitation statusNot known exploited | FixNot confirmed | Affected productRed Hat Enterprise Linux 10 | Published04/06/2026 | SeverityMedium |
CVE-2026-4046iconv crash due to assertion failure with untrusted input | Exploitation statusPublic exploit | FixYes | Affected productglibc | Published03/30/2026 | SeverityHigh |
CVE-2026-4647Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library | Exploitation statusNot known exploited | FixNot confirmed | Affected productRed Hat Hardened Images | Published03/23/2026 | SeverityMedium |
CVE-2026-4438gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames | Exploitation statusNot known exploited | FixYes | Affected productglibc | Published03/20/2026 | SeverityMedium |
CVE-2026-4437gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response | Exploitation statusNot known exploited | FixYes | Affected productglibc | Published03/20/2026 | SeverityHigh |
CVE-2025-69720 | Exploitation statusPublic exploit | FixYes | Affected productncurses | Published03/19/2026 | SeverityCritical |
CVE-2026-3441Binutils: gnu binutils: information disclosure via specially crafted xcoff object file | Exploitation statusNot known exploited | FixNot confirmed | Affected productRed Hat Hardened Images | Published03/15/2026 | SeverityMedium |
CVE-2026-3442Binutils: gnu binutils: information disclosure or denial of service via out-of-bounds read in bfd linker | Exploitation statusNot known exploited | FixNot confirmed | Affected productRed Hat Hardened Images | Published03/15/2026 | SeverityMedium |
CVE-2026-32772 | Exploitation statusPublic exploit | FixNot confirmed | Affected productinetutils | Published03/13/2026 | SeverityLow |
CVE-2026-32746 | Exploitation statusPublic exploit | FixNot confirmed | Affected productinetutils | Published03/13/2026 | SeverityCritical |
CVE-2025-61154 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published03/12/2026 | SeverityMedium |
CVE-2026-3904 | Exploitation statusNot known exploited | FixYes | Affected productglibc | Published03/11/2026 | SeverityMedium |
CVE-2025-69647 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published03/09/2026 | SeverityMedium |
CVE-2025-69648 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published03/09/2026 | SeverityMedium |
CVE-2025-69644 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published03/06/2026 | SeverityMedium |
CVE-2025-69651 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published03/06/2026 | SeverityMedium |
CVE-2025-69649 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published03/06/2026 | SeverityMedium |
CVE-2025-69645 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published03/06/2026 | SeverityMedium |
CVE-2025-69650 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published03/06/2026 | SeverityHigh |
CVE-2025-69646 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published03/06/2026 | SeverityMedium |
CVE-2025-69652 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published03/06/2026 | SeverityMedium |
CVE-2026-28372 | Exploitation statusPublic exploit | FixNot confirmed | Affected productinetutils | Published02/27/2026 | SeverityHigh |
CVE-2026-24061 | Exploitation statusKEV | FixNot confirmed | Affected productinetutils | Published01/21/2026 | SeverityCritical |
CVE-2025-15281wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory | Exploitation statusNot known exploited | FixYes | Affected productglibc | Published01/20/2026 | SeverityHigh |
CVE-2026-0915getnetbyaddr and getnetbyaddr_r leak stack contents to DNS resovler | Exploitation statusPublic exploit | FixYes | Affected productglibc | Published01/15/2026 | SeverityHigh |
CVE-2026-0861Integer overflow in memalign leads to heap corruption | Exploitation statusNot known exploited | FixYes | Affected productglibc | Published01/14/2026 | SeverityHigh |
CVE-2025-69195Wget2: gnu wget2: memory corruption and crash via filename sanitization logic with attacker-controlled urls | Exploitation statusNot known exploited | FixYes | Affected productwget2 | Published01/09/2026 | SeverityHigh |
CVE-2025-69194Wget2: arbitrary file write via metalink path traversal in gnu wget2 | Exploitation statusNot known exploited | FixYes | Affected productwget2 | Published01/09/2026 | SeverityHigh |
CVE-2025-13151 | Exploitation statusNot known exploited | FixYes | Affected productlibtasn1 | Published01/07/2026 | SeverityHigh |
CVE-2025-65409 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published12/30/2025 | SeverityHigh |
CVE-2025-66861 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published12/29/2025 | SeverityLow |
CVE-2025-66865 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published12/29/2025 | SeverityHigh |
CVE-2025-66866 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published12/29/2025 | SeverityMedium |
CVE-2025-66864 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published12/29/2025 | SeverityMedium |
CVE-2025-66862 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published12/29/2025 | SeverityHigh |
CVE-2025-66863 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published12/29/2025 | SeverityHigh |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
